Loading ...

Play interactive tourEdit tour

Analysis Report SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.2561

Overview

General Information

Sample Name:SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.2561 (renamed file extension from 2561 to exe)
Analysis ID:356597
MD5:ed6841cbc5206942dd2e812f7855b156
SHA1:3b51ff4aa0b8d39e6d6e2df5b19a47b06898ab21
SHA256:0381c68c02579ec24cbc328815c87c9aa49833ae2ddc321780fe9881234a2f80
Tags:AgentTesla

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains potential unpacker
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "6WLmA2S8h7", "URL: ": "https://GsKwOmvIezHndSQmIcyS.com", "To: ": "armyscheme@yandex.com", "ByHost: ": "smtp.yandex.com:587", "Password: ": "UM9UHPz8BDmgDL", "From: ": "armyscheme@yandex.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.652337158.0000000003679000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000004.00000002.911990568.00000000029C1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000004.00000002.910118958.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000002.651977760.00000000026AB000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.3944ca0.3.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              4.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.269986c.1.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
                  0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.3944ca0.3.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.38447f0.5.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 2 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.7080.4.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "6WLmA2S8h7", "URL: ": "https://GsKwOmvIezHndSQmIcyS.com", "To: ": "armyscheme@yandex.com", "ByHost: ": "smtp.yandex.com:587", "Password: ": "UM9UHPz8BDmgDL", "From: ": "armyscheme@yandex.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeVirustotal: Detection: 36%Perma Link
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeReversingLabs: Detection: 33%
                      Machine Learning detection for sampleShow sources
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeJoe Sandbox ML: detected
                      Source: 4.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

                      Compliance:

                      barindex
                      Uses 32bit PE filesShow sources
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Contains modern PE file flags such as dynamic base (ASLR) or NXShow sources
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h0_2_05920BB8

                      Networking:

                      barindex
                      C2 URLs / IPs found in malware configurationShow sources
                      Source: Malware configuration extractorURLs: https://GsKwOmvIezHndSQmIcyS.com
                      Source: global trafficTCP traffic: 192.168.2.4:49764 -> 77.88.21.158:587
                      Source: Joe Sandbox ViewIP Address: 77.88.21.158 77.88.21.158
                      Source: global trafficTCP traffic: 192.168.2.4:49764 -> 77.88.21.158:587
                      Source: unknownDNS traffic detected: queries for: smtp.yandex.com
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911990568.00000000029C1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911990568.00000000029C1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ca.crl0h
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.915387308.0000000006370000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.plWq
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ca.cer09
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ycasha2.cer0
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://smtp.yandex.com
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com0.
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911990568.00000000029C1000.00000004.00000001.sdmpString found in binary or memory: http://tTAnFc.com
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://www.certum.pl/CPS0
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.915387308.0000000006370000.00000004.00000001.sdmpString found in binary or memory: http://www.certum.pl/Ciq
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: http://yandex.ocsp-responder.com03
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912499535.0000000002CDB000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912630626.0000000002D4D000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000003.856886257.0000000000BB4000.00000004.00000001.sdmpString found in binary or memory: https://GsKwOmvIezHndSQmIcyS.com
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911990568.00000000029C1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%$
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911990568.00000000029C1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.912711978.0000000002D64000.00000004.00000001.sdmpString found in binary or memory: https://www.certum.pl/CPS0
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.652337158.0000000003679000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.910118958.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911990568.00000000029C1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      .NET source code contains very large stringsShow sources
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, FrmStart.csLong String: Length: 13656
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 0_2_059213B80_2_059213B8
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 0_2_024E96080_2_024E9608
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 0_2_024EC2A80_2_024EC2A8
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 0_2_024EAB340_2_024EAB34
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 0_2_001BA1610_2_001BA161
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 2_2_0018A1612_2_0018A161
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007B0C584_2_007B0C58
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007B98584_2_007B9858
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007BC5604_2_007BC560
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007B59504_2_007B5950
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007BE7084_2_007BE708
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007BF4114_2_007BF411
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007BC7504_2_007BC750
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007DB44C4_2_007DB44C
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007DDEA64_2_007DDEA6
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007DAB704_2_007DAB70
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007D27684_2_007D2768
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007D1FF04_2_007D1FF0
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_00E346A04_2_00E346A0
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_00E346904_2_00E34690
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_010601604_2_01060160
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_010618184_2_01061818
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_0106B3204_2_0106B320
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_01065E484_2_01065E48
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_0106E5A84_2_0106E5A8
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_0106A9B04_2_0106A9B0
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_01066C404_2_01066C40
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_01066B484_2_01066B48
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_0057A1614_2_0057A161
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000000.642508017.00000000002BC000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamec.exe8 vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.652337158.0000000003679000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameLegacyPathHandling.dllN vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.652337158.0000000003679000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameVUjAHBxYPFxCVjXHCpyuGgBIgZxcGuTQWnqk.exe4 vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAsyncState.dllF vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000002.00000000.648671150.000000000028C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamec.exe8 vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.910424435.00000000007C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.910296987.000000000067C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamec.exe8 vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911469585.0000000000FD0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.910537732.0000000000AF8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.910118958.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameVUjAHBxYPFxCVjXHCpyuGgBIgZxcGuTQWnqk.exe4 vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.910376100.00000000007A0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeBinary or memory string: OriginalFilenamec.exe8 vs SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, FrmStart.csBase64 encoded string: 'GIdDNNZNNNNRNNNN//8NNYtNNNNNNNNNDNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNtNNNNN4sht4NgNaAVotOGZ0uITucplOjpz9apzSgVTAuoz5iqPOvMFOlqJ4tnJ4tER9GVT1iMTHhQD0XWNNNNNNNNNODEDNNGNRQNViu868NNNNNNNNNNBNNNvRYNINNNPNNNNNTNNNNNNNNlw8NNNNtNNNNDNNNNNNNRDNtNNNNNtNNONNNNNNNNNNRNNNNNNNNNNPNNNNNNtNNNNNNNNZNDVHNNONNNONNNNNNRNNNRNNNNNNNNONNNNNNNNNNNNNNNUt/NNOCNNNNNRNNNBDQNNNNNNNNNNNNNNNNNNNNNNNNNTNNNNjNNNOpCjNNUNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNVNNNPNNNNNNNNNNNNNNNPPNNNRtNNNNNNNNNNNNNNP50MKu0NNNN0O8NNNNtNNNNVNNNNNVNNNNNNNNNNNNNNNNNNPNNNTNhpaAlLjNNNBDQNNNNDNNNNNDNNNNvNNNNNNNNNNNNNNNNNNONNNONYaWyoT9wNNNZNNNNNTNNNNNPNNNNWtNNNNNNNNNNNNNNNNNNDNNNDtNNNNNNNNNNNNNNNNNNNNPfCjNNNNNNNRtNNNNPNNHNhPHNNBjLNNNQNNNNNNNNNXD+NNP4NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO4PXOLNNNbdWtNPXOpNNNbNXdMmTNNNPbNONNNRpkxNNNdNNtNNOUZnNNNXtNZNNNEmTjNNPbNRNNNRXuZjNDNDNNNNNDNNRDO+NDNNOT8pNNNXPvfNOvbGZNRNRNNNNNVNNORNstVNNNEiUDNNPtbeNNLdRmNONONNNNNQNNNENU4QNNNRok4NNNbXXjNTXuZjNDNDNNNNONNNRDO+ONNNOT8sNNNXPvfNOvbGZNVNCNNNNNHNNORNstHNNNDHXPNNNNbYOljuptRNNUQDODNNNvtuNNNXolVNNNcmVjNNPtjVtNHNNNDNNU4SNNNRPvfNOvbGZNRNPjNNNNLNNORNstLNNNDXXjNTXvVNNbNTNNNRXyMmQNNNOvtxNNNXqNLNNNXNOjNNOPbrNvtyNNNXXtNNRmNONNfNNNNUNNNENU4UNNNRPvfNOvbNRmNONNfNNNNUNNNENPtANNNTPvfNOvc+pwfNNUPNPNNNOUV7NNOjtNxNNNElBjNNpVNXNNNRXxbNNvtzNNNXNNZROFtENNNTNPbNNOZjONO0NNNNPNNNRDOmWjNNPtbTVYvPNDNtXWbONT8bNNNXXPxNNNbNNvtINNNTOPtHNNNTPjpbRjNNOtZbSDNNOvtFNNNTQNtbXtNNPt0WolfNNNbqzuZRRDEiYNNNPuhnRjHEOKV9NNOjTOvAStNNNFtgNNNXWuLbYtNNPtNdRmNSNWpNNNNWNNNENPtiNNNXN28jNNNXPjVPwzxK2cRspTRZNb5cS9LK2usJwF8NNNRANb5cS9bGOORRRjHJRjLeBtxEOtVEOcRVLDpEO5SugWjEOjAiZDNNPusn/tRGPORVRjxEPFjTSuZUNPfVNORUS9LGOjNEOusJRjLEOuRSZpNWNb5cTAbK1usnS9nAYjNNNFtlNNNXqNHNNOfXXjNTXtNGZNHNctNNNNbNNORNStfPomZNNNbGOkVUXQDNNNbZPNwLTgtAPEsnS9nAYjNNNEZRPOsnRjtJRjxeDjtK2uZXSuZYXl0PRDxEP281NNNXRjjFQPt2NNNXXQpNNNbJRDDUTvt4NNNXNNpn1tfEPksJRjfEPkRXZp0EPEsJRjxEPERVZopEOOLbBDNNPuZSRDHK2usJwF8NNNRGOuRRTuRTSuRTwzxbBNNNPtNEOtbeNNLdNNNGZNVNXNNNNNfNNORNN3WYNNOjXQbNNNbbBjNNPaZwNNNXPjpPomjNNNc0VtNNNDbeNNLdRmNRNRbNNNNZNNNENNWiZDNNPuuopm0NNNbYNz8kNNNXTAbZSt0eUjpPPEuiCtNNPu8DXQ8NNNbbDNNNPz9ONNNXWtxL1t0WPQUqO29PNNNXPvfNOvbNNOZjNDNUNNNNQDNNRDNHPvfNOvcTNNVJztVKztVLzvtENNNTNPbNNNNGZNZNVNNNNN4NNORNsttNNNE+PDNNOU4XNNNRXORNNNLNpwfNNUNXXjNTXuZjNtNFNNNNQjNNRDNPNluQNNNXXRDNNNbXXjNTXtNNRmNONNjNNNNDNNNENNVbEDNNPtbeNNLdRmNONONNNNNENNNENANWNNNPXPRNNNbXXjNTXuZjNDNZNNNNQtNNRDNPXRLNNNbXXjNTXuZjNtNqNNNNRtNNRDNPwNLNNOfH/tRYOljVXNRNNPfXXjHNNtbeNNLdWtNQ/uHTNNNoXvLNNvtzNNNXNPbNNNNGZNVNADNNNOZNNORNNagVNNNXo0xNNNbYO4jWNNNoSC4OQNtfSPtPNNNePjW7FNNNPtqiFtNNPtNNNNpXXjNTXyVNNvtzNNNXNNWmFjNNPa1VNNNXXv4bTNNNObNZNNNRXu4PXPLNNNbdNNOPH0cPNDNONNNNNNNZNNNNqwVhZP41ZQplAjNNNNNSNTjNNNPbPDNNV34NNODXNNOjPDNNV1A0pzyhM3ZNNNNNuOZNNTDNNNNwIIZN6OZNNONNNNNwE1IWENNNNCtGNNQ0ONNNV0Wfo2VNNNNNNNNNNtNNNIpIbtxWQjNNNCbOZjNJNNNONNNNBDNNNNfNNNNZNNNNVjNNNORNNNOYNNNNCjNNNOZNNNNTNNNNPtNNNNjNNNNWNNNNNDNNNNDNNNNONNNNNjNNNNZNNNNPNNNNNNNZODRNNNNNNNLNdtBJOjLNSjFJOjLNztYZOt8NQttNNNLN2jXzODLNwDBzODLN/tBzODLNltBzODLN4jBzODL
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@5/2@4/1
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.logJump to behavior
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeVirustotal: Detection: 36%
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeReversingLabs: Detection: 33%
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeString found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeString found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeString found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeString found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
                      Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe'
                      Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic file information: File size 1103872 > 1048576
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x108a00
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, BoundHandle.cs.Net Code: .ctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007B980D pushad ; ret 4_2_007B9821
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007D7A37 push edi; retn 0000h4_2_007D7A39
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_00E3CD51 push esp; iretd 4_2_00E3CD5D
                      Source: initial sampleStatic PE information: section name: .text entropy: 6.90500904332
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM_3Show sources
                      Source: Yara matchFile source: 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.651977760.00000000026AB000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe PID: 6952, type: MEMORY
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.269986c.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.26d27c0.2.raw.unpack, type: UNPACKEDPE
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWindow / User API: threadDelayed 1685Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWindow / User API: threadDelayed 8116Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe TID: 6956Thread sleep time: -101038s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe TID: 6976Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe TID: 5992Thread sleep time: -20291418481080494s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe TID: 6004Thread sleep count: 1685 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe TID: 6004Thread sleep count: 8116 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe TID: 5992Thread sleep count: 37 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000000.00000002.651915801.0000000002671000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeCode function: 4_2_007BB018 LdrInitializeThunk,4_2_007BB018
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeMemory allocated: page read and write | page guardJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeJump to behavior
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911905161.00000000014B0000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911905161.00000000014B0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911905161.00000000014B0000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe, 00000004.00000002.911905161.00000000014B0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000000.00000002.652337158.0000000003679000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.910118958.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe PID: 6952, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe PID: 7080, type: MEMORY
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.3944ca0.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.3944ca0.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.38447f0.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.37e69d0.4.raw.unpack, type: UNPACKEDPE
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: Yara matchFile source: 00000004.00000002.911990568.00000000029C1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe PID: 7080, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000000.00000002.652337158.0000000003679000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.910118958.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe PID: 6952, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe PID: 7080, type: MEMORY
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.3944ca0.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.3944ca0.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.38447f0.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.Trojan.GenericKDZ.73120.3552.exe.37e69d0.4.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection12Masquerading1OS Credential Dumping2Query Registry1Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsCommand and Scripting Interpreter2Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsVirtualization/Sandbox Evasion13Credentials in Registry1Security Software Discovery211Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerVirtualization/Sandbox Evasion13SMB/Windows Admin SharesData from Local System2Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection12NTDSProcess Discovery2Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol111SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information31LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing12Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Information Discovery114Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped