Analysis Report PO_010-240.exe

Overview

General Information

Sample Name: PO_010-240.exe
Analysis ID: 322367
MD5: 9c827b2d04fd53e767ee0d2413d99185
SHA1: 5ab0d449f17e2aefa298a16d938dfa5c97a756a9
SHA256: d30cc9d8ea941300167901e21d771b2df8164a5dad45e120b9e716dd6e9744e5

Most interesting Screenshot:

Detection

AgentTesla GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: RegAsm connects to smtp port
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected GuLoader
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: RegAsm.exe.6264.8.memstr Malware Configuration Extractor: Agenttesla {"Username: ": "Igjkc0HpN", "URL: ": "http://ve2IyZTobSOfG5Vf.com", "To: ": "officesales@jtceh.com", "ByHost: ": "mail.jtceh.com:587", "Password: ": "=0AmHJaHF", "From: ": "officesales@jtceh.com"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\sore\PREIMBUED.exe ReversingLabs: Detection: 41%
Multi AV Scanner detection for submitted file
Source: PO_010-240.exe Virustotal: Detection: 20% Perma Link
Source: PO_010-240.exe ReversingLabs: Detection: 41%

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49738 -> 162.213.255.53:587
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49738 -> 162.213.255.53:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 184.73.247.141 184.73.247.141
Source: Joe Sandbox View IP Address: 184.73.247.141 184.73.247.141
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.3:49738 -> 162.213.255.53:587
Source: unknown DNS traffic detected: queries for: jtceh.com
Source: RegAsm.exe, 00000001.00000002.292786482.000000001D4F1000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: http://DuWwST.com
Source: RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: RegAsm.exe, 00000008.00000002.1278287252.0000000001346000.00000004.00000020.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: RegAsm.exe, 00000008.00000003.488927857.0000000000EC1000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: RegAsm.exe, 00000008.00000003.488927857.0000000000EC1000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
Source: RegAsm.exe, 00000008.00000003.518140961.000000000135A000.00000004.00000001.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: RegAsm.exe, 00000008.00000002.1283623530.000000001DEDC000.00000004.00000001.sdmp String found in binary or memory: http://mail.jtceh.com
Source: RegAsm.exe, 00000008.00000002.1278287252.0000000001346000.00000004.00000020.sdmp, RegAsm.exe, 00000008.00000003.488927857.0000000000EC1000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: RegAsm.exe, 00000008.00000003.518140961.000000000135A000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.sectigo.com0#
Source: RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000008.00000002.1283218914.000000001DBA6000.00000004.00000001.sdmp String found in binary or memory: http://ve2IyZTobSOfG5Vf.com
Source: RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org
Source: RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org/
Source: RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: RegAsm.exe, 00000001.00000002.292786482.000000001D4F1000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: RegAsm.exe String found in binary or memory: https://jtceh.com/oficework_AJmKD179.bin
Source: RegAsm.exe, 00000008.00000003.518140961.000000000135A000.00000004.00000001.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: RegAsm.exe, 00000008.00000003.488927857.0000000000EC1000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: RegAsm.exe, 00000001.00000002.292786482.000000001D4F1000.00000004.00000001.sdmp, RegAsm.exe, 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: PO_010-240.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B653C NtResumeThread, 0_2_029B653C
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B269D NtWriteVirtualMemory, 0_2_029B269D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00965D45 NtProtectVirtualMemory, 1_2_00965D45
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 6_2_02BE269D NtWriteVirtualMemory, 6_2_02BE269D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F8622C LoadLibraryA,NtQueryInformationProcess, 8_2_00F8622C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F85D45 NtProtectVirtualMemory, 8_2_00F85D45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F862E3 NtQueryInformationProcess, 8_2_00F862E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F862BC NtQueryInformationProcess, 8_2_00F862BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F862B1 NtQueryInformationProcess, 8_2_00F862B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F864A3 NtQueryInformationProcess, 8_2_00F864A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F86472 NtQueryInformationProcess, 8_2_00F86472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F8626F NtQueryInformationProcess, 8_2_00F8626F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F86449 NtQueryInformationProcess, 8_2_00F86449
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F86245 NtQueryInformationProcess, 8_2_00F86245
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F86420 NtQueryInformationProcess, 8_2_00F86420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F863FB NtQueryInformationProcess, 8_2_00F863FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F863D4 NtQueryInformationProcess, 8_2_00F863D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F863AD NtQueryInformationProcess, 8_2_00F863AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F86383 NtQueryInformationProcess, 8_2_00F86383
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F86565 NtQueryInformationProcess, 8_2_00F86565
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F8634F NtQueryInformationProcess, 8_2_00F8634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F8653C NtQueryInformationProcess, 8_2_00F8653C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F86328 NtQueryInformationProcess, 8_2_00F86328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F86306 NtQueryInformationProcess, 8_2_00F86306
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 9_2_02152722 NtWriteVirtualMemory, 9_2_02152722
Detected potential crypto function
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405847 0_2_00405847
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405C4D 0_2_00405C4D
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405C59 0_2_00405C59
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040585C 0_2_0040585C
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405C62 0_2_00405C62
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405471 0_2_00405471
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405403 0_2_00405403
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405C0B 0_2_00405C0B
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040580D 0_2_0040580D
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405C21 0_2_00405C21
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040582E 0_2_0040582E
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405433 0_2_00405433
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405CC2 0_2_00405CC2
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004054D0 0_2_004054D0
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004054E5 0_2_004054E5
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405CE9 0_2_00405CE9
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004058F4 0_2_004058F4
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004054FB 0_2_004054FB
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004058FF 0_2_004058FF
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405C82 0_2_00405C82
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405899 0_2_00405899
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405CB4 0_2_00405CB4
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405940 0_2_00405940
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040554C 0_2_0040554C
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405D4F 0_2_00405D4F
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405961 0_2_00405961
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405975 0_2_00405975
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040551B 0_2_0040551B
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040591D 0_2_0040591D
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405D2B 0_2_00405D2B
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00408DC6 0_2_00408DC6
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405DE4 0_2_00405DE4
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004059EC 0_2_004059EC
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405987 0_2_00405987
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040559D 0_2_0040559D
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004059A5 0_2_004059A5
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004059B8 0_2_004059B8
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405656 0_2_00405656
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405E79 0_2_00405E79
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405A7D 0_2_00405A7D
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405A02 0_2_00405A02
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405E05 0_2_00405E05
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405A1A 0_2_00405A1A
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405630 0_2_00405630
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405E38 0_2_00405E38
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004056D3 0_2_004056D3
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405AD8 0_2_00405AD8
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405EDD 0_2_00405EDD
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405AE9 0_2_00405AE9
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405A88 0_2_00405A88
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405E8A 0_2_00405E8A
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040568B 0_2_0040568B
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405A94 0_2_00405A94
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405AA4 0_2_00405AA4
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004056A6 0_2_004056A6
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405EAA 0_2_00405EAA
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004056B6 0_2_004056B6
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405753 0_2_00405753
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405B57 0_2_00405B57
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405765 0_2_00405765
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040576E 0_2_0040576E
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405B7E 0_2_00405B7E
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405710 0_2_00405710
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040572A 0_2_0040572A
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040533E 0_2_0040533E
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004057C4 0_2_004057C4
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405BC9 0_2_00405BC9
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004057D6 0_2_004057D6
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405BDD 0_2_00405BDD
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004057F4 0_2_004057F4
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_00405BF9 0_2_00405BF9
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040538C 0_2_0040538C
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_004057A1 0_2_004057A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00962AA3 1_2_00962AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_1F6046A0 1_2_1F6046A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_1F60D310 1_2_1F60D310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_1F604630 1_2_1F604630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_1F604690 1_2_1F604690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F82AA3 8_2_00F82AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_1D9B46A0 8_2_1D9B46A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_1D9BD300 8_2_1D9BD300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_1D9B4690 8_2_1D9B4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_1D9B4672 8_2_1D9B4672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20C13258 8_2_20C13258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20C1D548 8_2_20C1D548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20C197E0 8_2_20C197E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DD64B8 8_2_20DD64B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DD5758 8_2_20DD5758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DDF740 8_2_20DDF740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DDB148 8_2_20DDB148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DFCC90 8_2_20DFCC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DF6088 8_2_20DF6088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DF122F 8_2_20DF122F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DFAB80 8_2_20DFAB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DF71B0 8_2_20DF71B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DFC2D0 8_2_20DFC2D0
PE file contains strange resources
Source: PO_010-240.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PO_010-240.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PREIMBUED.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PREIMBUED.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: PO_010-240.exe, 00000000.00000002.239094748.0000000002980000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs PO_010-240.exe
Source: PO_010-240.exe, 00000000.00000000.193908141.0000000000411000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameFrai.exe vs PO_010-240.exe
Source: PO_010-240.exe Binary or memory string: OriginalFilenameFrai.exe vs PO_010-240.exe
Tries to load missing DLLs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@12/2@5/2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\sore Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6080:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6372:120:WilError_01
Source: C:\Users\user\Desktop\PO_010-240.exe File created: C:\Users\user\AppData\Local\Temp\~DF6936BBC87031E172.TMP Jump to behavior
Source: PO_010-240.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PO_010-240.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\PO_010-240.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: PO_010-240.exe Virustotal: Detection: 20%
Source: PO_010-240.exe ReversingLabs: Detection: 41%
Source: unknown Process created: C:\Users\user\Desktop\PO_010-240.exe 'C:\Users\user\Desktop\PO_010-240.exe'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO_010-240.exe'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\sore\PREIMBUED.exe 'C:\Users\user\sore\PREIMBUED.exe'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\sore\PREIMBUED.exe'
Source: unknown Process created: C:\Users\user\sore\PREIMBUED.exe 'C:\Users\user\sore\PREIMBUED.exe'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\sore\PREIMBUED.exe'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO_010-240.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO_010-240.exe' Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\sore\PREIMBUED.exe' Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\sore\PREIMBUED.exe' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6264, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6072, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6432, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040BD33 push cs; ret 0_2_0040BD34
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040AD97 push ds; retf 0_2_0040AF10
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040AE05 push ds; retf 0_2_0040AF10
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_0040BE17 push cs; ret 0_2_0040BE18
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B569B push esp; retf 0_2_029B569C
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B2A12 push ebp; rep ret 0_2_029B2A98
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B5624 push ds; ret 0_2_029B5687
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B2A55 push ebp; rep ret 0_2_029B2A98
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B364A push ds; retf 0_2_029B364F
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B0E45 push ds; ret 0_2_029B0E93
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B109B push edi; ret 0_2_029B10D8
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B25BC push edx; ret 0_2_029B25EC
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B4D09 push ds; retf 0_2_029B4D1B
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 6_2_02BE109A push edi; ret 6_2_02BE10D8
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 6_2_02BE5697 push esp; retf 6_2_02BE569C
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 6_2_02BE140B push esi; ret 6_2_02BE152B
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 6_2_02BE25BC push edx; ret 6_2_02BE25EC
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 6_2_02BE0F2C push edi; ret 6_2_02BE10D8
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 6_2_02BE151A push esi; ret 6_2_02BE152B
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 6_2_02BE4112 push edx; retf 6_2_02BE411C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_1D9B3349 push cs; retf 001Fh 8_2_1D9B334A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_20DF47CA push 8BFFFFFFh; retf 8_2_20DF47D0
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 9_2_02150A37 push 37480215h; retf 9_2_02150A46
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 9_2_02152620 push edx; ret 9_2_021525EC
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 9_2_02153A20 push edx; retf 9_2_02153A21
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 9_2_02152A95 push ebp; rep ret 9_2_02152A98
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 9_2_02155697 push esp; retf 9_2_0215569C
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 9_2_021525BC push edx; ret 9_2_021525EC
Source: C:\Users\user\sore\PREIMBUED.exe Code function: 9_2_021527A6 push E22BA338h; ret 9_2_021527AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_011356C5 push edi; ret 11_2_011356C7

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\sore\PREIMBUED.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce PROLOGISIN Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce PROLOGISIN Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce PROLOGISIN Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce PROLOGISIN Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\PO_010-240.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_010-240.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_010-240.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_010-240.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_010-240.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_010-240.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO_010-240.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect Any.run
Source: C:\Users\user\Desktop\PO_010-240.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\PO_010-240.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: RegAsm.exe Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_0096622C rdtsc 1_2_0096622C
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 3126 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 6702 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 608 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 9247 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\sore\PREIMBUED.exe API coverage: 4.2 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 772 Thread sleep time: -26747778906878833s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7024 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7028 Thread sleep count: 608 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7028 Thread sleep count: 9247 > 30 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: RegAsm.exe, 00000001.00000002.294011273.0000000020030000.00000002.00000001.sdmp, RegAsm.exe, 00000008.00000002.1284536082.00000000206F0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: RegAsm.exe, 00000008.00000002.1278287252.0000000001346000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000001.00000002.294011273.0000000020030000.00000002.00000001.sdmp, RegAsm.exe, 00000008.00000002.1284536082.00000000206F0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: RegAsm.exe Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: RegAsm.exe, 00000001.00000002.294011273.0000000020030000.00000002.00000001.sdmp, RegAsm.exe, 00000008.00000002.1284536082.00000000206F0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: RegAsm.exe, 00000001.00000002.294011273.0000000020030000.00000002.00000001.sdmp, RegAsm.exe, 00000008.00000002.1284536082.00000000206F0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\PO_010-240.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PO_010-240.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_0096622C rdtsc 1_2_0096622C
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO_010-240.exe Code function: 0_2_029B3B84 LdrInitializeThunk, 0_2_029B3B84
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_009658A0 mov eax, dword ptr fs:[00000030h] 1_2_009658A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_009650F2 mov eax, dword ptr fs:[00000030h] 1_2_009650F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00965875 mov eax, dword ptr fs:[00000030h] 1_2_00965875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00962BA5 mov eax, dword ptr fs:[00000030h] 1_2_00962BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00964D47 mov eax, dword ptr fs:[00000030h] 1_2_00964D47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F850F2 mov eax, dword ptr fs:[00000030h] 8_2_00F850F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F858A0 mov eax, dword ptr fs:[00000030h] 8_2_00F858A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F85875 mov eax, dword ptr fs:[00000030h] 8_2_00F85875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F82BA5 mov eax, dword ptr fs:[00000030h] 8_2_00F82BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 8_2_00F84D47 mov eax, dword ptr fs:[00000030h] 8_2_00F84D47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_01134D47 mov eax, dword ptr fs:[00000030h] 11_2_01134D47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_01131D69 mov eax, dword ptr fs:[00000030h] 11_2_01131D69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_01131D6C mov eax, dword ptr fs:[00000030h] 11_2_01131D6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_01135875 mov eax, dword ptr fs:[00000030h] 11_2_01135875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_0113148C mov eax, dword ptr fs:[00000030h] 11_2_0113148C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_011358A0 mov eax, dword ptr fs:[00000030h] 11_2_011358A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_011350F2 mov eax, dword ptr fs:[00000030h] 11_2_011350F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_01131B25 mov eax, dword ptr fs:[00000030h] 11_2_01131B25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 11_2_01132BAC mov eax, dword ptr fs:[00000030h] 11_2_01132BAC
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\PO_010-240.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 960000 Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F80000 Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1130000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO_010-240.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\PO_010-240.exe' Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\sore\PREIMBUED.exe' Jump to behavior
Source: C:\Users\user\sore\PREIMBUED.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\sore\PREIMBUED.exe' Jump to behavior
Source: RegAsm.exe, 00000008.00000002.1278698422.00000000017E0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: RegAsm.exe, 00000008.00000002.1278698422.00000000017E0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000008.00000002.1278698422.00000000017E0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: RegAsm.exe, 00000008.00000002.1278698422.00000000017E0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: unknown VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000001.00000002.292786482.000000001D4F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1283218914.000000001DBA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6264, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6072, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000001.00000002.292786482.000000001D4F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1283218914.000000001DBA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6264, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6072, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000001.00000002.292786482.000000001D4F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1283147601.000000001DB51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1283218914.000000001DBA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6264, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6072, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 322367 Sample: PO_010-240.exe Startdate: 25/11/2020 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 6 other signatures 2->45 7 PREIMBUED.exe 1 2->7         started        10 PO_010-240.exe 1 2->10         started        12 PREIMBUED.exe 1 2->12         started        process3 signatures4 47 Multi AV Scanner detection for dropped file 7->47 49 Writes to foreign memory regions 7->49 51 Tries to detect Any.run 7->51 14 RegAsm.exe 15 10 7->14         started        53 Hides threads from debuggers 10->53 18 RegAsm.exe 1 11 10->18         started        21 RegAsm.exe 1 12->21         started        process5 dnsIp6 31 mail.jtceh.com 14->31 33 elb097307-934924932.us-east-1.elb.amazonaws.com 184.73.247.141, 443, 49737 AMAZON-AESUS United States 14->33 37 2 other IPs or domains 14->37 55 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->55 57 Tries to steal Mail credentials (via file access) 14->57 59 Tries to harvest and steal ftp login credentials 14->59 67 3 other signatures 14->67 23 conhost.exe 14->23         started        35 jtceh.com 162.213.255.53, 443, 49723, 49729 NAMECHEAP-NETUS United States 18->35 29 C:\Users\user\sore\PREIMBUED.exe, PE32 18->29 dropped 61 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->61 63 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 18->63 65 Tries to detect Any.run 18->65 25 conhost.exe 18->25         started        27 conhost.exe 21->27         started        file7 signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.213.255.53
 unknown United States
22612 NAMECHEAP-NETUS true
184.73.247.141
 unknown United States
14618 AMAZON-AESUS false

Contacted Domains

Name IP Active
elb097307-934924932.us-east-1.elb.amazonaws.com 184.73.247.141 true
mail.jtceh.com 162.213.255.53 true
jtceh.com 162.213.255.53 true
api.ipify.org unknown unknown