Loading ...

Play interactive tourEdit tour

Analysis Report AMPUTERE.exe

Overview

General Information

Sample Name:AMPUTERE.exe
Analysis ID:379730
MD5:f2fa3c87de32858f1244fb352873f399
SHA1:3d6f6d635639c689a8e4709ccb379500b4e76096
SHA256:2beda3caff1f808814294dca346cbe62ad229272d54696fe75e99388a73ff3cc
Tags:exeGuLoader
Infos:

Most interesting Screenshot:

Detection

AgentTesla GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • AMPUTERE.exe (PID: 6608 cmdline: 'C:\Users\user\Desktop\AMPUTERE.exe' MD5: F2FA3C87DE32858F1244FB352873F399)
    • RegAsm.exe (PID: 6044 cmdline: 'C:\Users\user\Desktop\AMPUTERE.exe' MD5: 529695608EAFBED00ACA9E61EF333A7C)
      • conhost.exe (PID: 1212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000013.00000002.859923887.0000000001102000.00000040.00000001.sdmpJoeSecurity_GuLoaderYara detected GuLoaderJoe Security
        Process Memory Space: RegAsm.exe PID: 6044JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          Process Memory Space: RegAsm.exe PID: 6044JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 1 entries

            Sigma Overview

            No Sigma rule has matched

            Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Antivirus / Scanner detection for submitted sampleShow sources
            Source: AMPUTERE.exeAvira: detected
            Multi AV Scanner detection for submitted fileShow sources
            Source: AMPUTERE.exeVirustotal: Detection: 44%Perma Link
            Source: AMPUTERE.exeReversingLabs: Detection: 68%
            Machine Learning detection for sampleShow sources
            Source: AMPUTERE.exeJoe Sandbox ML: detected
            Source: AMPUTERE.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
            Source: unknownHTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.6:49747 version: TLS 1.2
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: unknownDNS traffic detected: queries for: doc-14-a0-docs.googleusercontent.com
            Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
            Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmpString found in binary or memory: http://CFlLIU.com
            Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
            Source: RegAsm.exeString found in binary or memory: https://drive.google.com/uc?export=download&id=1YqpUxJBnjokc5FJGT-8XzuYbR97RtVG2
            Source: RegAsm.exe, 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
            Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
            Source: unknownHTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.6:49747 version: TLS 1.2
            Source: AMPUTERE.exe, 00000000.00000002.811048059.00000000005EA000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
            Source: C:\Users\user\Desktop\AMPUTERE.exeProcess Stats: CPU usage > 98%
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107349 NtQueryInformationProcess,19_2_01107349
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01106E63 NtProtectVirtualMemory,19_2_01106E63
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_0110752F NtQueryInformationProcess,19_2_0110752F
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_0110755B NtQueryInformationProcess,19_2_0110755B
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_0110759F NtQueryInformationProcess,19_2_0110759F
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107583 NtQueryInformationProcess,19_2_01107583
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011075BB NtQueryInformationProcess,19_2_011075BB
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011075E7 NtQueryInformationProcess,19_2_011075E7
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107417 NtQueryInformationProcess,19_2_01107417
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107437 NtQueryInformationProcess,19_2_01107437
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107457 NtQueryInformationProcess,19_2_01107457
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107477 NtQueryInformationProcess,19_2_01107477
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011074A0 NtQueryInformationProcess,19_2_011074A0
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011074DF NtQueryInformationProcess,19_2_011074DF
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_0110770C NtQueryInformationProcess,19_2_0110770C
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107747 NtQueryInformationProcess,19_2_01107747
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_0110777F NtQueryInformationProcess,19_2_0110777F
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107363 NtQueryInformationProcess,19_2_01107363
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107384 NtQueryInformationProcess,19_2_01107384
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011073B3 NtQueryInformationProcess,19_2_011073B3
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011073CB NtQueryInformationProcess,19_2_011073CB
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011073EB NtQueryInformationProcess,19_2_011073EB
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107603 NtQueryInformationProcess,19_2_01107603
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01106E22 NtProtectVirtualMemory,19_2_01106E22
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01106E47 NtProtectVirtualMemory,19_2_01106E47
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107663 NtQueryInformationProcess,19_2_01107663
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011076AB NtQueryInformationProcess,19_2_011076AB
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011076CB NtQueryInformationProcess,19_2_011076CB
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_1DC8B0BA NtQuerySystemInformation,19_2_1DC8B0BA
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_1DC8B089 NtQuerySystemInformation,19_2_1DC8B089
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004094180_2_00409418
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A8620_2_0040A862
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A0780_2_0040A078
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A4780_2_0040A478
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040943F0_2_0040943F
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004098860_2_00409886
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004094B00_2_004094B0
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A1010_2_0040A101
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A50A0_2_0040A50A
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409D0C0_2_00409D0C
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004099180_2_00409918
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409DED0_2_00409DED
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004095880_2_00409588
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A1930_2_0040A193
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A5950_2_0040A595
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004099A60_2_004099A6
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004095BE0_2_004095BE
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004096490_2_00409649
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A6280_2_0040A628
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409A2A0_2_00409A2A
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409A2C0_2_00409A2C
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409E300_2_00409E30
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A2C00_2_0040A2C0
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409EC40_2_00409EC4
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004096D50_2_004096D5
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A6FC0_2_0040A6FC
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A6B30_2_0040A6B3
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409ABB0_2_00409ABB
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A7460_2_0040A746
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409B500_2_00409B50
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040A3560_2_0040A356
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409F5F0_2_00409F5F
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004097620_2_00409762
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409BE20_2_00409BE2
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409FE90_2_00409FE9
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004097F40_2_004097F4
            Source: AMPUTERE.exe, 00000000.00000002.811248602.0000000002200000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs AMPUTERE.exe
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeSection loaded: sfc.dllJump to behavior
            Source: AMPUTERE.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
            Source: classification engineClassification label: mal100.troj.evad.winEXE@4/0@1/1
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_1DC8AF3E AdjustTokenPrivileges,19_2_1DC8AF3E
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_1DC8AF07 AdjustTokenPrivileges,19_2_1DC8AF07
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1212:120:WilError_01
            Source: C:\Users\user\Desktop\AMPUTERE.exeFile created: C:\Users\user\AppData\Local\Temp\~DF371BB4A539764BA1.TMPJump to behavior
            Source: AMPUTERE.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\AMPUTERE.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Users\user\Desktop\AMPUTERE.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: AMPUTERE.exeVirustotal: Detection: 44%
            Source: AMPUTERE.exeReversingLabs: Detection: 68%
            Source: unknownProcess created: C:\Users\user\Desktop\AMPUTERE.exe 'C:\Users\user\Desktop\AMPUTERE.exe'
            Source: C:\Users\user\Desktop\AMPUTERE.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe'
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\AMPUTERE.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe' Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior

            Data Obfuscation:

            barindex
            Yara detected GuLoaderShow sources
            Source: Yara matchFile source: 00000013.00000002.859923887.0000000001102000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY
            Source: AMPUTERE.exeStatic PE information: real checksum: 0x255bc should be: 0x22e67
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040306C push esi; iretd 0_2_00403078
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040307A push esi; ret 0_2_0040307C
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004034DD push ebp; ret 0_2_004034DE
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004058EE push esi; ret 0_2_00405918
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040888A push esi; ret 0_2_0040888C
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_004071F6 push esi; retf 0_2_0040723C
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_0040723D push esi; ret 0_2_00407280
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00404BEA push esi; iretd 0_2_00404BEC
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01104B84 push dword ptr [ebp+77h]; ret 19_2_01104B89
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01107384 push cs; retn EB1Ah19_2_011073A0
            Source: C:\Users\user\Desktop\AMPUTERE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\AMPUTERE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\AMPUTERE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion:

            barindex
            Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01103317 19_2_01103317
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011032A2 19_2_011032A2
            Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 00000000005261EC second address: 00000000005261EC instructions:
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 0000000000526246 second address: 0000000000526246 instructions:
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 0000000000526315 second address: 0000000000526315 instructions:
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 00000000005233AC second address: 00000000005233AC instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F99848EE8F8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e test dh, ch 0x00000020 add edi, edx 0x00000022 test ecx, ebx 0x00000024 dec ecx 0x00000025 jmp 00007F99848EE90Ah 0x00000027 test bl, bl 0x00000029 cmp ecx, 00000000h 0x0000002c jne 00007F99848EE8A5h 0x0000002e push ecx 0x0000002f jmp 00007F99848EE90Ah 0x00000031 cmp bh, ah 0x00000033 cmp ah, bh 0x00000035 call 00007F99848EE93Fh 0x0000003a call 00007F99848EE908h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 0000000000526BD4 second address: 0000000000526BD4 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp byte ptr [ebx], FFFFFFB8h 0x0000000d jne 00007F99848EE922h 0x0000000f cmp ecx, 00002000h 0x00000015 jne 00007F99848EE7C6h 0x0000001b inc ecx 0x0000001c inc ebx 0x0000001d test cl, dl 0x0000001f cmp dword ptr [ebx], 9090C350h 0x00000025 jne 00007F99848EE926h 0x00000027 cmp edx, 257E6A7Fh 0x0000002d cmp edx, dword ptr [ebx] 0x0000002f jne 00007F99848EE916h 0x00000031 test dh, ch 0x00000033 cmp byte ptr [ebx], FFFFFFE8h 0x00000036 jne 00007F99848EE95Bh 0x00000038 cmp edi, 1B7EF1A7h 0x0000003e pushad 0x0000003f rdtsc
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 00000000005209F7 second address: 00000000005209F7 instructions:
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeRDTSC instruction interceptor: First address: 0000000001101F83 second address: 0000000001101F83 instructions:
            Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
            Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
            Tries to detect Any.runShow sources
            Source: C:\Users\user\Desktop\AMPUTERE.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Users\user\Desktop\AMPUTERE.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
            Source: RegAsm.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
            Tries to detect virtualization through RDTSC time measurementsShow sources
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 00000000005261EC second address: 00000000005261EC instructions:
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 0000000000526246 second address: 0000000000526246 instructions:
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 0000000000526315 second address: 0000000000526315 instructions:
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 00000000005233AC second address: 00000000005233AC instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F99848EE8F8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e test dh, ch 0x00000020 add edi, edx 0x00000022 test ecx, ebx 0x00000024 dec ecx 0x00000025 jmp 00007F99848EE90Ah 0x00000027 test bl, bl 0x00000029 cmp ecx, 00000000h 0x0000002c jne 00007F99848EE8A5h 0x0000002e push ecx 0x0000002f jmp 00007F99848EE90Ah 0x00000031 cmp bh, ah 0x00000033 cmp ah, bh 0x00000035 call 00007F99848EE93Fh 0x0000003a call 00007F99848EE908h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 00000000005235B0 second address: 00000000005235B0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F99845B8528h 0x0000001d popad 0x0000001e jmp 00007F99845B565Ah 0x00000020 test ch, dh 0x00000022 call 00007F99845B568Bh 0x00000027 lfence 0x0000002a rdtsc
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 0000000000526BD4 second address: 0000000000526BD4 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a cmp byte ptr [ebx], FFFFFFB8h 0x0000000d jne 00007F99848EE922h 0x0000000f cmp ecx, 00002000h 0x00000015 jne 00007F99848EE7C6h 0x0000001b inc ecx 0x0000001c inc ebx 0x0000001d test cl, dl 0x0000001f cmp dword ptr [ebx], 9090C350h 0x00000025 jne 00007F99848EE926h 0x00000027 cmp edx, 257E6A7Fh 0x0000002d cmp edx, dword ptr [ebx] 0x0000002f jne 00007F99848EE916h 0x00000031 test dh, ch 0x00000033 cmp byte ptr [ebx], FFFFFFE8h 0x00000036 jne 00007F99848EE95Bh 0x00000038 cmp edi, 1B7EF1A7h 0x0000003e pushad 0x0000003f rdtsc
            Source: C:\Users\user\Desktop\AMPUTERE.exeRDTSC instruction interceptor: First address: 00000000005209F7 second address: 00000000005209F7 instructions:
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeRDTSC instruction interceptor: First address: 00000000011035B0 second address: 00000000011035B0 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F99848F17D8h 0x0000001d popad 0x0000001e jmp 00007F99848EE90Ah 0x00000020 test ch, dh 0x00000022 call 00007F99848EE93Bh 0x00000027 lfence 0x0000002a rdtsc
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeRDTSC instruction interceptor: First address: 0000000001101F6C second address: 0000000001101F83 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 call 00007F99845B5BC9h 0x00000008 cmp dword ptr [edi+00000818h], 00000000h 0x0000000f je 00007F99845B5708h 0x00000015 test ah, ah 0x00000017 ret 0x00000018 cmp edx, A37443ABh 0x0000001e test edx, ecx 0x00000020 mov eax, dword ptr fs:[00000030h] 0x00000026 pushad 0x00000027 rdtsc
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeRDTSC instruction interceptor: First address: 0000000001101F83 second address: 0000000001101F83 instructions:
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409418 rdtsc 0_2_00409418
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772Thread sleep time: -3210000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 772Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeThread delayed: delay time: 30000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeThread delayed: delay time: 30000Jump to behavior
            Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
            Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
            Source: RegAsm.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
            Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
            Source: RegAsm.exe, 00000013.00000002.865466102.00000000203F0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess information queried: ProcessInformationJump to behavior

            Anti Debugging:

            barindex
            Hides threads from debuggersShow sources
            Source: C:\Users\user\Desktop\AMPUTERE.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Users\user\Desktop\AMPUTERE.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\AMPUTERE.exeCode function: 0_2_00409418 rdtsc 0_2_00409418
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01104417 LdrInitializeThunk,19_2_01104417
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_0110690F mov eax, dword ptr fs:[00000030h]19_2_0110690F
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01106977 mov eax, dword ptr fs:[00000030h]19_2_01106977
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011031DF mov eax, dword ptr fs:[00000030h]19_2_011031DF
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01106089 mov eax, dword ptr fs:[00000030h]19_2_01106089
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01105733 mov eax, dword ptr fs:[00000030h]19_2_01105733
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_01103200 mov eax, dword ptr fs:[00000030h]19_2_01103200
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion:

            barindex
            Writes to foreign memory regionsShow sources
            Source: C:\Users\user\Desktop\AMPUTERE.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 1100000Jump to behavior
            Source: C:\Users\user\Desktop\AMPUTERE.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 'C:\Users\user\Desktop\AMPUTERE.exe' Jump to behavior
            Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
            Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmpBinary or memory string: Progman
            Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmpBinary or memory string: &Program Manager
            Source: RegAsm.exe, 00000013.00000002.860438642.0000000001980000.00000002.00000001.sdmpBinary or memory string: Progmanlock
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeCode function: 19_2_011069B3 cpuid 19_2_011069B3
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information:

            barindex
            Yara detected AgentTeslaShow sources
            Source: Yara matchFile source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY
            Source: Yara matchFile source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

            Remote Access Functionality:

            barindex
            Yara detected AgentTeslaShow sources
            Source: Yara matchFile source: 00000013.00000002.864518316.000000001DEE1000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 6044, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management Instrumentation211DLL Side-Loading1Access Token Manipulation1Disable or Modify Tools1Input Capture1Security Software Discovery731Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel12Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsProcess Injection112Virtualization/Sandbox Evasion341LSASS MemoryProcess Discovery2Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)DLL Side-Loading1Access Token Manipulation1Security Account ManagerVirtualization/Sandbox Evasion341SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud Backups</