Analysis Report AE-808_RAJEN.exe

Overview

General Information

Sample Name: AE-808_RAJEN.exe
Analysis ID: 344977
MD5: 208f2494a82c3b830d676c187e1f03d1
SHA1: 98f350298f0b61cfd94c73bca51ef61802188527
SHA256: a659c50e03822cd595bf5d21007b2870fda97b6d4a5d3840d68bf8f333cc47ea
Tags: AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AntiVM_3
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: AE-808_RAJEN.exe.2912.1.memstr Malware Configuration Extractor: Agenttesla {"Username: ": "=0AcmYy16kpc", "URL: ": "https://EiR6SA0ya1Q.org", "To: ": "bluez@hisensetech.gq", "ByHost: ": "server116.web-hosting.com:587", "Password: ": "=0AvNB2DkamI", "From: ": "bluezlog@hisensetech.gq"}
Multi AV Scanner detection for submitted file
Source: AE-808_RAJEN.exe Virustotal: Detection: 35% Perma Link
Source: AE-808_RAJEN.exe ReversingLabs: Detection: 36%
Machine Learning detection for sample
Source: AE-808_RAJEN.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.AE-808_RAJEN.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: AE-808_RAJEN.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: AE-808_RAJEN.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49779 -> 68.65.122.156:587
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://EiR6SA0ya1Q.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 68.65.122.156:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.4:49779 -> 68.65.122.156:587
Source: unknown DNS traffic detected: queries for: server116.web-hosting.com
Source: AE-808_RAJEN.exe, 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: AE-808_RAJEN.exe, 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: AE-808_RAJEN.exe, 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp String found in binary or memory: http://lOlcWJ.com
Source: AE-808_RAJEN.exe, 00000000.00000002.654461075.0000000002B91000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AE-808_RAJEN.exe, 00000001.00000002.1032679809.00000000036A5000.00000004.00000001.sdmp String found in binary or memory: http://server116.web-hosting.com
Source: AE-808_RAJEN.exe String found in binary or memory: http://simpletimelapse.sourceforge.net/update/version.txt?Refresh=
Source: AE-808_RAJEN.exe, 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp String found in binary or memory: https://EiR6SA0ya1Q.or
Source: AE-808_RAJEN.exe, 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp String found in binary or memory: https://EiR6SA0ya1Q.org
Source: AE-808_RAJEN.exe String found in binary or memory: https://api.lightboot.org/panel/index.php?page=Api&key=b6udeJ2WqDoyHKzzsEjfG3QajboCjeJv&host=
Source: AE-808_RAJEN.exe String found in binary or memory: https://ffmpeg.org
Source: AE-808_RAJEN.exe String found in binary or memory: https://simpletimelapse.sourceforge.io/update/changelog.txt
Source: AE-808_RAJEN.exe String found in binary or memory: https://simpletimelapse.sourceforge.io/update/version.txt
Source: AE-808_RAJEN.exe String found in binary or memory: https://simpletimelapse.sourceforge.io/update/version.txtwhttps://simpletimelapse.sourceforge.io/upd
Source: AE-808_RAJEN.exe String found in binary or memory: https://www.flaticon.com/packs/free-basic-ui-elements
Source: AE-808_RAJEN.exe, 00000000.00000002.654789370.0000000003B99000.00000004.00000001.sdmp, AE-808_RAJEN.exe, 00000001.00000002.1030691966.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: AE-808_RAJEN.exe, 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\AE-808_RAJEN.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
Detected potential crypto function
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_02A5C2B0 0_2_02A5C2B0
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_02A599B8 0_2_02A599B8
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_05EB6290 0_2_05EB6290
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_05EB0040 0_2_05EB0040
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_05EB0006 0_2_05EB0006
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_05EB001C 0_2_05EB001C
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_05EB6280 0_2_05EB6280
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_06504A50 0_2_06504A50
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_06508728 0_2_06508728
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_06504180 0_2_06504180
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_06503E38 0_2_06503E38
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_06500015 0_2_06500015
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_01447C68 1_2_01447C68
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_0144DF28 1_2_0144DF28
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_01440B51 1_2_01440B51
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_01448FA0 1_2_01448FA0
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_017B47A0 1_2_017B47A0
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_017B4790 1_2_017B4790
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_064D6510 1_2_064D6510
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_064DEBD0 1_2_064DEBD0
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_064D6858 1_2_064D6858
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_064D90F0 1_2_064D90F0
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_064D7128 1_2_064D7128
Sample file is different than original file name gathered from version info
Source: AE-808_RAJEN.exe Binary or memory string: OriginalFilename vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000000.00000002.654506944.0000000002BCE000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSoapName.dll2 vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000000.00000002.654461075.0000000002B91000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameJbNoFYPjeMFbpEdEIKHcoCEGJFhJNzgafOODrX.exe4 vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000000.00000002.654908714.0000000003C86000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamePositiveSign.dll< vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000000.00000000.646175766.0000000000672000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameXmlToFieldTypeMap.exeL vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe Binary or memory string: OriginalFilename vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000001.00000002.1033808650.0000000006380000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000001.00000002.1030890833.0000000001338000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000001.00000002.1031370246.000000000164A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000001.00000000.651232600.0000000000EA2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameXmlToFieldTypeMap.exeL vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000001.00000002.1030691966.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameJbNoFYPjeMFbpEdEIKHcoCEGJFhJNzgafOODrX.exe4 vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe, 00000001.00000002.1031811029.0000000001880000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamewshom.ocx.mui vs AE-808_RAJEN.exe
Source: AE-808_RAJEN.exe Binary or memory string: OriginalFilenameXmlToFieldTypeMap.exeL vs AE-808_RAJEN.exe
Uses 32bit PE files
Source: AE-808_RAJEN.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: AE-808_RAJEN.exe, BowenTheatre.Bookings/Encrypta??o.cs Cryptographic APIs: 'TransformFinalBlock'
Source: AE-808_RAJEN.exe, BowenTheatre.Bookings/Encrypta??o.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.AE-808_RAJEN.exe.670000.0.unpack, BowenTheatre.Bookings/Encrypta??o.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.AE-808_RAJEN.exe.670000.0.unpack, BowenTheatre.Bookings/Encrypta??o.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.0.AE-808_RAJEN.exe.ea0000.0.unpack, BowenTheatre.Bookings/Encrypta??o.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.AE-808_RAJEN.exe.ea0000.0.unpack, BowenTheatre.Bookings/Encrypta??o.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AE-808_RAJEN.exe.log Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Mutant created: \Sessions\1\BaseNamedObjects\ZOfxnTxUBGrGSPTUnoyZEyJ
Source: AE-808_RAJEN.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: AE-808_RAJEN.exe Virustotal: Detection: 35%
Source: AE-808_RAJEN.exe ReversingLabs: Detection: 36%
Source: unknown Process created: C:\Users\user\Desktop\AE-808_RAJEN.exe 'C:\Users\user\Desktop\AE-808_RAJEN.exe'
Source: unknown Process created: C:\Users\user\Desktop\AE-808_RAJEN.exe C:\Users\user\Desktop\AE-808_RAJEN.exe
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process created: C:\Users\user\Desktop\AE-808_RAJEN.exe C:\Users\user\Desktop\AE-808_RAJEN.exe Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: AE-808_RAJEN.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: AE-808_RAJEN.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_0067A95E push es; retn 0001h 0_2_0067AB0D
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_05EB49EC pushad ; iretd 0_2_05EB49ED
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_05EB4884 push ebx; retf 0_2_05EB4885
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 0_2_065091E6 push esi; ret 0_2_065091E8
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_00EAA95E push es; retn 0001h 1_2_00EAAB0D
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_064DC600 push es; ret 1_2_064DC610
Source: initial sample Static PE information: section name: .text entropy: 7.26312302148

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM_3
Source: Yara match File source: 00000000.00000002.654461075.0000000002B91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654506944.0000000002BCE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AE-808_RAJEN.exe PID: 6140, type: MEMORY
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: AE-808_RAJEN.exe, 00000000.00000002.654461075.0000000002B91000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: AE-808_RAJEN.exe, 00000000.00000002.654506944.0000000002BCE000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: AE-808_RAJEN.exe, 00000000.00000002.654506944.0000000002BCE000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0 Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Window / User API: threadDelayed 1836 Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Window / User API: threadDelayed 7959 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe TID: 6492 Thread sleep time: -50947s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe TID: 6692 Thread sleep time: -23058430092136925s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe TID: 6708 Thread sleep count: 1836 > 30 Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe TID: 6708 Thread sleep count: 7959 > 30 Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe TID: 6692 Thread sleep count: 36 > 30 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: AE-808_RAJEN.exe, 00000000.00000002.654041690.0000000000D36000.00000004.00000020.sdmp Binary or memory string: VMware
Source: AE-808_RAJEN.exe, 00000000.00000002.654461075.0000000002B91000.00000004.00000001.sdmp Binary or memory string: %l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: AE-808_RAJEN.exe, 00000000.00000002.654041690.0000000000D36000.00000004.00000020.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMwareUN_ASN62Win32_VideoControllerO7X6AYD1VideoController120060621000000.000000-0007724726.display.infMSBDA__NMLRRMPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsWG1TSHMA
Source: AE-808_RAJEN.exe, 00000001.00000003.866676188.0000000001730000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Use
Source: AE-808_RAJEN.exe, 00000000.00000002.654506944.0000000002BCE000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: AE-808_RAJEN.exe, 00000001.00000002.1033808650.0000000006380000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: AE-808_RAJEN.exe, 00000000.00000002.654506944.0000000002BCE000.00000004.00000001.sdmp Binary or memory string: vmware
Source: AE-808_RAJEN.exe, 00000000.00000002.654041690.0000000000D36000.00000004.00000020.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMwareUN_ASN62Win32_VideoControllerO7X6AYD1VideoController120060621000000.000000-0007724726.display.infMSBDA__NMLRRMPCI\VEN_15AD&DEV_0405&U/3:Y
Source: AE-808_RAJEN.exe, 00000000.00000002.654461075.0000000002B91000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: AE-808_RAJEN.exe, 00000000.00000002.654461075.0000000002B91000.00000004.00000001.sdmp Binary or memory string: %l"SOFTWARE\VMware, Inc.\VMware Tools
Source: AE-808_RAJEN.exe, 00000001.00000002.1033808650.0000000006380000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: AE-808_RAJEN.exe, 00000001.00000002.1033808650.0000000006380000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: AE-808_RAJEN.exe, 00000000.00000002.654506944.0000000002BCE000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: AE-808_RAJEN.exe, 00000000.00000002.654506944.0000000002BCE000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: AE-808_RAJEN.exe, 00000001.00000002.1033808650.0000000006380000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Memory written: C:\Users\user\Desktop\AE-808_RAJEN.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Process created: C:\Users\user\Desktop\AE-808_RAJEN.exe C:\Users\user\Desktop\AE-808_RAJEN.exe Jump to behavior
Source: AE-808_RAJEN.exe, 00000001.00000002.1031862191.0000000001C60000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: AE-808_RAJEN.exe, 00000001.00000002.1031862191.0000000001C60000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: AE-808_RAJEN.exe, 00000001.00000002.1031862191.0000000001C60000.00000002.00000001.sdmp Binary or memory string: Progman
Source: AE-808_RAJEN.exe, 00000001.00000002.1031862191.0000000001C60000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Users\user\Desktop\AE-808_RAJEN.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Users\user\Desktop\AE-808_RAJEN.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Code function: 1_2_064D54E4 GetUserNameW, 1_2_064D54E4
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000000.00000002.654789370.0000000003B99000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654908714.0000000003C86000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1030691966.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AE-808_RAJEN.exe PID: 2912, type: MEMORY
Source: Yara match File source: Process Memory Space: AE-808_RAJEN.exe PID: 6140, type: MEMORY
Source: Yara match File source: 1.2.AE-808_RAJEN.exe.400000.0.unpack, type: UNPACKEDPE
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\AE-808_RAJEN.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AE-808_RAJEN.exe PID: 2912, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000000.00000002.654789370.0000000003B99000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654908714.0000000003C86000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1030691966.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1032201040.0000000003341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AE-808_RAJEN.exe PID: 2912, type: MEMORY
Source: Yara match File source: Process Memory Space: AE-808_RAJEN.exe PID: 6140, type: MEMORY
Source: Yara match File source: 1.2.AE-808_RAJEN.exe.400000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 344977 Sample: AE-808_RAJEN.exe Startdate: 27/01/2021 Architecture: WINDOWS Score: 100 18 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->18 20 Found malware configuration 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 5 other signatures 2->24 6 AE-808_RAJEN.exe 3 2->6         started        process3 file4 14 C:\Users\user\...\AE-808_RAJEN.exe.log, ASCII 6->14 dropped 26 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 6->26 28 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->28 30 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->30 32 Injects a PE file into a foreign processes 6->32 10 AE-808_RAJEN.exe 2 6->10         started        signatures5 process6 dnsIp7 16 server116.web-hosting.com 68.65.122.156, 49779, 587 NAMECHEAP-NETUS United States 10->16 34 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->34 36 Tries to steal Mail credentials (via file access) 10->36 38 Tries to harvest and steal ftp login credentials 10->38 40 2 other signatures 10->40 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
68.65.122.156
 unknown United States
22612 NAMECHEAP-NETUS false

Contacted Domains

Name IP Active
server116.web-hosting.com 68.65.122.156 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://EiR6SA0ya1Q.org true
  • Avira URL Cloud: safe
 unknown