Analysis Report AMPUTERE.exe

Overview

General Information

Sample Name:	AMPUTERE.exe
Analysis ID:	379730
MD5:	f2fa3c87de32858f1244fb352873f399
SHA1:	3d6f6d635639c689a8e4709ccb379500b4e76096
SHA256:	2beda3caff1f808814294dca346cbe62ad229272d54696fe75e99388a73ff3cc
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

AgentTesla GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Hides threads from debuggers

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: AMPUTERE.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: AMPUTERE.exe	Virustotal: Detection: 44%			Perma Link
Source: AMPUTERE.exe	ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: AMPUTERE.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: AMPUTERE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.6:49747 version: TLS 1.2

Networking:

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: doc-14-a0-docs.googleusercontent.com

Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp	String found in binary or memory: http://CFlLIU.com
Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RegAsm.exe	String found in binary or memory: https://drive.google.com/uc?export=download&id=1YqpUxJBnjokc5FJGT-8XzuYbR97RtVG2
Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown

HTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.6:49747 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: AMPUTERE.exe, 00000000.00000002.811048059.00000000005EA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\AMPUTERE.exe

Process Stats: CPU usage > 98%

Contains functionality to call native functions

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107349 NtQueryInformationProcess,	19_2_01107349
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106E63 NtProtectVirtualMemory,	19_2_01106E63
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110752F NtQueryInformationProcess,	19_2_0110752F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110755B NtQueryInformationProcess,	19_2_0110755B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110759F NtQueryInformationProcess,	19_2_0110759F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107583 NtQueryInformationProcess,	19_2_01107583
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011075BB NtQueryInformationProcess,	19_2_011075BB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011075E7 NtQueryInformationProcess,	19_2_011075E7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107417 NtQueryInformationProcess,	19_2_01107417
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107437 NtQueryInformationProcess,	19_2_01107437
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107457 NtQueryInformationProcess,	19_2_01107457
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107477 NtQueryInformationProcess,	19_2_01107477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011074A0 NtQueryInformationProcess,	19_2_011074A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011074DF NtQueryInformationProcess,	19_2_011074DF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110770C NtQueryInformationProcess,	19_2_0110770C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107747 NtQueryInformationProcess,	19_2_01107747
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110777F NtQueryInformationProcess,	19_2_0110777F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107363 NtQueryInformationProcess,	19_2_01107363
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107384 NtQueryInformationProcess,	19_2_01107384
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011073B3 NtQueryInformationProcess,	19_2_011073B3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011073CB NtQueryInformationProcess,	19_2_011073CB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011073EB NtQueryInformationProcess,	19_2_011073EB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107603 NtQueryInformationProcess,	19_2_01107603
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106E22 NtProtectVirtualMemory,	19_2_01106E22
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106E47 NtProtectVirtualMemory,	19_2_01106E47
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107663 NtQueryInformationProcess,	19_2_01107663
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011076AB NtQueryInformationProcess,	19_2_011076AB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011076CB NtQueryInformationProcess,	19_2_011076CB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_1DC8B0BA NtQuerySystemInformation,	19_2_1DC8B0BA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_1DC8B089 NtQuerySystemInformation,	19_2_1DC8B089

Detected potential crypto function

Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409418	0_2_00409418
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A862	0_2_0040A862
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A078	0_2_0040A078
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A478	0_2_0040A478
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040943F	0_2_0040943F
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409886	0_2_00409886
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004094B0	0_2_004094B0
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A101	0_2_0040A101
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A50A	0_2_0040A50A
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409D0C	0_2_00409D0C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409918	0_2_00409918
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409DED	0_2_00409DED
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409588	0_2_00409588
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A193	0_2_0040A193
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A595	0_2_0040A595
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004099A6	0_2_004099A6
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004095BE	0_2_004095BE
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409649	0_2_00409649
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A628	0_2_0040A628
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409A2A	0_2_00409A2A
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409A2C	0_2_00409A2C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409E30	0_2_00409E30
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A2C0	0_2_0040A2C0
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409EC4	0_2_00409EC4
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004096D5	0_2_004096D5
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A6FC	0_2_0040A6FC
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A6B3	0_2_0040A6B3
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409ABB	0_2_00409ABB
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A746	0_2_0040A746
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409B50	0_2_00409B50
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A356	0_2_0040A356
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409F5F	0_2_00409F5F
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409762	0_2_00409762
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409BE2	0_2_00409BE2
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409FE9	0_2_00409FE9
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004097F4	0_2_004097F4

Sample file is different than original file name gathered from version info

Source: AMPUTERE.exe, 00000000.00000002.811248602.0000000002200000.00000002.00000001.sdmp

Binary or memory string: OriginalFilenameuser32j% vs AMPUTERE.exe

Tries to load missing DLLs

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Uses 32bit PE files

Source: AMPUTERE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/0@1/1

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_1DC8AF3E AdjustTokenPrivileges,		19_2_1DC8AF3E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_1DC8AF07 AdjustTokenPrivileges,		19_2_1DC8AF07

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1212:120:WilError_01

Source: C:\Users\user\Desktop\AMPUTERE.exe

File created: C:\Users\user\AppData\Local\Temp\~DF371BB4A539764BA1.TMP

Jump to behavior

Source: AMPUTERE.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AMPUTERE.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\AMPUTERE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: AMPUTERE.exe	Virustotal: Detection: 44%
Source: AMPUTERE.exe	ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\AMPUTERE.exe 'C:\Users\user\Desktop\AMPUTERE.exe'
Source: C:\Users\user\Desktop\AMPUTERE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe'
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AMPUTERE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe'	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Source: Yara match	File source: 00000013.00000002.859923887.0000000001102000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

PE file contains an invalid checksum

Source: AMPUTERE.exe

Static PE information: real checksum: 0x255bc should be: 0x22e67

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040306C push esi; iretd	0_2_00403078
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040307A push esi; ret	0_2_0040307C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004034DD push ebp; ret	0_2_004034DE
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004058EE push esi; ret	0_2_00405918
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040888A push esi; ret	0_2_0040888C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004071F6 push esi; retf	0_2_0040723C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040723D push esi; ret	0_2_00407280
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00404BEA push esi; iretd	0_2_00404BEC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01104B84 push dword ptr [ebp+77h]; ret	19_2_01104B89
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107384 push cs; retn EB1Ah	19_2_011073A0

Source: C:\Users\user\Desktop\AMPUTERE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AMPUTERE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AMPUTERE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01103317		19_2_01103317
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011032A2		19_2_011032A2

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005261EC second address: 00000000005261EC instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526246 second address: 0000000000526246 instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526315 second address: 0000000000526315 instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005233AC second address: 00000000005233AC instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F99848EE8F8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e test dh, ch 0x00000020 add edi, edx 0x00000022 test ecx, ebx 0x00000024 dec ecx 0x00000025 jmp 00007F99848EE90Ah 0x00000027 test bl, bl 0x00000029 cmp ecx, 00000000h 0x0000002c jne 00007F99848EE8A5h 0x0000002e push ecx 0x0000002f jmp 00007F99848EE90Ah 0x00000031 cmp bh, ah 0x00000033 cmp ah, bh 0x00000035 call 00007F99848EE93Fh 0x0000003a call 00007F99848EE908h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526BD4 second address: 0000000000526BD4 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp byte ptr [ebx], FFFFFFB8h 0x0000000d jne 00007F99848EE922h 0x0000000f cmp ecx, 00002000h 0x00000015 jne 00007F99848EE7C6h 0x0000001b inc ecx 0x0000001c inc ebx 0x0000001d test cl, dl 0x0000001f cmp dword ptr [ebx], 9090C350h 0x00000025 jne 00007F99848EE926h 0x00000027 cmp edx, 257E6A7Fh 0x0000002d cmp edx, dword ptr [ebx] 0x0000002f jne 00007F99848EE916h 0x00000031 test dh, ch 0x00000033 cmp byte ptr [ebx], FFFFFFE8h 0x00000036 jne 00007F99848EE95Bh 0x00000038 cmp edi, 1B7EF1A7h 0x0000003e pushad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005209F7 second address: 00000000005209F7 instructions:
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000001101F83 second address: 0000000001101F83 instructions:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect Any.run

Source: C:\Users\user\Desktop\AMPUTERE.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\AMPUTERE.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005261EC second address: 00000000005261EC instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526246 second address: 0000000000526246 instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526315 second address: 0000000000526315 instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005233AC second address: 00000000005233AC instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F99848EE8F8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e test dh, ch 0x00000020 add edi, edx 0x00000022 test ecx, ebx 0x00000024 dec ecx 0x00000025 jmp 00007F99848EE90Ah 0x00000027 test bl, bl 0x00000029 cmp ecx, 00000000h 0x0000002c jne 00007F99848EE8A5h 0x0000002e push ecx 0x0000002f jmp 00007F99848EE90Ah 0x00000031 cmp bh, ah 0x00000033 cmp ah, bh 0x00000035 call 00007F99848EE93Fh 0x0000003a call 00007F99848EE908h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005235B0 second address: 00000000005235B0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F99845B8528h 0x0000001d popad 0x0000001e jmp 00007F99845B565Ah 0x00000020 test ch, dh 0x00000022 call 00007F99845B568Bh 0x00000027 lfence 0x0000002a rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526BD4 second address: 0000000000526BD4 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp byte ptr [ebx], FFFFFFB8h 0x0000000d jne 00007F99848EE922h 0x0000000f cmp ecx, 00002000h 0x00000015 jne 00007F99848EE7C6h 0x0000001b inc ecx 0x0000001c inc ebx 0x0000001d test cl, dl 0x0000001f cmp dword ptr [ebx], 9090C350h 0x00000025 jne 00007F99848EE926h 0x00000027 cmp edx, 257E6A7Fh 0x0000002d cmp edx, dword ptr [ebx] 0x0000002f jne 00007F99848EE916h 0x00000031 test dh, ch 0x00000033 cmp byte ptr [ebx], FFFFFFE8h 0x00000036 jne 00007F99848EE95Bh 0x00000038 cmp edi, 1B7EF1A7h 0x0000003e pushad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005209F7 second address: 00000000005209F7 instructions:
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	RDTSC instruction interceptor: First address: 00000000011035B0 second address: 00000000011035B0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F99848F17D8h 0x0000001d popad 0x0000001e jmp 00007F99848EE90Ah 0x00000020 test ch, dh 0x00000022 call 00007F99848EE93Bh 0x00000027 lfence 0x0000002a rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000001101F6C second address: 0000000001101F83 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 call 00007F99845B5BC9h 0x00000008 cmp dword ptr [edi+00000818h], 00000000h 0x0000000f je 00007F99845B5708h 0x00000015 test ah, ah 0x00000017 ret 0x00000018 cmp edx, A37443ABh 0x0000001e test edx, ecx 0x00000020 mov eax, dword ptr fs:[00000030h] 0x00000026 pushad 0x00000027 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000001101F83 second address: 0000000001101F83 instructions:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\AMPUTERE.exe

Code function: 0_2_00409418 rdtsc

0_2_00409418

Contains long sleeps (>= 3 min)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772	Thread sleep time: -3210000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772	Thread sleep time: -30000s >= -30000s	Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: RegAsm.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Source: C:\Users\user\Desktop\AMPUTERE.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger	Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\AMPUTERE.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\AMPUTERE.exe

Code function: 0_2_00409418 rdtsc

0_2_00409418

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 19_2_01104417 LdrInitializeThunk,

19_2_01104417

Contains functionality to read the PEB

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110690F mov eax, dword ptr fs:[00000030h]	19_2_0110690F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106977 mov eax, dword ptr fs:[00000030h]	19_2_01106977
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011031DF mov eax, dword ptr fs:[00000030h]	19_2_011031DF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106089 mov eax, dword ptr fs:[00000030h]	19_2_01106089
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01105733 mov eax, dword ptr fs:[00000030h]	19_2_01105733
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01103200 mov eax, dword ptr fs:[00000030h]	19_2_01103200

Enables debug privileges

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Source: C:\Users\user\Desktop\AMPUTERE.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 1100000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\AMPUTERE.exe

Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe'

Jump to behavior

Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 19_2_011069B3 cpuid

19_2_011069B3

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Source: Yara match	File source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

Yara detected Credential Stealer

Source: Yara match	File source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Source: Yara match	File source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
216.58.215.225	googlehosted.l.googleusercontent.com	United States		15169	GOOGLEUS	false

Contacted Domains

Name	IP	Active
googlehosted.l.googleusercontent.com	216.58.215.225	true
doc-14-a0-docs.googleusercontent.com	unknown	unknown

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: AMPUTERE.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: AMPUTERE.exe	Virustotal: Detection: 44%			Perma Link
Source: AMPUTERE.exe	ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: AMPUTERE.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: AMPUTERE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.6:49747 version: TLS 1.2

Networking:

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: doc-14-a0-docs.googleusercontent.com

Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp	String found in binary or memory: http://CFlLIU.com
Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RegAsm.exe	String found in binary or memory: https://drive.google.com/uc?export=download&id=1YqpUxJBnjokc5FJGT-8XzuYbR97RtVG2
Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown

HTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.6:49747 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: AMPUTERE.exe, 00000000.00000002.811048059.00000000005EA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\AMPUTERE.exe

Process Stats: CPU usage > 98%

Contains functionality to call native functions

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107349 NtQueryInformationProcess,	19_2_01107349
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106E63 NtProtectVirtualMemory,	19_2_01106E63
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110752F NtQueryInformationProcess,	19_2_0110752F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110755B NtQueryInformationProcess,	19_2_0110755B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110759F NtQueryInformationProcess,	19_2_0110759F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107583 NtQueryInformationProcess,	19_2_01107583
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011075BB NtQueryInformationProcess,	19_2_011075BB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011075E7 NtQueryInformationProcess,	19_2_011075E7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107417 NtQueryInformationProcess,	19_2_01107417
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107437 NtQueryInformationProcess,	19_2_01107437
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107457 NtQueryInformationProcess,	19_2_01107457
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107477 NtQueryInformationProcess,	19_2_01107477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011074A0 NtQueryInformationProcess,	19_2_011074A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011074DF NtQueryInformationProcess,	19_2_011074DF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110770C NtQueryInformationProcess,	19_2_0110770C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107747 NtQueryInformationProcess,	19_2_01107747
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110777F NtQueryInformationProcess,	19_2_0110777F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107363 NtQueryInformationProcess,	19_2_01107363
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107384 NtQueryInformationProcess,	19_2_01107384
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011073B3 NtQueryInformationProcess,	19_2_011073B3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011073CB NtQueryInformationProcess,	19_2_011073CB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011073EB NtQueryInformationProcess,	19_2_011073EB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107603 NtQueryInformationProcess,	19_2_01107603
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106E22 NtProtectVirtualMemory,	19_2_01106E22
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106E47 NtProtectVirtualMemory,	19_2_01106E47
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107663 NtQueryInformationProcess,	19_2_01107663
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011076AB NtQueryInformationProcess,	19_2_011076AB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011076CB NtQueryInformationProcess,	19_2_011076CB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_1DC8B0BA NtQuerySystemInformation,	19_2_1DC8B0BA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_1DC8B089 NtQuerySystemInformation,	19_2_1DC8B089

Detected potential crypto function

Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409418	0_2_00409418
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A862	0_2_0040A862
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A078	0_2_0040A078
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A478	0_2_0040A478
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040943F	0_2_0040943F
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409886	0_2_00409886
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004094B0	0_2_004094B0
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A101	0_2_0040A101
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A50A	0_2_0040A50A
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409D0C	0_2_00409D0C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409918	0_2_00409918
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409DED	0_2_00409DED
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409588	0_2_00409588
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A193	0_2_0040A193
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A595	0_2_0040A595
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004099A6	0_2_004099A6
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004095BE	0_2_004095BE
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409649	0_2_00409649
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A628	0_2_0040A628
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409A2A	0_2_00409A2A
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409A2C	0_2_00409A2C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409E30	0_2_00409E30
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A2C0	0_2_0040A2C0
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409EC4	0_2_00409EC4
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004096D5	0_2_004096D5
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A6FC	0_2_0040A6FC
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A6B3	0_2_0040A6B3
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409ABB	0_2_00409ABB
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A746	0_2_0040A746
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409B50	0_2_00409B50
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040A356	0_2_0040A356
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409F5F	0_2_00409F5F
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409762	0_2_00409762
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409BE2	0_2_00409BE2
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00409FE9	0_2_00409FE9
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004097F4	0_2_004097F4

Sample file is different than original file name gathered from version info

Source: AMPUTERE.exe, 00000000.00000002.811248602.0000000002200000.00000002.00000001.sdmp

Binary or memory string: OriginalFilenameuser32j% vs AMPUTERE.exe

Tries to load missing DLLs

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Uses 32bit PE files

Source: AMPUTERE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/0@1/1

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_1DC8AF3E AdjustTokenPrivileges,		19_2_1DC8AF3E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_1DC8AF07 AdjustTokenPrivileges,		19_2_1DC8AF07

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1212:120:WilError_01

Source: C:\Users\user\Desktop\AMPUTERE.exe

File created: C:\Users\user\AppData\Local\Temp\~DF371BB4A539764BA1.TMP

Jump to behavior

Source: AMPUTERE.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AMPUTERE.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\AMPUTERE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: AMPUTERE.exe	Virustotal: Detection: 44%
Source: AMPUTERE.exe	ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\AMPUTERE.exe 'C:\Users\user\Desktop\AMPUTERE.exe'
Source: C:\Users\user\Desktop\AMPUTERE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe'
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AMPUTERE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe'	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Source: Yara match	File source: 00000013.00000002.859923887.0000000001102000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

PE file contains an invalid checksum

Source: AMPUTERE.exe

Static PE information: real checksum: 0x255bc should be: 0x22e67

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040306C push esi; iretd	0_2_00403078
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040307A push esi; ret	0_2_0040307C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004034DD push ebp; ret	0_2_004034DE
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004058EE push esi; ret	0_2_00405918
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040888A push esi; ret	0_2_0040888C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_004071F6 push esi; retf	0_2_0040723C
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_0040723D push esi; ret	0_2_00407280
Source: C:\Users\user\Desktop\AMPUTERE.exe	Code function: 0_2_00404BEA push esi; iretd	0_2_00404BEC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01104B84 push dword ptr [ebp+77h]; ret	19_2_01104B89
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01107384 push cs; retn EB1Ah	19_2_011073A0

Source: C:\Users\user\Desktop\AMPUTERE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AMPUTERE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AMPUTERE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01103317		19_2_01103317
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011032A2		19_2_011032A2

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005261EC second address: 00000000005261EC instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526246 second address: 0000000000526246 instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526315 second address: 0000000000526315 instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005233AC second address: 00000000005233AC instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F99848EE8F8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e test dh, ch 0x00000020 add edi, edx 0x00000022 test ecx, ebx 0x00000024 dec ecx 0x00000025 jmp 00007F99848EE90Ah 0x00000027 test bl, bl 0x00000029 cmp ecx, 00000000h 0x0000002c jne 00007F99848EE8A5h 0x0000002e push ecx 0x0000002f jmp 00007F99848EE90Ah 0x00000031 cmp bh, ah 0x00000033 cmp ah, bh 0x00000035 call 00007F99848EE93Fh 0x0000003a call 00007F99848EE908h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526BD4 second address: 0000000000526BD4 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp byte ptr [ebx], FFFFFFB8h 0x0000000d jne 00007F99848EE922h 0x0000000f cmp ecx, 00002000h 0x00000015 jne 00007F99848EE7C6h 0x0000001b inc ecx 0x0000001c inc ebx 0x0000001d test cl, dl 0x0000001f cmp dword ptr [ebx], 9090C350h 0x00000025 jne 00007F99848EE926h 0x00000027 cmp edx, 257E6A7Fh 0x0000002d cmp edx, dword ptr [ebx] 0x0000002f jne 00007F99848EE916h 0x00000031 test dh, ch 0x00000033 cmp byte ptr [ebx], FFFFFFE8h 0x00000036 jne 00007F99848EE95Bh 0x00000038 cmp edi, 1B7EF1A7h 0x0000003e pushad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005209F7 second address: 00000000005209F7 instructions:
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000001101F83 second address: 0000000001101F83 instructions:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect Any.run

Source: C:\Users\user\Desktop\AMPUTERE.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\AMPUTERE.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005261EC second address: 00000000005261EC instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526246 second address: 0000000000526246 instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526315 second address: 0000000000526315 instructions:
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005233AC second address: 00000000005233AC instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F99848EE8F8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e test dh, ch 0x00000020 add edi, edx 0x00000022 test ecx, ebx 0x00000024 dec ecx 0x00000025 jmp 00007F99848EE90Ah 0x00000027 test bl, bl 0x00000029 cmp ecx, 00000000h 0x0000002c jne 00007F99848EE8A5h 0x0000002e push ecx 0x0000002f jmp 00007F99848EE90Ah 0x00000031 cmp bh, ah 0x00000033 cmp ah, bh 0x00000035 call 00007F99848EE93Fh 0x0000003a call 00007F99848EE908h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005235B0 second address: 00000000005235B0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F99845B8528h 0x0000001d popad 0x0000001e jmp 00007F99845B565Ah 0x00000020 test ch, dh 0x00000022 call 00007F99845B568Bh 0x00000027 lfence 0x0000002a rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 0000000000526BD4 second address: 0000000000526BD4 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp byte ptr [ebx], FFFFFFB8h 0x0000000d jne 00007F99848EE922h 0x0000000f cmp ecx, 00002000h 0x00000015 jne 00007F99848EE7C6h 0x0000001b inc ecx 0x0000001c inc ebx 0x0000001d test cl, dl 0x0000001f cmp dword ptr [ebx], 9090C350h 0x00000025 jne 00007F99848EE926h 0x00000027 cmp edx, 257E6A7Fh 0x0000002d cmp edx, dword ptr [ebx] 0x0000002f jne 00007F99848EE916h 0x00000031 test dh, ch 0x00000033 cmp byte ptr [ebx], FFFFFFE8h 0x00000036 jne 00007F99848EE95Bh 0x00000038 cmp edi, 1B7EF1A7h 0x0000003e pushad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\AMPUTERE.exe	RDTSC instruction interceptor: First address: 00000000005209F7 second address: 00000000005209F7 instructions:
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	RDTSC instruction interceptor: First address: 00000000011035B0 second address: 00000000011035B0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F99848F17D8h 0x0000001d popad 0x0000001e jmp 00007F99848EE90Ah 0x00000020 test ch, dh 0x00000022 call 00007F99848EE93Bh 0x00000027 lfence 0x0000002a rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000001101F6C second address: 0000000001101F83 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 call 00007F99845B5BC9h 0x00000008 cmp dword ptr [edi+00000818h], 00000000h 0x0000000f je 00007F99845B5708h 0x00000015 test ah, ah 0x00000017 ret 0x00000018 cmp edx, A37443ABh 0x0000001e test edx, ecx 0x00000020 mov eax, dword ptr fs:[00000030h] 0x00000026 pushad 0x00000027 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	RDTSC instruction interceptor: First address: 0000000001101F83 second address: 0000000001101F83 instructions:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\AMPUTERE.exe

Code function: 0_2_00409418 rdtsc

0_2_00409418

Contains long sleeps (>= 3 min)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772	Thread sleep time: -3210000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772	Thread sleep time: -30000s >= -30000s	Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: RegAsm.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Source: C:\Users\user\Desktop\AMPUTERE.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread information set: HideFromDebugger	Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\AMPUTERE.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\AMPUTERE.exe

Code function: 0_2_00409418 rdtsc

0_2_00409418

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 19_2_01104417 LdrInitializeThunk,

19_2_01104417

Contains functionality to read the PEB

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_0110690F mov eax, dword ptr fs:[00000030h]	19_2_0110690F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106977 mov eax, dword ptr fs:[00000030h]	19_2_01106977
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_011031DF mov eax, dword ptr fs:[00000030h]	19_2_011031DF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01106089 mov eax, dword ptr fs:[00000030h]	19_2_01106089
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01105733 mov eax, dword ptr fs:[00000030h]	19_2_01105733
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 19_2_01103200 mov eax, dword ptr fs:[00000030h]	19_2_01103200

Enables debug privileges

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Source: C:\Users\user\Desktop\AMPUTERE.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 1100000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\AMPUTERE.exe

Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe'

Jump to behavior

Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Code function: 19_2_011069B3 cpuid

19_2_011069B3

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Source: Yara match	File source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

Yara detected Credential Stealer

Source: Yara match	File source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Source: Yara match	File source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

ID:	379730
Product:	CloudBasic
Start time:	07:40:53
Start date:	01.04.2021
Sample:	AMPUTERE.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	f2fa3c87de32858f1244fb352873f399
SHA1:	3d6f6d635639c689a8e4709ccb379500b4e76096
SHA256:	2beda3caff1f808814294dca346cbe62ad229272d54696fe75e99388a73ff3cc
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Analysis Report AMPUTERE.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains