Analysis Report New Inquiry015 02-12-2020.exe

Overview

General Information

Sample Name: New Inquiry015 02-12-2020.exe
Analysis ID: 326332
MD5: 927fab3ec236804c2a332e74eebfc470
SHA1: 9d53579e681124074b4c568d01bc3a405d55bd89
SHA256: 52eaa2efa586bbcabbba08c6bb8f4b139ef7133c3f8fd1e5df73b19412b73acd
Tags: AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains very large strings
Installs a global keyboard hook
Machine Learning detection for sample
Moves itself to temp directory
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: New Inquiry015 02-12-2020.exe.5020.1.memstr Malware Configuration Extractor: Agenttesla {"Username: ": "WVWbQTBst", "URL: ": "https://K10aXlbvtt.com", "To: ": "markchez@divasvalves.com", "ByHost: ": "smtp.divasvalves.com:587", "Password: ": "FfVLcmdRdZNwTBR", "From: ": "markchez@divasvalves.com"}
Multi AV Scanner detection for submitted file
Source: New Inquiry015 02-12-2020.exe ReversingLabs: Detection: 29%
Machine Learning detection for sample
Source: New Inquiry015 02-12-2020.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.New Inquiry015 02-12-2020.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49765 -> 208.91.198.143:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49766 -> 208.91.198.143:587
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49765 -> 208.91.198.143:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.91.198.143 208.91.198.143
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.4:49765 -> 208.91.198.143:587
Source: unknown DNS traffic detected: queries for: smtp.divasvalves.com
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: http://oTGuDm.com
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924894293.0000000002E30000.00000004.00000001.sdmp String found in binary or memory: http://smtp.divasvalves.com
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924894293.0000000002E30000.00000004.00000001.sdmp String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924874628.0000000002E2A000.00000004.00000001.sdmp, New Inquiry015 02-12-2020.exe, 00000001.00000002.924894293.0000000002E30000.00000004.00000001.sdmp, New Inquiry015 02-12-2020.exe, 00000001.00000002.924919189.0000000002E3B000.00000004.00000001.sdmp String found in binary or memory: https://K10aXlbvtt.com
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org/
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664540986.00000000041B9000.00000004.00000001.sdmp, New Inquiry015 02-12-2020.exe, 00000001.00000002.922075853.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664540986.00000000041B9000.00000004.00000001.sdmp, New Inquiry015 02-12-2020.exe, 00000001.00000002.922075853.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
.NET source code contains very large strings
Source: New Inquiry015 02-12-2020.exe, ???Nw?Aax?/?NNGUzSDD.cs Long String: Length: 81136
Source: 0.0.New Inquiry015 02-12-2020.exe.e80000.0.unpack, ???Nw?Aax?/?NNGUzSDD.cs Long String: Length: 81136
Source: 0.2.New Inquiry015 02-12-2020.exe.e80000.0.unpack, ???Nw?Aax?/?NNGUzSDD.cs Long String: Length: 81136
Source: 1.2.New Inquiry015 02-12-2020.exe.660000.1.unpack, ???Nw?Aax?/?NNGUzSDD.cs Long String: Length: 81136
Source: 1.0.New Inquiry015 02-12-2020.exe.660000.0.unpack, ???Nw?Aax?/?NNGUzSDD.cs Long String: Length: 81136
Detected potential crypto function
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 0_2_0186A458 0_2_0186A458
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 0_2_0186A908 0_2_0186A908
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 0_2_01869CF0 0_2_01869CF0
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 0_2_01867F70 0_2_01867F70
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 0_2_018669F8 0_2_018669F8
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 0_2_01867F7F 0_2_01867F7F
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 0_2_00E8AFE1 0_2_00E8AFE1
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F059E8 1_3_00F059E8
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F059E8 1_3_00F059E8
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F07A6D 1_3_00F07A6D
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F07A6D 1_3_00F07A6D
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F059E8 1_3_00F059E8
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F059E8 1_3_00F059E8
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F07A6D 1_3_00F07A6D
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F07A6D 1_3_00F07A6D
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_2_01074860 1_2_01074860
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_2_0107479C 1_2_0107479C
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_2_0107DBE0 1_2_0107DBE0
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_2_0066AFE1 1_2_0066AFE1
Sample file is different than original file name gathered from version info
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664540986.00000000041B9000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameGlaxoSmithKline.dll@ vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664540986.00000000041B9000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameWIYmGNmapMQZHggtdqutGY.exe4 vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.663286315.0000000000F26000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameComparison.exe@ vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.670641867.0000000026FC0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameNT1.dll, vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.922245030.0000000000706000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameComparison.exe@ vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.922075853.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameWIYmGNmapMQZHggtdqutGY.exe4 vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.922937289.0000000000E1A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.929285312.0000000006000000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamewshom.ocx vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.929035704.0000000005BA0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamewshom.ocx.mui vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.922306655.0000000000AF8000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.929737664.0000000006960000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe Binary or memory string: OriginalFilenameComparison.exe@ vs New Inquiry015 02-12-2020.exe
Source: New Inquiry015 02-12-2020.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/1
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Inquiry015 02-12-2020.exe.log Jump to behavior
Source: New Inquiry015 02-12-2020.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: New Inquiry015 02-12-2020.exe ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File read: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe:Zone.Identifier Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe 'C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe'
Source: unknown Process created: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process created: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: New Inquiry015 02-12-2020.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: New Inquiry015 02-12-2020.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 0_2_0186C870 push esp; retf 0_2_0186C871
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F0C8D5 pushad ; iretd 1_3_00F0C8D6
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F0C8D5 pushad ; iretd 1_3_00F0C8D6
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F09715 pushad ; iretd 1_3_00F09716
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F09715 pushad ; iretd 1_3_00F09716
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F0C8D5 pushad ; iretd 1_3_00F0C8D6
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F0C8D5 pushad ; iretd 1_3_00F0C8D6
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F09715 pushad ; iretd 1_3_00F09716
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Code function: 1_3_00F09715 pushad ; iretd 1_3_00F09716
Source: initial sample Static PE information: section name: .text entropy: 6.982280721

Hooking and other Techniques for Hiding and Protection:

barindex
Moves itself to temp directory
Source: c:\users\user\desktop\new inquiry015 02-12-2020.exe File moved: C:\Users\user\AppData\Local\Temp\tmpG492.tmp Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM_3
Source: Yara match File source: 00000000.00000002.664139555.00000000031B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: New Inquiry015 02-12-2020.exe PID: 6188, type: MEMORY
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664139555.00000000031B1000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664139555.00000000031B1000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Window / User API: threadDelayed 765 Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Window / User API: threadDelayed 9095 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe TID: 2460 Thread sleep time: -50614s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe TID: 6268 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe TID: 5128 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe TID: 6004 Thread sleep count: 765 > 30 Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe TID: 6004 Thread sleep count: 9095 > 30 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664139555.00000000031B1000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664139555.00000000031B1000.00000004.00000001.sdmp Binary or memory string: vmware
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664139555.00000000031B1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.923060743.0000000000E94000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: New Inquiry015 02-12-2020.exe, 00000000.00000002.664139555.00000000031B1000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Process created: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Jump to behavior
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924062326.00000000014A0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924062326.00000000014A0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924062326.00000000014A0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: New Inquiry015 02-12-2020.exe, 00000001.00000002.924062326.00000000014A0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000001.00000002.922075853.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.664540986.00000000041B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: New Inquiry015 02-12-2020.exe PID: 6188, type: MEMORY
Source: Yara match File source: Process Memory Space: New Inquiry015 02-12-2020.exe PID: 5020, type: MEMORY
Source: Yara match File source: 1.2.New Inquiry015 02-12-2020.exe.400000.0.unpack, type: UNPACKEDPE
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\New Inquiry015 02-12-2020.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000001.00000002.924429396.0000000002AED000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: New Inquiry015 02-12-2020.exe PID: 5020, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000001.00000002.922075853.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.664540986.00000000041B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.924388701.0000000002AB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: New Inquiry015 02-12-2020.exe PID: 6188, type: MEMORY
Source: Yara match File source: Process Memory Space: New Inquiry015 02-12-2020.exe PID: 5020, type: MEMORY
Source: Yara match File source: 1.2.New Inquiry015 02-12-2020.exe.400000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 326332 Sample: New Inquiry015 02-12-2020.exe Startdate: 03/12/2020 Architecture: WINDOWS Score: 100 19 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->19 21 Found malware configuration 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 7 other signatures 2->25 6 New Inquiry015 02-12-2020.exe 1 2->6         started        process3 file4 13 C:\...13ew Inquiry015 02-12-2020.exe.log, ASCII 6->13 dropped 9 New Inquiry015 02-12-2020.exe 15 6 6->9         started        process5 dnsIp6 15 smtp.divasvalves.com 9->15 17 us2.smtp.mailhostbox.com 208.91.198.143, 49765, 49766, 587 PUBLIC-DOMAIN-REGISTRYUS United States 9->17 27 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 9->27 29 Moves itself to temp directory 9->29 31 Tries to steal Mail credentials (via file access) 9->31 33 3 other signatures 9->33 signatures7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.91.198.143
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false

Contacted Domains

Name IP Active
us2.smtp.mailhostbox.com 208.91.198.143 true
smtp.divasvalves.com unknown unknown