Analysis Report PAYMENT CONFIRMATION.exe

Overview

General Information

Sample Name: PAYMENT CONFIRMATION.exe
Analysis ID: 385300
MD5: b7724fd635cc9c0ac12af69468d8f734
SHA1: db18fe9a073456a11a8346e510b3d04d6f64adc9
SHA256: 6df1420d84c9c0a1427b91fdf3e9fe8b6245f9f8ea3b00658c430106e72d33d8
Tags: AgentTesla
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: 1.2.PAYMENT CONFIRMATION.exe.37d32c0.2.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "ho@almasroor.com042264528mail.almasroor.com"}
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: PAYMENT CONFIRMATION.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 2.2.PAYMENT CONFIRMATION.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 20.2.kprUEGC.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: PAYMENT CONFIRMATION.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: PAYMENT CONFIRMATION.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49742 -> 69.65.3.206:587
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49742 -> 69.65.3.206:587
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ASN-GIGENETUS ASN-GIGENETUS
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.3:49742 -> 69.65.3.206:587
Source: unknown DNS traffic detected: queries for: mail.almasroor.com
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.473828679.0000000003151000.00000004.00000001.sdmp, kprUEGC.exe, 00000014.00000002.472291889.0000000002BE1000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: kprUEGC.exe, 00000014.00000002.472291889.0000000002BE1000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.476420854.000000000340C000.00000004.00000001.sdmp String found in binary or memory: http://almasroor.com
Source: kprUEGC.exe, 00000014.00000002.472291889.0000000002BE1000.00000004.00000001.sdmp String found in binary or memory: http://bQxorv.com
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.476420854.000000000340C000.00000004.00000001.sdmp String found in binary or memory: http://mail.almasroor.com
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.476023319.00000000033D1000.00000004.00000001.sdmp String found in binary or memory: https://IJiNPGixATMzyiVeKdM.org
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.473828679.0000000003151000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%0
Source: kprUEGC.exe, 00000014.00000002.472291889.0000000002BE1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: PAYMENT CONFIRMATION.exe, 00000001.00000002.218173630.00000000035A9000.00000004.00000001.sdmp, PAYMENT CONFIRMATION.exe, 00000002.00000002.466852718.0000000000402000.00000040.00000001.sdmp, kprUEGC.exe, 00000008.00000002.303769479.0000000003CB9000.00000004.00000001.sdmp, kprUEGC.exe, 00000014.00000002.466854304.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.473828679.0000000003151000.00000004.00000001.sdmp, kprUEGC.exe, 00000014.00000002.472291889.0000000002BE1000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Jump to behavior
Creates a DirectInput object (often for capturing keystrokes)
Source: kprUEGC.exe, 00000008.00000002.302933279.0000000000ED8000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

Spam, unwanted Advertisements and Ransom Demands:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

System Summary:

barindex
.NET source code contains very large array initializations
Source: 2.2.PAYMENT CONFIRMATION.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bE39C872Eu002d8914u002d48C3u002dBF35u002dA8B0A9168404u007d/u00311446D9Eu002dE05Fu002d4878u002dAF9Eu002d244D020F16BC.cs Large array initialization: .cctor: array initializer size 11951
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: PAYMENT CONFIRMATION.exe
Detected potential crypto function
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017929D 1_2_0017929D
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_00179BE6 1_2_00179BE6
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_00B6C164 1_2_00B6C164
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_00B6E5B0 1_2_00B6E5B0
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_00B6E5A0 1_2_00B6E5A0
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AA6320 1_2_04AA6320
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AA6840 1_2_04AA6840
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AAC090 1_2_04AAC090
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AA630F 1_2_04AA630F
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AA6831 1_2_04AA6831
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AAB0A0 1_2_04AAB0A0
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AAB09F 1_2_04AAB09F
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AAD210 1_2_04AAD210
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D5929D 2_2_00D5929D
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D59BE6 2_2_00D59BE6
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_015547A0 2_2_015547A0
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_01553CCC 2_2_01553CCC
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_01554772 2_2_01554772
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_01554790 2_2_01554790
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_01555490 2_2_01555490
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_0155D820 2_2_0155D820
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007F9BE6 8_2_007F9BE6
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007F929D 8_2_007F929D
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_0133C164 8_2_0133C164
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_0133E5B0 8_2_0133E5B0
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_0133E5A0 8_2_0133E5A0
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_0057929D 19_2_0057929D
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_00579BE6 19_2_00579BE6
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_00CDC164 19_2_00CDC164
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_00CDE5A0 19_2_00CDE5A0
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_00CDE5B0 19_2_00CDE5B0
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_006E9BE6 20_2_006E9BE6
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_006E929D 20_2_006E929D
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_02A147A0 20_2_02A147A0
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_02A14718 20_2_02A14718
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_02A1D820 20_2_02A1D820
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_05E47530 20_2_05E47530
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_05E494F0 20_2_05E494F0
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_05E46918 20_2_05E46918
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_05E46C60 20_2_05E46C60
PE file contains strange resources
Source: PAYMENT CONFIRMATION.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: kprUEGC.exe.2.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: PAYMENT CONFIRMATION.exe, 00000001.00000002.217862007.0000000002581000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMetroFramework.dll> vs PAYMENT CONFIRMATION.exe
Source: PAYMENT CONFIRMATION.exe, 00000001.00000000.200737209.0000000000216000.00000002.00020000.sdmp Binary or memory string: OriginalFilename48Vu.exeH vs PAYMENT CONFIRMATION.exe
Source: PAYMENT CONFIRMATION.exe, 00000001.00000002.218173630.00000000035A9000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameelxZSujHMHuHJxbAMwLHIgWJxBXR.exe4 vs PAYMENT CONFIRMATION.exe
Source: PAYMENT CONFIRMATION.exe, 00000001.00000002.221887306.00000000056E1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs PAYMENT CONFIRMATION.exe
Source: PAYMENT CONFIRMATION.exe, 00000002.00000003.261003873.0000000006B11000.00000004.00000001.sdmp Binary or memory string: OriginalFilename48Vu.exeH vs PAYMENT CONFIRMATION.exe
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.466852718.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameelxZSujHMHuHJxbAMwLHIgWJxBXR.exe4 vs PAYMENT CONFIRMATION.exe
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.470834629.0000000001320000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamewshom.ocx vs PAYMENT CONFIRMATION.exe
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.469393946.0000000000FB8000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PAYMENT CONFIRMATION.exe
Source: PAYMENT CONFIRMATION.exe Binary or memory string: OriginalFilename48Vu.exeH vs PAYMENT CONFIRMATION.exe
Uses 32bit PE files
Source: PAYMENT CONFIRMATION.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: PAYMENT CONFIRMATION.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: kprUEGC.exe.2.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 2.2.PAYMENT CONFIRMATION.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.PAYMENT CONFIRMATION.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@7/6@2/1
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PAYMENT CONFIRMATION.exe.log Jump to behavior
Source: PAYMENT CONFIRMATION.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File read: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe 'C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe'
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process created: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe {path}
Source: unknown Process created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe 'C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe'
Source: unknown Process created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe 'C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe'
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe {path}
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process created: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe {path} Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: PAYMENT CONFIRMATION.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PAYMENT CONFIRMATION.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: PAYMENT CONFIRMATION.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

barindex
Binary contains a suspicious time stamp
Source: PAYMENT CONFIRMATION.exe Static PE information: 0xF55F3D02 [Mon Jun 14 12:30:58 2100 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B297 push cs; iretd 1_2_0017B29A
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B501 push cs; iretd 1_2_0017B502
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B58C push cs; iretd 1_2_0017B58E
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B023 push cs; iretd 1_2_0017B024
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B02F push cs; iretd 1_2_0017B032
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B928 push cs; iretd 1_2_0017B92A
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B945 push cs; iretd 1_2_0017B946
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B3E7 push cs; iretd 1_2_0017B3EA
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B4E5 push cs; iretd 1_2_0017B4E6
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017AEE0 push cs; iretd 1_2_0017AEE2
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_0017B5EE push cs; iretd 1_2_0017B5F0
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AAAC68 push eax; iretd 1_2_04AAAC71
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 1_2_04AACE19 push ecx; iretd 1_2_04AACE26
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D5B297 push cs; iretd 2_2_00D5B29A
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D5B945 push cs; iretd 2_2_00D5B946
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D5B3E7 push cs; iretd 2_2_00D5B3EA
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D5AEE0 push cs; iretd 2_2_00D5AEE2
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D5B023 push cs; iretd 2_2_00D5B024
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D5B02F push cs; iretd 2_2_00D5B032
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Code function: 2_2_00D5B928 push cs; iretd 2_2_00D5B92A
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007FB02F push cs; iretd 8_2_007FB032
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007FB928 push cs; iretd 8_2_007FB92A
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007FB3E7 push cs; iretd 8_2_007FB3EA
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007FB023 push cs; iretd 8_2_007FB024
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007FAEE0 push cs; iretd 8_2_007FAEE2
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007FB297 push cs; iretd 8_2_007FB29A
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 8_2_007FB945 push cs; iretd 8_2_007FB946
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_0057B297 push cs; iretd 19_2_0057B29A
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_0057B945 push cs; iretd 19_2_0057B946
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_0057B3E7 push cs; iretd 19_2_0057B3EA
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 19_2_0057B023 push cs; iretd 19_2_0057B024
Source: initial sample Static PE information: section name: .text entropy: 7.88580318793
Source: initial sample Static PE information: section name: .text entropy: 7.88580318793

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Jump to dropped file
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run kprUEGC Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run kprUEGC Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File opened: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: kprUEGC.exe PID: 4156, type: MEMORY
Source: Yara match File source: Process Memory Space: PAYMENT CONFIRMATION.exe PID: 5940, type: MEMORY
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: PAYMENT CONFIRMATION.exe, 00000001.00000002.222431551.0000000005B26000.00000004.00000001.sdmp, kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PAYMENT CONFIRMATION.exe, 00000001.00000002.222431551.0000000005B26000.00000004.00000001.sdmp, kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Window / User API: threadDelayed 2540 Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Window / User API: threadDelayed 7310 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Window / User API: threadDelayed 5028 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Window / User API: threadDelayed 4772 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe TID: 2540 Thread sleep time: -31500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe TID: 2576 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe TID: 5464 Thread sleep time: -17524406870024063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe TID: 3352 Thread sleep count: 2540 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe TID: 3352 Thread sleep count: 7310 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe TID: 5952 Thread sleep time: -31500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe TID: 4472 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe TID: 6656 Thread sleep time: -31500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe TID: 6912 Thread sleep time: -17524406870024063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe TID: 6916 Thread sleep count: 5028 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe TID: 6916 Thread sleep count: 4772 > 30 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Thread delayed: delay time: 31500 Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Thread delayed: delay time: 31500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Thread delayed: delay time: 31500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: vmware
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.480197568.0000000006B10000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: kprUEGC.exe, 00000008.00000002.307848677.0000000006175000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Process created: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe {path} Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Process created: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe {path} Jump to behavior
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.473203991.0000000001B60000.00000002.00000001.sdmp, kprUEGC.exe, 00000014.00000002.471237564.0000000001560000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.473203991.0000000001B60000.00000002.00000001.sdmp, kprUEGC.exe, 00000014.00000002.471237564.0000000001560000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.473203991.0000000001B60000.00000002.00000001.sdmp, kprUEGC.exe, 00000014.00000002.471237564.0000000001560000.00000002.00000001.sdmp Binary or memory string: Progman
Source: PAYMENT CONFIRMATION.exe, 00000002.00000002.473203991.0000000001B60000.00000002.00000001.sdmp, kprUEGC.exe, 00000014.00000002.471237564.0000000001560000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\kprUEGC\kprUEGC.exe Code function: 20_2_05E44FFC GetUserNameW, 20_2_05E44FFC
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000014.00000002.466854304.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.466852718.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.218173630.00000000035A9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.303769479.0000000003CB9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.472291889.0000000002BE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PAYMENT CONFIRMATION.exe PID: 2208, type: MEMORY
Source: Yara match File source: Process Memory Space: kprUEGC.exe PID: 4156, type: MEMORY
Source: Yara match File source: Process Memory Space: kprUEGC.exe PID: 6672, type: MEMORY
Source: Yara match File source: Process Memory Space: PAYMENT CONFIRMATION.exe PID: 5940, type: MEMORY
Source: Yara match File source: 1.2.PAYMENT CONFIRMATION.exe.37d32c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.kprUEGC.exe.3ee32c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.PAYMENT CONFIRMATION.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.kprUEGC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PAYMENT CONFIRMATION.exe.37d32c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.kprUEGC.exe.3ee32c0.2.raw.unpack, type: UNPACKEDPE
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT CONFIRMATION.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000014.00000002.472291889.0000000002BE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.473828679.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PAYMENT CONFIRMATION.exe PID: 2208, type: MEMORY
Source: Yara match File source: Process Memory Space: kprUEGC.exe PID: 6672, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000014.00000002.466854304.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.466852718.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.218173630.00000000035A9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.303769479.0000000003CB9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.472291889.0000000002BE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PAYMENT CONFIRMATION.exe PID: 2208, type: MEMORY
Source: Yara match File source: Process Memory Space: kprUEGC.exe PID: 4156, type: MEMORY
Source: Yara match File source: Process Memory Space: kprUEGC.exe PID: 6672, type: MEMORY
Source: Yara match File source: Process Memory Space: PAYMENT CONFIRMATION.exe PID: 5940, type: MEMORY
Source: Yara match File source: 1.2.PAYMENT CONFIRMATION.exe.37d32c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.kprUEGC.exe.3ee32c0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.PAYMENT CONFIRMATION.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.kprUEGC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PAYMENT CONFIRMATION.exe.37d32c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.kprUEGC.exe.3ee32c0.2.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 385300 Sample: PAYMENT CONFIRMATION.exe Startdate: 12/04/2021 Architecture: WINDOWS Score: 100 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Yara detected AgentTesla 2->45 47 7 other signatures 2->47 6 PAYMENT CONFIRMATION.exe 3 2->6         started        9 kprUEGC.exe 3 2->9         started        12 kprUEGC.exe 2 2->12         started        process3 file4 21 C:\Users\...\PAYMENT CONFIRMATION.exe.log, ASCII 6->21 dropped 14 PAYMENT CONFIRMATION.exe 2 5 6->14         started        49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 9->49 51 Machine Learning detection for dropped file 9->51 53 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 9->53 19 kprUEGC.exe 2 9->19         started        signatures5 process6 dnsIp7 29 almasroor.com 69.65.3.206, 49742, 587 ASN-GIGENETUS United States 14->29 31 mail.almasroor.com 14->31 23 C:\Users\user\AppData\Roaming\...\kprUEGC.exe, PE32 14->23 dropped 25 C:\Users\user\...\kprUEGC.exe:Zone.Identifier, ASCII 14->25 dropped 33 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->33 35 Tries to steal Mail credentials (via file access) 14->35 37 Tries to harvest and steal ftp login credentials 14->37 39 4 other signatures 14->39 27 C:\Windows\System32\drivers\etc\hosts, ASCII 19->27 dropped file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
69.65.3.206
 almasroor.com United States
32181 ASN-GIGENETUS true

Contacted Domains

Name IP Active
almasroor.com 69.65.3.206 true
mail.almasroor.com unknown unknown