Analysis Report LIZvq3EW7m.exe

Overview

General Information

Sample Name: LIZvq3EW7m.exe
Analysis ID: 357559
MD5: 5d2d34449323c67ba1f5ec7561df2204
SHA1: a48c7f51db44ca8a2b0240d9c57c1983ac5d75dd
SHA256: 95a1ff3f5d08ac3d0dfe64300eec668fa0c78bdb7da395f1d91735c5a0aef8a5
Tags: exeGuLoader
Infos:

Most interesting Screenshot:

Detection

AgentTesla GuLoader
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected GuLoader
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Enables debug privileges
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: LIZvq3EW7m.exe Virustotal: Detection: 21% Perma Link
Source: LIZvq3EW7m.exe ReversingLabs: Detection: 16%

Compliance:

barindex
Uses 32bit PE files
Source: LIZvq3EW7m.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Uses new MSVCR Dlls
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: unknown DNS traffic detected: queries for: onedrive.live.com
Source: RegAsm.exe, 0000000E.00000002.515531566.000000001D861000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegAsm.exe, 0000000E.00000002.515531566.000000001D861000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: RegAsm.exe, 0000000E.00000002.515531566.000000001D861000.00000004.00000001.sdmp String found in binary or memory: http://JSQBKI.com
Source: RegAsm.exe, 0000000E.00000002.510950928.0000000000F7D000.00000004.00000020.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: RegAsm.exe, 0000000E.00000002.510950928.0000000000F7D000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: RegAsm.exe, 0000000E.00000002.510950928.0000000000F7D000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.msocsp.com0
Source: RegAsm.exe, 0000000E.00000002.515531566.000000001D861000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: RegAsm.exe, 0000000E.00000002.510872582.0000000000F1B000.00000004.00000020.sdmp String found in binary or memory: https://cbzrfq.bl.files.1drv.com/X
Source: RegAsm.exe, 0000000E.00000002.510872582.0000000000F1B000.00000004.00000020.sdmp String found in binary or memory: https://cbzrfq.bl.files.1drv.com/t
Source: RegAsm.exe, 0000000E.00000002.510872582.0000000000F1B000.00000004.00000020.sdmp String found in binary or memory: https://cbzrfq.bl.files.1drv.com/y4m6xg1XvMW3gbVxDaG8eC-sQOlr6nmG4uqhmYHacvOjJxUricSauwypPs7Fa6xUXOy
Source: RegAsm.exe, 0000000E.00000002.510930369.0000000000F5E000.00000004.00000020.sdmp String found in binary or memory: https://cbzrfq.bl.files.1drv.com/y4meC4ccKelBPgeKSh6hZT6bRCOR5ff4nvnt28NLuAcRP3PcWBKUwkBGKN3LJUa7F0I
Source: RegAsm.exe, 0000000E.00000002.510872582.0000000000F1B000.00000004.00000020.sdmp String found in binary or memory: https://onedrive.live.com/B
Source: RegAsm.exe, 0000000E.00000002.510872582.0000000000F1B000.00000004.00000020.sdmp String found in binary or memory: https://onedrive.live.com/R
Source: RegAsm.exe String found in binary or memory: https://onedrive.live.com/download?cid=F57CEB019EB26E7D&resid=F57CEB019EB26E7D%21108&authkey=AN1oxHG
Source: RegAsm.exe, 0000000E.00000002.515531566.000000001D861000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46AA5 NtProtectVirtualMemory,NtSetInformationThread, 14_2_00B46AA5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46F2E LoadLibraryA,NtSetInformationThread, 14_2_00B46F2E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B470B2 NtSetInformationThread, 14_2_00B470B2
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B47097 NtSetInformationThread, 14_2_00B47097
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B47081 NtSetInformationThread, 14_2_00B47081
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B470C9 NtSetInformationThread, 14_2_00B470C9
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B47013 NtSetInformationThread, 14_2_00B47013
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B47007 NtSetInformationThread, 14_2_00B47007
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B4705C NtSetInformationThread, 14_2_00B4705C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B471A9 NtSetInformationThread, 14_2_00B471A9
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B47190 NtSetInformationThread, 14_2_00B47190
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B471F7 NtSetInformationThread, 14_2_00B471F7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B471DE NtSetInformationThread, 14_2_00B471DE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B4710B NtSetInformationThread, 14_2_00B4710B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B4717A NtSetInformationThread, 14_2_00B4717A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B47151 NtSetInformationThread, 14_2_00B47151
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B4729D NtSetInformationThread, 14_2_00B4729D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46AF6 NtSetInformationThread, 14_2_00B46AF6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46AC7 NtSetInformationThread, 14_2_00B46AC7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B4720F NtSetInformationThread, 14_2_00B4720F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46A5F NtProtectVirtualMemory, 14_2_00B46A5F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46B15 NtSetInformationThread, 14_2_00B46B15
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46E84 NtSetInformationThread, 14_2_00B46E84
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46FBD NtSetInformationThread, 14_2_00B46FBD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46FA1 NtSetInformationThread, 14_2_00B46FA1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46FD8 NtSetInformationThread, 14_2_00B46FD8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46F75 NtSetInformationThread, 14_2_00B46F75
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46F47 NtSetInformationThread, 14_2_00B46F47
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_1D6BB0BA NtQuerySystemInformation, 14_2_1D6BB0BA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_1D6BB089 NtQuerySystemInformation, 14_2_1D6BB089
PE file contains strange resources
Source: LIZvq3EW7m.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: LIZvq3EW7m.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: LIZvq3EW7m.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: LIZvq3EW7m.exe, 00000001.00000000.245490360.0000000000417000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameudfrlig.exe vs LIZvq3EW7m.exe
Source: LIZvq3EW7m.exe Binary or memory string: OriginalFilenameudfrlig.exe vs LIZvq3EW7m.exe
Tries to load missing DLLs
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Uses 32bit PE files
Source: LIZvq3EW7m.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal96.troj.evad.winEXE@4/0@2/0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_1D6BAF3E AdjustTokenPrivileges, 14_2_1D6BAF3E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_1D6BAF07 AdjustTokenPrivileges, 14_2_1D6BAF07
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4632:120:WilError_01
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe File created: C:\Users\user\AppData\Local\Temp\~DF5FD0B92EB3573A4E.TMP Jump to behavior
Source: LIZvq3EW7m.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: LIZvq3EW7m.exe Virustotal: Detection: 21%
Source: LIZvq3EW7m.exe ReversingLabs: Detection: 16%
Source: unknown Process created: C:\Users\user\Desktop\LIZvq3EW7m.exe 'C:\Users\user\Desktop\LIZvq3EW7m.exe'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\LIZvq3EW7m.exe'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\LIZvq3EW7m.exe' Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 0000000E.00000002.510534238.0000000000B42000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6728, type: MEMORY
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 0000000000463918 second address: 0000000000463918 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FE178CB36F8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d jmp 00007FE178CB3702h 0x0000001f cmp bx, bx 0x00000022 cmp bx, dx 0x00000025 pop ecx 0x00000026 add edi, edx 0x00000028 dec ecx 0x00000029 cmp ecx, 00000000h 0x0000002c jne 00007FE178CB36C7h 0x0000002e cmp ah, bh 0x00000030 test cl, dl 0x00000032 push ecx 0x00000033 call 00007FE178CB3779h 0x00000038 call 00007FE178CB3708h 0x0000003d lfence 0x00000040 mov edx, dword ptr [7FFE0014h] 0x00000046 lfence 0x00000049 ret 0x0000004a mov esi, edx 0x0000004c pushad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 00000000004638DF second address: 0000000000463B4F instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a jmp 00007FE178BD29D2h 0x0000000c pushad 0x0000000d mov bx, 2AB1h 0x00000011 cmp bx, 2AB1h 0x00000016 jne 00007FE178BCF536h 0x0000001c popad 0x0000001d ret 0x0000001e jmp 00007FE178BD29D2h 0x00000020 test dx, ax 0x00000023 jmp 00007FE178BD29D2h 0x00000025 cmp eax, edx 0x00000027 jmp 00007FE178BD29D2h 0x00000029 test bl, bl 0x0000002b jmp 00007FE178BD29D2h 0x0000002d test dh, dh 0x0000002f mov dword ptr [ebp+0000009Ch], 00000000h 0x00000039 jmp 00007FE178BD29D2h 0x0000003b test bx, ax 0x0000003e xor edi, edi 0x00000040 jmp 00007FE178BD29D2h 0x00000042 test bl, 00000069h 0x00000045 mov ecx, 000186A0h 0x0000004a jmp 00007FE178BD29D2h 0x0000004c test dx, ax 0x0000004f jmp 00007FE178BD29D2h 0x00000051 cmp eax, edx 0x00000053 test dx, cx 0x00000056 cmp bx, dx 0x00000059 push ecx 0x0000005a call 00007FE178BD2A62h 0x0000005f call 00007FE178BD2A22h 0x00000064 lfence 0x00000067 rdtsc
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 0000000000463A7D second address: 0000000000463B4F instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test cl, 00000016h 0x0000000d add dword ptr [ebp+0000009Ch], 01h 0x00000014 jmp 00007FE178BD29D2h 0x00000016 test eax, ecx 0x00000018 add edi, edx 0x0000001a dec ecx 0x0000001b cmp ecx, 00000000h 0x0000001e jne 00007FE178BD2959h 0x00000020 cmp bx, dx 0x00000023 push ecx 0x00000024 call 00007FE178BD2A62h 0x00000029 call 00007FE178BD2A22h 0x0000002e lfence 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 0000000000463473 second address: 0000000000465189 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a jmp 00007FE178BD29D2h 0x0000000c test ch, ah 0x0000000e jmp 00007FE178BD4110h 0x00000013 call 00007FE178BD1277h 0x00000018 pop eax 0x00000019 cmp ax, dx 0x0000001c push edi 0x0000001d push eax 0x0000001e call 00007FE178BD4693h 0x00000023 jmp 00007FE178BD29D2h 0x00000025 pushad 0x00000026 mov ebx, 000000ACh 0x0000002b rdtsc
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect Any.run
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: RegAsm.exe Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 0000000000463918 second address: 0000000000463918 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FE178CB36F8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d jmp 00007FE178CB3702h 0x0000001f cmp bx, bx 0x00000022 cmp bx, dx 0x00000025 pop ecx 0x00000026 add edi, edx 0x00000028 dec ecx 0x00000029 cmp ecx, 00000000h 0x0000002c jne 00007FE178CB36C7h 0x0000002e cmp ah, bh 0x00000030 test cl, dl 0x00000032 push ecx 0x00000033 call 00007FE178CB3779h 0x00000038 call 00007FE178CB3708h 0x0000003d lfence 0x00000040 mov edx, dword ptr [7FFE0014h] 0x00000046 lfence 0x00000049 ret 0x0000004a mov esi, edx 0x0000004c pushad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 00000000004638DF second address: 0000000000463B4F instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a jmp 00007FE178BD29D2h 0x0000000c pushad 0x0000000d mov bx, 2AB1h 0x00000011 cmp bx, 2AB1h 0x00000016 jne 00007FE178BCF536h 0x0000001c popad 0x0000001d ret 0x0000001e jmp 00007FE178BD29D2h 0x00000020 test dx, ax 0x00000023 jmp 00007FE178BD29D2h 0x00000025 cmp eax, edx 0x00000027 jmp 00007FE178BD29D2h 0x00000029 test bl, bl 0x0000002b jmp 00007FE178BD29D2h 0x0000002d test dh, dh 0x0000002f mov dword ptr [ebp+0000009Ch], 00000000h 0x00000039 jmp 00007FE178BD29D2h 0x0000003b test bx, ax 0x0000003e xor edi, edi 0x00000040 jmp 00007FE178BD29D2h 0x00000042 test bl, 00000069h 0x00000045 mov ecx, 000186A0h 0x0000004a jmp 00007FE178BD29D2h 0x0000004c test dx, ax 0x0000004f jmp 00007FE178BD29D2h 0x00000051 cmp eax, edx 0x00000053 test dx, cx 0x00000056 cmp bx, dx 0x00000059 push ecx 0x0000005a call 00007FE178BD2A62h 0x0000005f call 00007FE178BD2A22h 0x00000064 lfence 0x00000067 rdtsc
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 0000000000463B4F second address: 0000000000463B4F instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FE178CB59F7h 0x0000001d popad 0x0000001e call 00007FE178CB373Ah 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 0000000000463A7D second address: 0000000000463B4F instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test cl, 00000016h 0x0000000d add dword ptr [ebp+0000009Ch], 01h 0x00000014 jmp 00007FE178BD29D2h 0x00000016 test eax, ecx 0x00000018 add edi, edx 0x0000001a dec ecx 0x0000001b cmp ecx, 00000000h 0x0000001e jne 00007FE178BD2959h 0x00000020 cmp bx, dx 0x00000023 push ecx 0x00000024 call 00007FE178BD2A62h 0x00000029 call 00007FE178BD2A22h 0x0000002e lfence 0x00000031 rdtsc
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 000000000046534E second address: 000000000046534E instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov dx, word ptr [esi+ecx] 0x0000000f jmp 00007FE178CB3702h 0x00000011 test dh, 00000068h 0x00000014 cmp bx, dx 0x00000017 jne 00007FE178CB3663h 0x0000001d push dword ptr [esp+04h] 0x00000021 jmp 00007FE178CB3702h 0x00000023 test bx, ax 0x00000026 call 00007FE178CB3925h 0x0000002b mov ebx, dword ptr [esp+04h] 0x0000002f xor ecx, ecx 0x00000031 add ecx, 02h 0x00000034 cmp word ptr [ebx+ecx], 0000h 0x00000039 jne 00007FE178CB36E8h 0x0000003b add ecx, 02h 0x0000003e cmp word ptr [ebx+ecx], 0000h 0x00000043 jne 00007FE178CB36E8h 0x00000045 add ecx, 02h 0x00000048 cmp word ptr [ebx+ecx], 0000h 0x0000004d jne 00007FE178CB36E8h 0x0000004f add ecx, 02h 0x00000052 cmp word ptr [ebx+ecx], 0000h 0x00000057 jne 00007FE178CB36E8h 0x00000059 add ecx, 02h 0x0000005c cmp word ptr [ebx+ecx], 0000h 0x00000061 jne 00007FE178CB36E8h 0x00000063 add ecx, 02h 0x00000066 cmp word ptr [ebx+ecx], 0000h 0x0000006b jne 00007FE178CB36E8h 0x0000006d add ecx, 02h 0x00000070 cmp word ptr [ebx+ecx], 0000h 0x00000075 jne 00007FE178CB36E8h 0x00000077 retn 0004h 0x0000007a jmp 00007FE178CB3702h 0x0000007c cmp dh, dh 0x0000007e sub ecx, 02h 0x00000081 add eax, 02h 0x00000084 jmp 00007FE178CB3702h 0x00000086 cmp dl, cl 0x00000088 mov bx, word ptr [eax+ecx] 0x0000008c jmp 00007FE178CB3702h 0x0000008e pushad 0x0000008f lfence 0x00000092 rdtsc
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe RDTSC instruction interceptor: First address: 0000000000463473 second address: 0000000000465189 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a jmp 00007FE178BD29D2h 0x0000000c test ch, ah 0x0000000e jmp 00007FE178BD4110h 0x00000013 call 00007FE178BD1277h 0x00000018 pop eax 0x00000019 cmp ax, dx 0x0000001c push edi 0x0000001d push eax 0x0000001e call 00007FE178BD4693h 0x00000023 jmp 00007FE178BD29D2h 0x00000025 pushad 0x00000026 mov ebx, 000000ACh 0x0000002b rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe RDTSC instruction interceptor: First address: 0000000000B43B4F second address: 0000000000B43B4F instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FE178CB59F7h 0x0000001d popad 0x0000001e call 00007FE178CB373Ah 0x00000023 lfence 0x00000026 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B43831 rdtsc 14_2_00B43831
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 5412 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 5412 Thread sleep time: -4110000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 5412 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: RegAsm.exe, 0000000E.00000002.516070972.000000001FE30000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: RegAsm.exe, 0000000E.00000002.510872582.0000000000F1B000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAWp
Source: RegAsm.exe, 0000000E.00000002.510930369.0000000000F5E000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 0000000E.00000002.516070972.000000001FE30000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: RegAsm.exe Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: RegAsm.exe, 0000000E.00000002.516070972.000000001FE30000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: RegAsm.exe, 0000000E.00000002.516070972.000000001FE30000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B43831 rdtsc 14_2_00B43831
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B459F0 mov eax, dword ptr fs:[00000030h] 14_2_00B459F0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46499 mov eax, dword ptr fs:[00000030h] 14_2_00B46499
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46432 mov eax, dword ptr fs:[00000030h] 14_2_00B46432
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B4643D mov eax, dword ptr fs:[00000030h] 14_2_00B4643D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B4640D mov eax, dword ptr fs:[00000030h] 14_2_00B4640D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46477 mov eax, dword ptr fs:[00000030h] 14_2_00B46477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B46451 mov eax, dword ptr fs:[00000030h] 14_2_00B46451
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B455CD mov eax, dword ptr fs:[00000030h] 14_2_00B455CD
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B436C3 mov eax, dword ptr fs:[00000030h] 14_2_00B436C3
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: B40000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\LIZvq3EW7m.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\LIZvq3EW7m.exe' Jump to behavior
Source: RegAsm.exe, 0000000E.00000002.511467433.00000000013D0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 0000000E.00000002.511467433.00000000013D0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: RegAsm.exe, 0000000E.00000002.511467433.00000000013D0000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: RegAsm.exe, 0000000E.00000002.511467433.00000000013D0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: RegAsm.exe, 0000000E.00000002.511467433.00000000013D0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Code function: 14_2_00B438F9 cpuid 14_2_00B438F9
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 0000000E.00000002.515531566.000000001D861000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6728, type: MEMORY
Yara detected Credential Stealer
Source: Yara match File source: 0000000E.00000002.515531566.000000001D861000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6728, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 0000000E.00000002.515531566.000000001D861000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6728, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 357559 Sample: LIZvq3EW7m.exe Startdate: 24/02/2021 Architecture: WINDOWS Score: 96 22 Multi AV Scanner detection for submitted file 2->22 24 Yara detected GuLoader 2->24 26 Yara detected AgentTesla 2->26 28 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->28 7 LIZvq3EW7m.exe 1 2->7         started        process3 signatures4 30 Writes to foreign memory regions 7->30 32 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 7->32 34 Tries to detect Any.run 7->34 36 2 other signatures 7->36 10 RegAsm.exe 11 7->10         started        process5 dnsIp6 16 onedrive.live.com 10->16 18 cbzrfq.bl.files.1drv.com 10->18 20 bl-files.fe.1drv.com 10->20 38 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->38 40 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 10->40 42 Tries to detect Any.run 10->42 44 2 other signatures 10->44 14 conhost.exe 10->14         started        signatures7 process8
No contacted IP infos

Contacted Domains

Name IP Active
onedrive.live.com unknown unknown
cbzrfq.bl.files.1drv.com unknown unknown