Play interactive tour

Edit tour

Analysis Report RQF 100021790.exe

Overview

General Information

Sample Name:	RQF 100021790.exe
Analysis ID:	385385
MD5:	31f58bbbd330f886e422d44e9c21dbf4
SHA1:	1795b60a6f387dec4ac7a6c38119efa0138bdff7
SHA256:	c289703ef1a3645d2c1653c0f571a9abdeec2b404df429196c2523b0b17d9c4c
Tags:	AgentTesla
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

RQF 100021790.exe (PID: 5380 cmdline: 'C:\Users\user\Desktop\RQF 100021790.exe' MD5: 31F58BBBD330F886E422D44E9C21DBF4)

RQF 100021790.exe (PID: 3920 cmdline: {path} MD5: 31F58BBBD330F886E422D44E9C21DBF4)

RQF 100021790.exe (PID: 6020 cmdline: {path} MD5: 31F58BBBD330F886E422D44E9C21DBF4)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "ekwe@yillyenterprise.com^1.kk2[?w-Yzmail.yillyenterprise.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.466065951.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.207282678.0000000003F89000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RQF 100021790.exe PID: 5380	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RQF 100021790.exe PID: 5380	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RQF 100021790.exe PID: 6020	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RQF 100021790.exe PID: 6020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.RQF 100021790.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RQF 100021790.exe.41acc10.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RQF 100021790.exe.41acc10.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 3.2.RQF 100021790.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "ekwe@yillyenterprise.com^1.kk2[?w-Yzmail.yillyenterprise.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: RQF 100021790.exe	Virustotal: Detection: 31%			Perma Link
Source: RQF 100021790.exe	ReversingLabs: Detection: 14%

Machine Learning detection for sample

Show sources

Source: RQF 100021790.exe

Joe Sandbox ML: detected

Source: 3.2.RQF 100021790.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: RQF 100021790.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: RQF 100021790.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49753 -> 103.6.198.237:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49754 -> 103.6.198.237:587

Source: global traffic

TCP traffic: 192.168.2.3:49753 -> 103.6.198.237:587

Source: Joe Sandbox View

IP Address: 103.6.198.237 103.6.198.237

Source: Joe Sandbox View

ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY

Source: global traffic

TCP traffic: 192.168.2.3:49753 -> 103.6.198.237:587

Source: unknown

DNS traffic detected: queries for: mail.yillyenterprise.com

Source: RQF 100021790.exe, 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RQF 100021790.exe, 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	String found in binary or memory: http://BtAllR.com
Source: RQF 100021790.exe, 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RQF 100021790.exe, 00000003.00000002.473589734.0000000002BDD000.00000004.00000001.sdmp	String found in binary or memory: http://Lt3kEzuSCIaIDgvv.com
Source: RQF 100021790.exe, 00000003.00000002.474061943.0000000002C46000.00000004.00000001.sdmp	String found in binary or memory: http://mail.yillyenterprise.com
Source: RQF 100021790.exe, 00000003.00000002.474061943.0000000002C46000.00000004.00000001.sdmp	String found in binary or memory: http://yillyenterprise.com
Source: RQF 100021790.exe, 00000000.00000002.207282678.0000000003F89000.00000004.00000001.sdmp, RQF 100021790.exe, 00000003.00000002.466065951.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: RQF 100021790.exe, 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 3.2.RQF 100021790.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b64D54FA0u002dDCE6u002d4D17u002d90E5u002d01D5DCD649E7u007d/E665D213u002dE6B6u002d4438u002d9BD5u002d2DBC4037211B.cs

Large array initialization: .cctor: array initializer size 11944

Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 0_2_00BC929D	0_2_00BC929D
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 0_2_014DC164	0_2_014DC164
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 0_2_014DE5A0	0_2_014DE5A0
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 0_2_014DE5B0	0_2_014DE5B0
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 0_2_00BC9BE6	0_2_00BC9BE6
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 2_2_0001929D	2_2_0001929D
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 2_2_00019BE6	2_2_00019BE6
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_0053929D	3_2_0053929D
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_027F46A0	3_2_027F46A0
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_027F45B0	3_2_027F45B0
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_027FDA00	3_2_027FDA00
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C77540	3_2_05C77540
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C794F8	3_2_05C794F8
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C76C70	3_2_05C76C70
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C76928	3_2_05C76928
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F326B8	3_2_05F326B8
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F3A1A0	3_2_05F3A1A0
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F3AC49	3_2_05F3AC49
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F3F4B0	3_2_05F3F4B0
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F38C50	3_2_05F38C50
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F5A7D0	3_2_05F5A7D0
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F57E20	3_2_05F57E20
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F5007A	3_2_05F5007A
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F5AF30	3_2_05F5AF30
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F5E818	3_2_05F5E818
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F552D0	3_2_05F552D0
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_00539BE6	3_2_00539BE6

Source: RQF 100021790.exe, 00000000.00000002.206602241.0000000000C6E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewuF vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000000.00000002.210669766.00000000061A1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000000.00000002.210669766.00000000061A1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameexoUqrJZudHREjogRnRvJGlrAcwRCcAwmeAsDDz.exe4 vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000000.00000002.207175183.0000000002F61000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMetroFramework.dll> vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000002.00000002.205016490.00000000000BE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewuF vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000003.00000002.467328872.0000000000978000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000003.00000002.466065951.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameexoUqrJZudHREjogRnRvJGlrAcwRCcAwmeAsDDz.exe4 vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000003.00000000.205748466.00000000005DE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamewuF vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000003.00000002.470208674.0000000000E90000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000003.00000002.470101404.0000000000E10000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs RQF 100021790.exe
Source: RQF 100021790.exe, 00000003.00000002.470191907.0000000000E80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs RQF 100021790.exe
Source: RQF 100021790.exe	Binary or memory string: OriginalFilenamewuF vs RQF 100021790.exe

Source: RQF 100021790.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: RQF 100021790.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 3.2.RQF 100021790.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.RQF 100021790.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/2@4/1

Source: C:\Users\user\Desktop\RQF 100021790.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RQF 100021790.exe.log

Jump to behavior

Source: RQF 100021790.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RQF 100021790.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\RQF 100021790.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\RQF 100021790.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RQF 100021790.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: RQF 100021790.exe	Virustotal: Detection: 31%
Source: RQF 100021790.exe	ReversingLabs: Detection: 14%

Source: unknown	Process created: C:\Users\user\Desktop\RQF 100021790.exe 'C:\Users\user\Desktop\RQF 100021790.exe'
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process created: C:\Users\user\Desktop\RQF 100021790.exe {path}
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process created: C:\Users\user\Desktop\RQF 100021790.exe {path}
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process created: C:\Users\user\Desktop\RQF 100021790.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process created: C:\Users\user\Desktop\RQF 100021790.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: RQF 100021790.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RQF 100021790.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: RQF 100021790.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: RQF 100021790.exe

Static PE information: 0xCB6A8586 [Tue Feb 22 11:44:06 2078 UTC]

Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 0_2_00BCB02F push cs; iretd	0_2_00BCB032
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 0_2_00BCAEE0 push cs; iretd	0_2_00BCAEE2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 0_2_00BCB023 push cs; iretd	0_2_00BCB024
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 2_2_0001AEE0 push cs; iretd	2_2_0001AEE2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 2_2_0001B023 push cs; iretd	2_2_0001B024
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 2_2_0001B02F push cs; iretd	2_2_0001B032
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_0053B023 push cs; iretd	3_2_0053B024
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_0053AEE0 push cs; iretd	3_2_0053AEE2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_0053B02F push cs; iretd	3_2_0053B032
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_027F8BED push ebx; retf 0000h	3_2_027F8C02
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_027F8C27 push ebx; retf 0000h	3_2_027F8C32
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C725C7 push ebx; retn 0005h	3_2_05C725D2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C725D7 push esp; retn 0005h	3_2_05C725E2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C725E7 push edx; retn 0005h	3_2_05C725B2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C725E7 push ebp; retn 0005h	3_2_05C725F2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C725F7 push ebp; retn 0005h	3_2_05C72602
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C72597 push ecx; retn 0005h	3_2_05C725A2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C725A7 push edx; retn 0005h	3_2_05C725B2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C725B7 push ebx; retn 0005h	3_2_05C725C2
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C7257B push eax; retn 0005h	3_2_05C72582
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C7571F pushad ; retn 0005h	3_2_05C7572A
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C7572F pushad ; retn 0005h	3_2_05C7573A
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C72657 push edi; retn 0005h	3_2_05C72622
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C7260A push esi; retn 0005h	3_2_05C72612
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05C72617 push edi; retn 0005h	3_2_05C72622
Source: C:\Users\user\Desktop\RQF 100021790.exe	Code function: 3_2_05F534EC push eax; retf	3_2_05F534ED

Source: initial sample

Static PE information: section name: .text entropy: 7.89427057508

Source: C:\Users\user\Desktop\RQF 100021790.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: RQF 100021790.exe PID: 5380, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\RQF 100021790.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\RQF 100021790.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\RQF 100021790.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe	Window / User API: threadDelayed 2491			Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Window / User API: threadDelayed 7356			Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe TID: 5528	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe TID: 5376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe TID: 1288	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe TID: 5580	Thread sleep count: 2491 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe TID: 5580	Thread sleep count: 7356 > 30	Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\RQF 100021790.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\RQF 100021790.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RQF 100021790.exe	Thread delayed: delay time: 31500	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: RQF 100021790.exe, 00000000.00000002.211322093.000000000663E000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\RQF 100021790.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe

Code function: 3_2_05C7C5A8 KiUserExceptionDispatcher,KiUserExceptionDispatcher,KiUserExceptionDispatcher,LdrInitializeThunk,

3_2_05C7C5A8

Source: C:\Users\user\Desktop\RQF 100021790.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe	Process created: C:\Users\user\Desktop\RQF 100021790.exe {path}			Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Process created: C:\Users\user\Desktop\RQF 100021790.exe {path}			Jump to behavior

Source: RQF 100021790.exe, 00000003.00000002.470486675.00000000012F0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: RQF 100021790.exe, 00000003.00000002.470486675.00000000012F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RQF 100021790.exe, 00000003.00000002.470486675.00000000012F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RQF 100021790.exe, 00000003.00000002.470486675.00000000012F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Users\user\Desktop\RQF 100021790.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Users\user\Desktop\RQF 100021790.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RQF 100021790.exe

Code function: 3_2_05C75A94 GetUserNameW,

3_2_05C75A94

Source: C:\Users\user\Desktop\RQF 100021790.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000003.00000002.466065951.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.207282678.0000000003F89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RQF 100021790.exe PID: 5380, type: MEMORY
Source: Yara match	File source: Process Memory Space: RQF 100021790.exe PID: 6020, type: MEMORY
Source: Yara match	File source: 3.2.RQF 100021790.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RQF 100021790.exe.41acc10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RQF 100021790.exe.41acc10.2.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\RQF 100021790.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\RQF 100021790.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\RQF 100021790.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\RQF 100021790.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\RQF 100021790.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RQF 100021790.exe PID: 6020, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000003.00000002.466065951.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.207282678.0000000003F89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RQF 100021790.exe PID: 5380, type: MEMORY
Source: Yara match	File source: Process Memory Space: RQF 100021790.exe PID: 6020, type: MEMORY
Source: Yara match	File source: 3.2.RQF 100021790.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RQF 100021790.exe.41acc10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RQF 100021790.exe.41acc10.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection12	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Deobfuscate/Decode Files or Information1	Credentials in Registry1	System Information Discovery114	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing3	NTDS	Security Software Discovery211	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Virtualization/Sandbox Evasion131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion131	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection12	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RQF 100021790.exe	31%	Virustotal		Browse
RQF 100021790.exe	15%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
RQF 100021790.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.RQF 100021790.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
yillyenterprise.com	0%	Virustotal		Browse
mail.yillyenterprise.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://BtAllR.com	0%	Avira URL Cloud	safe
http://mail.yillyenterprise.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://Lt3kEzuSCIaIDgvv.com	0%	Avira URL Cloud	safe
http://yillyenterprise.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
yillyenterprise.com	103.6.198.237	true	true	0%, Virustotal, Browse	unknown
mail.yillyenterprise.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	RQF 100021790.exe, 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	RQF 100021790.exe, 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://BtAllR.com	RQF 100021790.exe, 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.yillyenterprise.com	RQF 100021790.exe, 00000003.00000002.474061943.0000000002C46000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	RQF 100021790.exe, 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	RQF 100021790.exe, 00000000.00000002.207282678.0000000003F89000.00000004.00000001.sdmp, RQF 100021790.exe, 00000003.00000002.466065951.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://Lt3kEzuSCIaIDgvv.com	RQF 100021790.exe, 00000003.00000002.473589734.0000000002BDD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://yillyenterprise.com	RQF 100021790.exe, 00000003.00000002.474061943.0000000002C46000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.6.198.237	yillyenterprise.com	Malaysia		46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	385385
Start date:	12.04.2021
Start time:	12:13:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	RQF 100021790.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/2@4/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.2% (good quality ratio 0.1%) Quality average: 38.9% Quality standard deviation: 43.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 64 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 52.147.198.201, 13.64.90.137, 20.82.210.154, 40.88.32.150, 184.30.24.56, 92.122.213.247, 92.122.213.194, 67.26.137.254, 8.253.95.249, 8.253.95.120, 8.248.141.254, 67.27.159.126, 52.155.217.156, 20.54.26.129 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, consumerrp-displaycatalog-aks2eap.md.mp.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:14:00	API Interceptor	818x Sleep call for process: RQF 100021790.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
103.6.198.237	RFQ - HASTALLOY MATERIAL.exe	Get hash	malicious	Browse
	#1002021.exe	Get hash	malicious	Browse
	#100028153.exe	Get hash	malicious	Browse
	#ENQ67548820.exe	Get hash	malicious	Browse
	_0000628.EXE	Get hash	malicious	Browse
	RFQ#100027386.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	IK8QsX6z2B1lPY0.exe	Get hash	malicious	Browse	137.59.110.57
	efaxHanglung_302.htm	Get hash	malicious	Browse	103.6.198.35
	RFQ - HASTALLOY MATERIAL.exe	Get hash	malicious	Browse	103.6.198.237
	#1002021.exe	Get hash	malicious	Browse	103.6.198.237
	PO AA21C04U3101-MTXGA6_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	#100028153.exe	Get hash	malicious	Browse	103.6.198.237
	#ENQ67548820.exe	Get hash	malicious	Browse	103.6.198.237
	PO AA21C04U3101-MTXGA6_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	New Order 1-4-2021_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	New Order 1-4-2021_PDF.exe	Get hash	malicious	Browse	137.59.110.57
	TaTYytHaBk.exe	Get hash	malicious	Browse	110.4.47.139
	_0000628.EXE	Get hash	malicious	Browse	103.6.198.237
	confirm bank account details pdf.exe	Get hash	malicious	Browse	103.6.198.37
	RFQ#100027386.exe	Get hash	malicious	Browse	103.6.198.237
	SWIFT COPY.png.exe	Get hash	malicious	Browse	103.6.196.156
	PAYMENT CONFIRMATION.exe	Get hash	malicious	Browse	103.6.196.156
	bank slip 10 285 USD..exe	Get hash	malicious	Browse	103.6.198.37
	1 Total New Invoices_Wendesday March 10_2021.xlsm	Get hash	malicious	Browse	137.59.109.40
	Request Quotation.exe	Get hash	malicious	Browse	103.6.198.37
	change certificate.exe	Get hash	malicious	Browse	103.6.196.156

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RQF 100021790.exe.log Download File
Process:	C:\Users\user\Desktop\RQF 100021790.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Roaming\bwxcnuey.tk5\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\RQF 100021790.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.891722616606059
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	RQF 100021790.exe
File size:	719360
MD5:	31f58bbbd330f886e422d44e9c21dbf4
SHA1:	1795b60a6f387dec4ac7a6c38119efa0138bdff7
SHA256:	c289703ef1a3645d2c1653c0f571a9abdeec2b404df429196c2523b0b17d9c4c
SHA512:	13c8c5151da7a0ac3409e7c7f2d50ec761377035694275b96f82c77e13979504bd05c68ae5d3a3bcb2fa6d5735f2433e4c98be0ad97e5aa6625f2f820bc542ec
SSDEEP:	12288:N67nnN27JO4zaE+ThxgcHzQC3n0eKR7gZxzhpsFifL:5I4zbYgor3nhX
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....j...............0......L........... ........@.. .......................`............@................................

File Icon


Icon Hash:	b04c9e9ab2c66a92

Static PE Info

General
Entrypoint:	0x4acb9a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xCB6A8586 [Tue Feb 22 11:44:06 2078 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xacb48	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x495c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xacb2c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaaba0	0xaac00	False	0.904438426519	data	7.89427057508	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x495c	0x4a00	False	0.932010135135	data	7.8688533795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb4000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xae130	0x42c1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0xb23f4	0x14	data
RT_VERSION	0xb2408	0x366	data
RT_MANIFEST	0xb2770	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Integra Wealth
Assembly Version	1.8.9.10
InternalName	wu.exe
FileVersion	1.9.1.0
CompanyName	Integra Wealth
LegalTrademarks
Comments
ProductName	ReplacementFallback
ProductVersion	1.9.1.0
FileDescription	ReplacementFallback
OriginalFilename	wu.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/12/21-12:15:45.696184	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49753	587	192.168.2.3	103.6.198.237
04/12/21-12:15:50.878674	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49754	587	192.168.2.3	103.6.198.237

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 12:15:42.762054920 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:43.071121931 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:43.071336985 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:43.782385111 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:43.783063889 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:44.092108965 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:44.094373941 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:44.402190924 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:44.402662039 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:44.751108885 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:44.752495050 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:44.761033058 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:45.069158077 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:45.072818041 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:45.383188963 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:45.383842945 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:45.690876007 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:45.690944910 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:45.696183920 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:45.696470976 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:45.696624041 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:45.696784019 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:46.004097939 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:46.004144907 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:46.441358089 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:46.490317106 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:47.621572971 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:47.930361032 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:47.930761099 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:47.932034016 CEST	49753	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:48.096860886 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:48.239238977 CEST	587	49753	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:48.391484976 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:48.391783953 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:49.080897093 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:49.081491947 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:49.373914003 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:49.374644995 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:49.668432951 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:49.669471025 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:49.994201899 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:49.994524956 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.288446903 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:50.288921118 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.585438967 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:50.585814953 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.876641035 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:50.876692057 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:50.878473997 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.878674030 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.878762007 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.878869057 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.879036903 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.879120111 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.879215956 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:50.879287958 CEST	49754	587	192.168.2.3	103.6.198.237
Apr 12, 2021 12:15:51.170461893 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:51.170726061 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:51.170878887 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:51.625159025 CEST	587	49754	103.6.198.237	192.168.2.3
Apr 12, 2021 12:15:51.678492069 CEST	49754	587	192.168.2.3	103.6.198.237

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 12:13:51.586704969 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 12, 2021 12:13:52.469470024 CEST	60152	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:13:52.520422935 CEST	53	60152	8.8.8.8	192.168.2.3
Apr 12, 2021 12:13:53.392422915 CEST	57544	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:13:53.441185951 CEST	53	57544	8.8.8.8	192.168.2.3
Apr 12, 2021 12:13:54.293262959 CEST	55984	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:13:54.342257977 CEST	53	55984	8.8.8.8	192.168.2.3
Apr 12, 2021 12:13:55.530160904 CEST	64185	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:13:55.581937075 CEST	53	64185	8.8.8.8	192.168.2.3
Apr 12, 2021 12:13:57.751872063 CEST	65110	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:13:57.811475039 CEST	53	65110	8.8.8.8	192.168.2.3
Apr 12, 2021 12:13:58.640142918 CEST	58361	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:13:58.688821077 CEST	53	58361	8.8.8.8	192.168.2.3
Apr 12, 2021 12:13:59.625888109 CEST	63492	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:13:59.675868034 CEST	53	63492	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:05.710988998 CEST	60831	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:05.759812117 CEST	53	60831	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:07.595828056 CEST	60100	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:07.647330046 CEST	53	60100	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:08.479594946 CEST	53195	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:08.528533936 CEST	53	53195	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:19.542860031 CEST	50141	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:19.596565962 CEST	53	50141	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:20.452672005 CEST	53023	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:20.501466036 CEST	53	53023	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:23.887476921 CEST	49563	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:23.939207077 CEST	53	49563	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:25.828679085 CEST	51352	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:25.882148981 CEST	53	51352	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:26.902961016 CEST	59349	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:26.951574087 CEST	53	59349	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:27.705231905 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:27.753947973 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:28.474406004 CEST	58823	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:28.533435106 CEST	53	58823	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:29.341681004 CEST	57568	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:29.400687933 CEST	53	57568	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:29.711903095 CEST	50540	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:29.772387981 CEST	53	50540	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:38.205297947 CEST	54366	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:38.264327049 CEST	53	54366	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:46.517821074 CEST	53034	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:46.570503950 CEST	53	53034	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:50.567768097 CEST	57762	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:50.673624992 CEST	53	57762	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:51.201191902 CEST	55435	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:51.345591068 CEST	53	55435	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:51.524884939 CEST	50713	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:51.599174976 CEST	53	50713	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:51.936480045 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:51.999366999 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:52.471220016 CEST	58987	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:52.528228045 CEST	53	58987	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:53.073225021 CEST	56579	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:53.156069994 CEST	53	56579	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:53.753889084 CEST	60633	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:53.810863972 CEST	53	60633	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:54.299735069 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:54.359675884 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:55.132415056 CEST	63619	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:55.226861000 CEST	53	63619	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:56.321180105 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:56.372930050 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 12, 2021 12:14:57.363403082 CEST	61946	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:14:57.420798063 CEST	53	61946	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:02.112020016 CEST	64910	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:02.160840988 CEST	53	64910	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:06.356405020 CEST	52123	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:06.424463987 CEST	53	52123	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:07.379235029 CEST	56130	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:07.437526941 CEST	53	56130	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:37.663800001 CEST	56338	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:37.712726116 CEST	53	56338	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:39.711788893 CEST	59420	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:39.782140970 CEST	53	59420	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:42.064769983 CEST	58784	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:42.254080057 CEST	53	58784	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:42.276153088 CEST	63978	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:42.655107975 CEST	53	63978	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:47.973196983 CEST	62938	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:48.032934904 CEST	53	62938	8.8.8.8	192.168.2.3
Apr 12, 2021 12:15:48.046407938 CEST	55708	53	192.168.2.3	8.8.8.8
Apr 12, 2021 12:15:48.095315933 CEST	53	55708	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 12, 2021 12:15:42.064769983 CEST	192.168.2.3	8.8.8.8	0x6128	Standard query (0)	mail.yillyenterprise.com	A (IP address)	IN (0x0001)
Apr 12, 2021 12:15:42.276153088 CEST	192.168.2.3	8.8.8.8	0xaab	Standard query (0)	mail.yillyenterprise.com	A (IP address)	IN (0x0001)
Apr 12, 2021 12:15:47.973196983 CEST	192.168.2.3	8.8.8.8	0xa834	Standard query (0)	mail.yillyenterprise.com	A (IP address)	IN (0x0001)
Apr 12, 2021 12:15:48.046407938 CEST	192.168.2.3	8.8.8.8	0xe4ea	Standard query (0)	mail.yillyenterprise.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 12, 2021 12:15:42.254080057 CEST	8.8.8.8	192.168.2.3	0x6128	No error (0)	mail.yillyenterprise.com	yillyenterprise.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2021 12:15:42.254080057 CEST	8.8.8.8	192.168.2.3	0x6128	No error (0)	yillyenterprise.com		103.6.198.237	A (IP address)	IN (0x0001)
Apr 12, 2021 12:15:42.655107975 CEST	8.8.8.8	192.168.2.3	0xaab	No error (0)	mail.yillyenterprise.com	yillyenterprise.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2021 12:15:42.655107975 CEST	8.8.8.8	192.168.2.3	0xaab	No error (0)	yillyenterprise.com		103.6.198.237	A (IP address)	IN (0x0001)
Apr 12, 2021 12:15:48.032934904 CEST	8.8.8.8	192.168.2.3	0xa834	No error (0)	mail.yillyenterprise.com	yillyenterprise.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2021 12:15:48.032934904 CEST	8.8.8.8	192.168.2.3	0xa834	No error (0)	yillyenterprise.com		103.6.198.237	A (IP address)	IN (0x0001)
Apr 12, 2021 12:15:48.095315933 CEST	8.8.8.8	192.168.2.3	0xe4ea	No error (0)	mail.yillyenterprise.com	yillyenterprise.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2021 12:15:48.095315933 CEST	8.8.8.8	192.168.2.3	0xe4ea	No error (0)	yillyenterprise.com		103.6.198.237	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 12, 2021 12:15:43.782385111 CEST	587	49753	103.6.198.237	192.168.2.3	220-naan.mschosting.com ESMTP Exim 4.94 #2 Mon, 12 Apr 2021 18:15:42 +0800 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 12, 2021 12:15:43.783063889 CEST	49753	587	192.168.2.3	103.6.198.237	EHLO 305090
Apr 12, 2021 12:15:44.092108965 CEST	587	49753	103.6.198.237	192.168.2.3	250-naan.mschosting.com Hello 305090 [84.17.52.3] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 12, 2021 12:15:44.094373941 CEST	49753	587	192.168.2.3	103.6.198.237	AUTH login ZWt3ZUB5aWxseWVudGVycHJpc2UuY29t
Apr 12, 2021 12:15:44.402190924 CEST	587	49753	103.6.198.237	192.168.2.3	334 UGFzc3dvcmQ6
Apr 12, 2021 12:15:44.752495050 CEST	587	49753	103.6.198.237	192.168.2.3	235 Authentication succeeded
Apr 12, 2021 12:15:44.761033058 CEST	49753	587	192.168.2.3	103.6.198.237	MAIL FROM:<ekwe@yillyenterprise.com>
Apr 12, 2021 12:15:45.069158077 CEST	587	49753	103.6.198.237	192.168.2.3	250 OK
Apr 12, 2021 12:15:45.072818041 CEST	49753	587	192.168.2.3	103.6.198.237	RCPT TO:<ekwe@yillyenterprise.com>
Apr 12, 2021 12:15:45.383188963 CEST	587	49753	103.6.198.237	192.168.2.3	250 Accepted
Apr 12, 2021 12:15:45.383842945 CEST	49753	587	192.168.2.3	103.6.198.237	DATA
Apr 12, 2021 12:15:45.690944910 CEST	587	49753	103.6.198.237	192.168.2.3	354 Enter message, ending with "." on a line by itself
Apr 12, 2021 12:15:45.696784019 CEST	49753	587	192.168.2.3	103.6.198.237	.
Apr 12, 2021 12:15:46.441358089 CEST	587	49753	103.6.198.237	192.168.2.3	250 OK id=1lVtbc-0001fd-2u
Apr 12, 2021 12:15:47.621572971 CEST	49753	587	192.168.2.3	103.6.198.237	QUIT
Apr 12, 2021 12:15:47.930361032 CEST	587	49753	103.6.198.237	192.168.2.3	221 naan.mschosting.com closing connection
Apr 12, 2021 12:15:49.080897093 CEST	587	49754	103.6.198.237	192.168.2.3	220-naan.mschosting.com ESMTP Exim 4.94 #2 Mon, 12 Apr 2021 18:15:47 +0800 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 12, 2021 12:15:49.081491947 CEST	49754	587	192.168.2.3	103.6.198.237	EHLO 305090
Apr 12, 2021 12:15:49.373914003 CEST	587	49754	103.6.198.237	192.168.2.3	250-naan.mschosting.com Hello 305090 [84.17.52.3] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 12, 2021 12:15:49.374644995 CEST	49754	587	192.168.2.3	103.6.198.237	AUTH login ZWt3ZUB5aWxseWVudGVycHJpc2UuY29t
Apr 12, 2021 12:15:49.668432951 CEST	587	49754	103.6.198.237	192.168.2.3	334 UGFzc3dvcmQ6
Apr 12, 2021 12:15:49.994201899 CEST	587	49754	103.6.198.237	192.168.2.3	235 Authentication succeeded
Apr 12, 2021 12:15:49.994524956 CEST	49754	587	192.168.2.3	103.6.198.237	MAIL FROM:<ekwe@yillyenterprise.com>
Apr 12, 2021 12:15:50.288446903 CEST	587	49754	103.6.198.237	192.168.2.3	250 OK
Apr 12, 2021 12:15:50.288921118 CEST	49754	587	192.168.2.3	103.6.198.237	RCPT TO:<ekwe@yillyenterprise.com>
Apr 12, 2021 12:15:50.585438967 CEST	587	49754	103.6.198.237	192.168.2.3	250 Accepted
Apr 12, 2021 12:15:50.585814953 CEST	49754	587	192.168.2.3	103.6.198.237	DATA
Apr 12, 2021 12:15:50.876692057 CEST	587	49754	103.6.198.237	192.168.2.3	354 Enter message, ending with "." on a line by itself
Apr 12, 2021 12:15:50.879287958 CEST	49754	587	192.168.2.3	103.6.198.237	.
Apr 12, 2021 12:15:51.625159025 CEST	587	49754	103.6.198.237	192.168.2.3	250 OK id=1lVtbh-0001iB-8z

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: RQF 100021790.exe PID: 5380 Parent PID: 5724

General

Start time:	12:13:59
Start date:	12/04/2021
Path:	C:\Users\user\Desktop\RQF 100021790.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\RQF 100021790.exe'
Imagebase:	0xbc0000
File size:	719360 bytes
MD5 hash:	31F58BBBD330F886E422D44E9C21DBF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.207282678.0000000003F89000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: RQF 100021790.exe PID: 3920 Parent PID: 5380

General

Start time:	12:14:02
Start date:	12/04/2021
Path:	C:\Users\user\Desktop\RQF 100021790.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x10000
File size:	719360 bytes
MD5 hash:	31F58BBBD330F886E422D44E9C21DBF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: RQF 100021790.exe PID: 6020 Parent PID: 5380

General

Start time:	12:14:02
Start date:	12/04/2021
Path:	C:\Users\user\Desktop\RQF 100021790.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x530000
File size:	719360 bytes
MD5 hash:	31F58BBBD330F886E422D44E9C21DBF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.466065951.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.471510302.0000000002971000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: RQF 100021790.exe PID: 5380 Parent PID: 5724 RQF 100021790.exeCOMMON

Executed Functions

Function 014DE5A0, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e21f40bc5fa0a174a62b207e64af9f3d94928211ecb47f32717bb07840eb7f
Instruction ID: b974c084701c720ba17f9f0924fcc0475a2b9cec1d9c051f125bb0a7086c5fb3
Opcode Fuzzy Hash: e7e21f40bc5fa0a174a62b207e64af9f3d94928211ecb47f32717bb07840eb7f
Instruction Fuzzy Hash: AFC113B1911B4A8BD720DF65E8885897BB1BB85328F61430CD2616FBF8D7B4147ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 014DFCC0, Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 014DFE4A

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 45ba1aba076df3a2e25b4714caedd5c232ebdd52a84b508277f0ab657b614af5
Instruction ID: 21b8c99d8fde7374d7c97fb2376cfe340b0af834c959933ed00a60e80b956f11
Opcode Fuzzy Hash: 45ba1aba076df3a2e25b4714caedd5c232ebdd52a84b508277f0ab657b614af5
Instruction Fuzzy Hash: D76114B1C042489FDF11CFA9C990ADEBFB1FF49314F15815AE819AB221D7319946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014DDDF0, Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 014DFE4A

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b68321a84dea622b2076cac72d0c52d9700a1382e4ae8bec3d3a88ef2a7d4a79
Instruction ID: 5e0990c9e723fa4d8573184e8a754f0ad61c37e860cbc8ef37b552d916b8363c
Opcode Fuzzy Hash: b68321a84dea622b2076cac72d0c52d9700a1382e4ae8bec3d3a88ef2a7d4a79
Instruction Fuzzy Hash: 605137B1C043489FDF15CFA9C890ADEBFB1BF49314F24856AE819AB211D774984ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 014DDE0C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 014DFE4A

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ca61572ff9a9966eddfa88fe5fa3bbaa1942087eb01a0ebc9e827060ff2c4794
Instruction ID: fed51e7e1b39c7f4ef890dfae173b412554207a100ef38c0100326ba947614c4
Opcode Fuzzy Hash: ca61572ff9a9966eddfa88fe5fa3bbaa1942087eb01a0ebc9e827060ff2c4794
Instruction Fuzzy Hash: ED51A2B1D003099FDF14CF99C894ADEBBB5BF48714F24812AE919AB211D7749986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014D5365, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014D5421

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 99f7f7a8eac49e68e4311f64ae10fad021efff15120a79daf74c37cedb6a3e79
Instruction ID: 77307cfddb7b15a61ebb454ea09d35a2b55c8069ddbc35c96741ffac955a6a5c
Opcode Fuzzy Hash: 99f7f7a8eac49e68e4311f64ae10fad021efff15120a79daf74c37cedb6a3e79
Instruction Fuzzy Hash: FF4101B1D00218CFDF24CFA9C8847DEBBB5BF49308F20816AD408AB251DB75694ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 014D3DE8, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014D5421

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3f9b16262f612785732227572dc1f93047964cbfb8c180f15cf6fdfecfa105d3
Instruction ID: a3b705e7586be74d4bc97ea6f19cc643a0bc9ac08931a379d8b2cbc89f5f16c9
Opcode Fuzzy Hash: 3f9b16262f612785732227572dc1f93047964cbfb8c180f15cf6fdfecfa105d3
Instruction Fuzzy Hash: C4410370D00618CFDF24CFA9C8947DEBBB5BF48308F60806AD408AB251DB75694ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 014D9800, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,014DB8BE,?,?,?,?,?), ref: 014DB97F

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 090448aff5150d9a08d7dcebddf578175e58422f3bd42a2462df33c4c0543f4f
Instruction ID: 1c8583d0e511f4e218403aacde2b07ec0bdc1aee2230161eb57e947377e8184b
Opcode Fuzzy Hash: 090448aff5150d9a08d7dcebddf578175e58422f3bd42a2462df33c4c0543f4f
Instruction Fuzzy Hash: B621E3B59002489FDB10CF9AD884AEEBBF4EB49324F15801AE914B7310D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014DB8F0, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,014DB8BE,?,?,?,?,?), ref: 014DB97F

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 183534f1e59054bad74b2fbe713062c56816c864379bad4532ec40cb5586871d
Instruction ID: 5665b5bbd2db62e66797e88fa688e00add73d73cf6a129b49f1995f53bc571e8
Opcode Fuzzy Hash: 183534f1e59054bad74b2fbe713062c56816c864379bad4532ec40cb5586871d
Instruction Fuzzy Hash: BA21E2B5D002489FDB10CFA9D984AEEBBF4EF48324F14841AE958B7311D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D9478, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014D9951,00000800,00000000,00000000), ref: 014D9B62

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 497dd02fb635e38e488aef9583d9246821c02999af6d472371f8d54d9909907e
Instruction ID: e2cd77141afedffdb7ca556af297f1d4de16682f46e17925e07515f0dcf5144a
Opcode Fuzzy Hash: 497dd02fb635e38e488aef9583d9246821c02999af6d472371f8d54d9909907e
Instruction Fuzzy Hash: E81106B2D003498FDB10CF9AD444ADEFBF4AB48314F05841AE915AB210C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D9AF0, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014D9951,00000800,00000000,00000000), ref: 014D9B62

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f854a67c3c2264e8a053b130850a7a2a2864368d2944cdbf71d7ac9ec7b63fcd
Instruction ID: 7f9230a5f837cc75bf7a2cbb971a1a554ba87e10d92b633c23de799d594f122a
Opcode Fuzzy Hash: f854a67c3c2264e8a053b130850a7a2a2864368d2944cdbf71d7ac9ec7b63fcd
Instruction Fuzzy Hash: 0F21E0B6D002098BDB10CF99D444ADEFBF4AB48318F15841AE919AB610C375A949CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 014D9869, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014D98D6

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ea98baae9a64502be185898e4684f85ec89a05c4d5bd11401496e575b7242e0
Instruction ID: b0fa784b1f1b50fd05dd6142e4a107948c69dd94f978b21435b036034688b445
Opcode Fuzzy Hash: 2ea98baae9a64502be185898e4684f85ec89a05c4d5bd11401496e575b7242e0
Instruction Fuzzy Hash: 721112B6C00609CFDB10CF9AC444BDEBBF4AF48718F14841AD429B7610C375A546CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 014D9870, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014D98D6

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 25f004ef7e2e7f0b22a2b844536d287746c455f435204e7bec8c5de73afd25e3
Instruction ID: 4c02dddc225c28a2c2767aa211b49f2b0abb54a4b8177c4b2aeb8cb17f143b20
Opcode Fuzzy Hash: 25f004ef7e2e7f0b22a2b844536d287746c455f435204e7bec8c5de73afd25e3
Instruction Fuzzy Hash: 4211DFB6D006498FDB10DF9AD444ADEFBF4EF88728F14842AE829B7610C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00BC929D, Relevance: 1.3, Instructions: 1264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.206432668.0000000000BC2000.00000002.00020000.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.206426180.0000000000BC0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.206602241.0000000000C6E000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3da61e73659ef827b5ac00ffc73bcc8536aa42a3cfe4c2c33c608bdbfa3fd6b
Instruction ID: 162b7db9ff6364741e3a3a2a17397c8d54df6c88f57bd439e498f19634f80163
Opcode Fuzzy Hash: e3da61e73659ef827b5ac00ffc73bcc8536aa42a3cfe4c2c33c608bdbfa3fd6b
Instruction Fuzzy Hash: FEA2EE9280F7C19FEB174B785DB96A1BFB1AD6321471E48CBC0C0CF1A7E109196AD726

Uniqueness

Uniqueness Score: -1.00%

Function 014DE5B0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c86a11707d5f45c8f76845105dbad85653d010f3ca817faea8f47e466c888a
Instruction ID: 575745547cf656f74a882db92840dc655319156ce4336a19ae30c9085065c48b
Opcode Fuzzy Hash: 84c86a11707d5f45c8f76845105dbad85653d010f3ca817faea8f47e466c888a
Instruction Fuzzy Hash: A712BFF1811B468BE330DF65E9985893BB1B785328B91420CD2616EBF9D7B8117ECF84

Uniqueness

Uniqueness Score: -1.00%

Function 014DC164, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.207023949.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da3a5303bd9aa53626e2a6c1dc5cdc55f661b0aae0de556c97367499d7f0c32
Instruction ID: 5c2b4d49047d78059a98fb71b480540ccae5269e6202273244ddfcf7c3edd0de
Opcode Fuzzy Hash: 0da3a5303bd9aa53626e2a6c1dc5cdc55f661b0aae0de556c97367499d7f0c32
Instruction Fuzzy Hash: 13A16D32E0021A8FCF16DFF5C8945DEBBF2FF95304B15856AE905AB261EB31A915CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RQF 100021790.exe PID: 6020 Parent PID: 5380 RQF 100021790.exeCOMMON

Executed Functions

Function 05C7C5A8, Relevance: 7.0, APIs: 4, Instructions: 979libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C6BC
KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 19b3c209b0dec6967ba79828e1eaa64b55b2d98ad87a61a32caa82b9d7f5c46c
Instruction ID: 1e2f6d5acf0b6a38c5cc5272a044fa2a81a112fb4076ce1cf8c91782e2a892c8
Opcode Fuzzy Hash: 19b3c209b0dec6967ba79828e1eaa64b55b2d98ad87a61a32caa82b9d7f5c46c
Instruction Fuzzy Hash: 30A204B4A14228CFCB64EB70D85879DB7B6BF89206F5085E9D50AA3750DF349E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C75A94, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05C7B633

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: df3c001ae2d0e17114e96d921755377adad5582a0959dd369940332cfeac05b1
Instruction ID: 725698c6307015bcb0a136a5f0abf7ac13889df2fb07c80e6e412bc02383ef36
Opcode Fuzzy Hash: df3c001ae2d0e17114e96d921755377adad5582a0959dd369940332cfeac05b1
Instruction Fuzzy Hash: 7151F470E002188FDB18CFA9C888BDEBBB1BF48318F158529E815BB791E7749944CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C5C9, Relevance: 6.6, APIs: 4, Instructions: 632libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C6BC
KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 4d3377f44c6e75509bdacbefcd5014f4cefe111fb9f3ccf17e03c4469225cfca
Instruction ID: 3f32f6fd72288f7771444f617ac4664d12f9b21545657467522e7c184b6d4611
Opcode Fuzzy Hash: 4d3377f44c6e75509bdacbefcd5014f4cefe111fb9f3ccf17e03c4469225cfca
Instruction Fuzzy Hash: 086206B4A14228CFCB64EB70D85879CB7B6BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C60E, Relevance: 6.6, APIs: 4, Instructions: 625libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C6BC
KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 01e53b463c15d94b1c46c50c78b48757b072ed345dbc6da5066485b56b5e7f6b
Instruction ID: ab2810ed9802729bd3294121f4a3e1653954c55546d10a5e7554d786cf9fb9a2
Opcode Fuzzy Hash: 01e53b463c15d94b1c46c50c78b48757b072ed345dbc6da5066485b56b5e7f6b
Instruction Fuzzy Hash: E05206B4A15228CFCB64EB70D85879CB7B6BF49206F5085EAD50AA3750CF349E81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C653, Relevance: 6.6, APIs: 4, Instructions: 618libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C6BC
KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 970d6f8f81f3732330f86a0acb8552af763f8c099664291c2f2979d26c30dc96
Instruction ID: 812c778f896aa7c9419a1b627623401a3592ad1a35eefe7414ee5db36f83fa2e
Opcode Fuzzy Hash: 970d6f8f81f3732330f86a0acb8552af763f8c099664291c2f2979d26c30dc96
Instruction Fuzzy Hash: 235206B4A15228CFCB64EB70D85879CB7B6BF49206F5085EAD50AA3750CF349E81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C698, Relevance: 6.6, APIs: 4, Instructions: 611libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C6BC
KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: dc048d81feb0925acafcc1bff9005d532254b2711ac48612c064f94445369f9e
Instruction ID: ad26c4adc030c103e3d3f555a977bbea185a7be9470073c854872f991c3e06bd
Opcode Fuzzy Hash: dc048d81feb0925acafcc1bff9005d532254b2711ac48612c064f94445369f9e
Instruction Fuzzy Hash: CA5206B4A15228CFCB64EB70D85879CB7B6BF49206F5085EAD50AA3750CF349E81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 027F6940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 027F69A0
GetCurrentThread.KERNEL32 ref: 027F69DD
GetCurrentProcess.KERNEL32 ref: 027F6A1A
GetCurrentThreadId.KERNEL32 ref: 027F6A73

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 637af0b03cab853fd542cea51794b50cfed8ee477ebcf47fc5a783d2856be659
Instruction ID: c3032a2aff1c77143f6d8fee0f5496a42f9f2831338934d9beea306372bdcc7a
Opcode Fuzzy Hash: 637af0b03cab853fd542cea51794b50cfed8ee477ebcf47fc5a783d2856be659
Instruction Fuzzy Hash: 335155B0A047488FDB54CFA9D648BDEBBF4EF88304F208069E519A7350D734A944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C6DD, Relevance: 5.1, APIs: 3, Instructions: 604libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 24ef0d9aabd5ff7d2309a423657cfcff750f2482c842472739fd0f48ff9350ea
Instruction ID: d89a7e1a362e2480933914376f053119277470b26e48c120bc296a17f72ff740
Opcode Fuzzy Hash: 24ef0d9aabd5ff7d2309a423657cfcff750f2482c842472739fd0f48ff9350ea
Instruction Fuzzy Hash: 0F5216B4A11228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C722, Relevance: 5.1, APIs: 3, Instructions: 597libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: b8a1f8a9d2d230ef8cdd09387beab64ab1ca37f19e67a2fb380424b8360dcfd8
Instruction ID: 4b6337a26b408fc5d3d76c03b326d3323c3626f512a3430705f8761ba711016a
Opcode Fuzzy Hash: b8a1f8a9d2d230ef8cdd09387beab64ab1ca37f19e67a2fb380424b8360dcfd8
Instruction Fuzzy Hash: D45206B4A14228CFCB64EB70D85879CB7B6BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C767, Relevance: 5.1, APIs: 3, Instructions: 590libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 2a2a73566e8c3813ccd11ba2323082b19533396e7c73cba18961e66832fbfb1f
Instruction ID: 4302bbd948399bafdb7bbdf28ca34b78af301b6ad082281c4642a47f1a54228f
Opcode Fuzzy Hash: 2a2a73566e8c3813ccd11ba2323082b19533396e7c73cba18961e66832fbfb1f
Instruction Fuzzy Hash: 5F5216B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C7C2, Relevance: 5.1, APIs: 3, Instructions: 579libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 0c550c29b6bc6e6280fd8f2ef4be6ed6f10a6abb2c812e4f1e3459a306fe0790
Instruction ID: a6dc52552f9864067c395258c8c339a01921538e236a89b552c2fe29a2eac88a
Opcode Fuzzy Hash: 0c550c29b6bc6e6280fd8f2ef4be6ed6f10a6abb2c812e4f1e3459a306fe0790
Instruction Fuzzy Hash: B65206B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C807, Relevance: 5.1, APIs: 3, Instructions: 572libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ea40167eafbaeea31fd9181a9ab992695093cbac86f58921fe072e06c48c043e
Instruction ID: a14c9563a394c0b0ba975ff81429b4bd5b8baf54701497e9cef46843b466b229
Opcode Fuzzy Hash: ea40167eafbaeea31fd9181a9ab992695093cbac86f58921fe072e06c48c043e
Instruction Fuzzy Hash: BB4216B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C84C, Relevance: 5.1, APIs: 3, Instructions: 565libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 1f56750718f1214e6b53ad5f862d89e9712ae0b4b8951ff27115e0a9eb7c532c
Instruction ID: bc9c305a370947592e37396b99adeaa5ec5eebaa31c1debfc236e355d35a324e
Opcode Fuzzy Hash: 1f56750718f1214e6b53ad5f862d89e9712ae0b4b8951ff27115e0a9eb7c532c
Instruction Fuzzy Hash: 434206B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C891, Relevance: 5.1, APIs: 3, Instructions: 558libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: c609b5464aeb6cb72d04c617985302238a33f081a7574a4ed5081ac673fcae61
Instruction ID: 65aa46c700fdb3dbb693a2b22f5f0775576684676477719edbb4290f87d90c6b
Opcode Fuzzy Hash: c609b5464aeb6cb72d04c617985302238a33f081a7574a4ed5081ac673fcae61
Instruction Fuzzy Hash: 8C4206B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C8D6, Relevance: 5.1, APIs: 3, Instructions: 551libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 16da4da069e6229418b2a4e2e5d384cfa16229c2bba625e6dfdc03916085f2b6
Instruction ID: 66b9bc03c9d023c148f34e3de265bd3a74c5074f8008d201afe3738d4b234668
Opcode Fuzzy Hash: 16da4da069e6229418b2a4e2e5d384cfa16229c2bba625e6dfdc03916085f2b6
Instruction Fuzzy Hash: DA4206B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C91B, Relevance: 5.0, APIs: 3, Instructions: 544libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ba057c77be2d8cd2bba947bced0cfecbdf2848fe7886f2970ee664debfba4aad
Instruction ID: 8d81f11f2731156e66ebb7ee14ed83da5534c657c271fd1062824943cd24d067
Opcode Fuzzy Hash: ba057c77be2d8cd2bba947bced0cfecbdf2848fe7886f2970ee664debfba4aad
Instruction Fuzzy Hash: BC4206B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C960, Relevance: 5.0, APIs: 3, Instructions: 537libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 22cee8852152e27efd75b2c0fa9eefa5fbbd9ac600791ce7c533d9c29be6daac
Instruction ID: f4afa275d39fa172f2975361367372693f37fe3982e1137bd110f380e0ef660b
Opcode Fuzzy Hash: 22cee8852152e27efd75b2c0fa9eefa5fbbd9ac600791ce7c533d9c29be6daac
Instruction Fuzzy Hash: B94206B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C9A5, Relevance: 5.0, APIs: 3, Instructions: 528libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7C9C0
KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: a048c87cc5adf9e60bb5bf34198b27549625c724e83cf5cbdb2b6a56060a5ad7
Instruction ID: c4e6af5a7aff018bf40c6b480f2b7e576cbd2d8801b61915b38ec2c42c7d2686
Opcode Fuzzy Hash: a048c87cc5adf9e60bb5bf34198b27549625c724e83cf5cbdb2b6a56060a5ad7
Instruction Fuzzy Hash: 1E3206B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C79297, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

Y/h^, xrefs: 05C79211

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID:
String ID: Y/h^
API String ID: 0-2242315189
Opcode ID: b197fb20c8458f8ad15cac0a4f865e2337459908584a2bc46e63cadd3e3c5b38
Instruction ID: 5ae4b81dd5b0613087fcaf93c25a3270a2a8ecc643224363a4d6eb2e5f144d19
Opcode Fuzzy Hash: b197fb20c8458f8ad15cac0a4f865e2337459908584a2bc46e63cadd3e3c5b38
Instruction Fuzzy Hash: B68100B2D082588FDB04CFA9C889BEDBBB1FF19314F05885AD415EBB91E7749805CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05C7C9F7, Relevance: 3.5, APIs: 2, Instructions: 519libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: a609275f06ce96ccb816fe7e1c12eef2d8efff5c34d97f81bc0b5f2afbc0cd47
Instruction ID: a21ca6161a875b08df85fce0f82fc49314a765bea52bfbe73cf5d56be2c0380e
Opcode Fuzzy Hash: a609275f06ce96ccb816fe7e1c12eef2d8efff5c34d97f81bc0b5f2afbc0cd47
Instruction Fuzzy Hash: 7B3206B4A15228CFCB64EB70D85879CB7B2BF49206F5085EAD50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CA3C, Relevance: 3.5, APIs: 2, Instructions: 510libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: a95f0c9bcf83da958dc671c34b4c0d4ac43f36cb87756476764520930d66d1f9
Instruction ID: a35a5053b7b76b4752a915533d6e1d52756f900b00844070070a3aeda3b16a48
Opcode Fuzzy Hash: a95f0c9bcf83da958dc671c34b4c0d4ac43f36cb87756476764520930d66d1f9
Instruction Fuzzy Hash: 8F3206B4A15228CFCB64EB70D85879CBBB2BF49206F5085E9D50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CA78, Relevance: 3.5, APIs: 2, Instructions: 503libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 6de20b16b693b06b07899be8471a84ac53337eca232081d723f4147dba9ac50b
Instruction ID: b42153dc32cfcf9949669bcb38f32fa39f26305040884646a1f045a84af3f8d0
Opcode Fuzzy Hash: 6de20b16b693b06b07899be8471a84ac53337eca232081d723f4147dba9ac50b
Instruction Fuzzy Hash: 343206B4A15228CFCB64EB70D85879CBBB2BF49206F5085E9D50AA3750CF349E81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CAB4, Relevance: 3.5, APIs: 2, Instructions: 498libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e7220c0da8f8b732e23a734cb522358e2e7a91f9498e7744f14e07e22a76720e
Instruction ID: f5d84e125673ae2e92d35641c6ed2b0d35a88dfbc42ac26ac0e4d7ae103e3781
Opcode Fuzzy Hash: e7220c0da8f8b732e23a734cb522358e2e7a91f9498e7744f14e07e22a76720e
Instruction Fuzzy Hash: A63206B4A15228CFCB64EB70D85879DBBB2BF49206F5085E9D50AA3750CF349E81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CAF9, Relevance: 3.5, APIs: 2, Instructions: 489libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 55821566cfc50300f10e0675f89f33320751c918e11558c3314576a75eb20b6a
Instruction ID: a6e64ec59c371f2eb2983601e9eaae45a8a85abcb75e981157c8d17761622439
Opcode Fuzzy Hash: 55821566cfc50300f10e0675f89f33320751c918e11558c3314576a75eb20b6a
Instruction Fuzzy Hash: 713206B4A14228CFCB64EB70D85879DBBB2BF49206F5085E9D50AA3750CF349E81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CB35, Relevance: 3.5, APIs: 2, Instructions: 484libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: f694156de6eb924765b8a1485f60ddeeae31ee6bb4f40b63d7cd7eb84cd3e9b6
Instruction ID: a9348fce0b5903f9cbc4f95c8d5d0edd9b9f9b2ebdfc35b5832d850f93034826
Opcode Fuzzy Hash: f694156de6eb924765b8a1485f60ddeeae31ee6bb4f40b63d7cd7eb84cd3e9b6
Instruction Fuzzy Hash: 202205B4A14228CFCB64EB70D85879DBBB2BF49206F5085E9D50AA3750CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CB7A, Relevance: 3.5, APIs: 2, Instructions: 477libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: aed4a764388ca439a1fcccb0affec834bd65165a0764cb3368045ad56c3871b3
Instruction ID: 6da28f36b4d7841a4887097f1d93a5da8167b9caf5cb4d02a8b9f77e847eeaba
Opcode Fuzzy Hash: aed4a764388ca439a1fcccb0affec834bd65165a0764cb3368045ad56c3871b3
Instruction Fuzzy Hash: BC2205B4A14228CFCB64EB70D85879DBBB2BF49206F5085E9D50AA3750CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CBBF, Relevance: 3.5, APIs: 2, Instructions: 468libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 0dd0dbbcbf50136074bfe2fb1ff7212a2a983cbb1a13ac19b60c6904caee13ba
Instruction ID: 114bbbda21b4447e5ec4af083849d0cb119355d1d4b23a816df2bd045c4e09e7
Opcode Fuzzy Hash: 0dd0dbbcbf50136074bfe2fb1ff7212a2a983cbb1a13ac19b60c6904caee13ba
Instruction Fuzzy Hash: 462206B4A14228CFCB64EB70D85879DBBB2BF49206F5085E9D50AA3750CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CBFB, Relevance: 3.5, APIs: 2, Instructions: 461libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 5222171cea8f80f12b40fcaa9b2b5cd49e03fe9e1c7159dc57b4fb9bb93337f4
Instruction ID: 06db1a81a4cb86445976566f66dc1c019724a73049e157d02c45aa15498a704b
Opcode Fuzzy Hash: 5222171cea8f80f12b40fcaa9b2b5cd49e03fe9e1c7159dc57b4fb9bb93337f4
Instruction Fuzzy Hash: 662206B4A14228CFCB64EB70D85879DBBB2BF49206F5085E9D50AA3750CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CC37, Relevance: 3.5, APIs: 2, Instructions: 456libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05C7CC5B
LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e3dea9f29c8cffcc3ed1e28d6a9fe0fe2e0a7466c4327aa35738bcc34efb22a2
Instruction ID: 8ecd5fac81bc60908ecf465216b15e62d52e548162b351b2e4bd35cd79579f3f
Opcode Fuzzy Hash: e3dea9f29c8cffcc3ed1e28d6a9fe0fe2e0a7466c4327aa35738bcc34efb22a2
Instruction Fuzzy Hash: 5C2226B4A14228CFCB64EB70D85879DB7B2BF89206F5085E9D50AA3750CF349E81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C7CC7C, Relevance: 1.9, APIs: 1, Instructions: 449libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05C7CDC5

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dd329df30f16ff4c3dcd78e313d7f2a6ecd0db6b8f9fb47d84a4bb1680c7f27
Instruction ID: e9ba2acc8e0743b34f0513e105862cdf24e1cdb1b23d6ff03630fc90a0974bea
Opcode Fuzzy Hash: 8dd329df30f16ff4c3dcd78e313d7f2a6ecd0db6b8f9fb47d84a4bb1680c7f27
Instruction Fuzzy Hash: 2D2216B4A14228CFCB64EB70D85879DB7B2BF89206F5085E9D50AA3750CF349E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C75873, Relevance: 1.8, APIs: 1, Instructions: 295COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05C7B633

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 6aa15a996cb10edd268b9e0a18c1118c91a6d5151f3787daa9c2143e232ef8f1
Instruction ID: 251fd549c355e9829fa06c5cf558b9220fd81b9881c98207fa371248017d62cc
Opcode Fuzzy Hash: 6aa15a996cb10edd268b9e0a18c1118c91a6d5151f3787daa9c2143e232ef8f1
Instruction Fuzzy Hash: 9AA1C1BAE80129ABEF14CF58CD46BDD7BF5AB94314F088409E525E7395E770C405CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C75AA8, Relevance: 1.7, APIs: 1, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c06552739fb6d0b84b79a0f69e910be31511ed871da9522afdda5016292f20
Instruction ID: 45fd2cd8e64c1b4e6f4715bef655829669592dd6b5c14e09ff642f2011eaab14
Opcode Fuzzy Hash: 18c06552739fb6d0b84b79a0f69e910be31511ed871da9522afdda5016292f20
Instruction Fuzzy Hash: 449114B1D002189FDB14DFA9C884BEEBBF5BF48314F148429E819AB790DB749944CF95

Uniqueness

Uniqueness Score: -1.00%

Function 027F500F, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d549f31b2bab0be9a22c424976822d8e37aa2986cb4fb91e86a6d846f32ecb
Instruction ID: 2357fab3a01c944567896609ef26d2d8aea23de5dc728786c5c5bd8b9f0a7fa4
Opcode Fuzzy Hash: d5d549f31b2bab0be9a22c424976822d8e37aa2986cb4fb91e86a6d846f32ecb
Instruction Fuzzy Hash: 916121B1D04249AFDF11CFA9C980ADDBFB1FF49300F25815AEA08AB221D7719955CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C7B4ED, Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05C7B633

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: bdaae3cb0c3981aad6401675e9e5ef72bb7e8d29c29f0dc7e410e0303bf67521
Instruction ID: d29308ad0dacea1ecbc7020a8953079a1e98adf367ba4d3b46fc679b6a4e3928
Opcode Fuzzy Hash: bdaae3cb0c3981aad6401675e9e5ef72bb7e8d29c29f0dc7e410e0303bf67521
Instruction Fuzzy Hash: DA5125B1E002188FDB18CFA9D884BDDBBB1BF48318F158529E819BB791E7749844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05C7921C, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05C7B633

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 879290b2e0b7f8c4d0390b43d1d9b23311f0d9ebd9340d9b7751823c5ab03638
Instruction ID: 918230b8a0b4b9d523ba05b0fecb0203b846a5c901c5f7361fa9b0f080ccde45
Opcode Fuzzy Hash: 879290b2e0b7f8c4d0390b43d1d9b23311f0d9ebd9340d9b7751823c5ab03638
Instruction Fuzzy Hash: B351E370E002188FDB18CFA9C888BDEBBB1BF48318F158529E815BB791E7749944CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05F5E438, Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.476174199.0000000005F50000.00000040.00000001.sdmp, Offset: 05F50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ced62d3813048249a29990e46ac1d49b90b021eca837cf07955206c5840bfec
Instruction ID: be0abc97739a4298699b6fbf0a1a35e7cb083abe5ca6553249753fd16cf839aa
Opcode Fuzzy Hash: 6ced62d3813048249a29990e46ac1d49b90b021eca837cf07955206c5840bfec
Instruction Fuzzy Hash: C0412571E043558FCB00CFA9D8143EEBBF5EF89224F0585AAD904E7241EB389944CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 027F5084, Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027F51A2

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 15e3d81dab779561522a0bfe5e5de3f173969a5ed4155308b1833d8fdfa26467
Instruction ID: aca7eeb84bc4b263a98ebf215f53a48755dd509a18381cfb55c992a06c2b2cef
Opcode Fuzzy Hash: 15e3d81dab779561522a0bfe5e5de3f173969a5ed4155308b1833d8fdfa26467
Instruction Fuzzy Hash: E251E0B1D103089FDF14CFA9C980ADEBBB1BF48314F65812AE918AB350D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 027F5090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027F51A2

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1731a715eea759e8b9de6aba56d86a3f2a20518a1ea56ab147b94816cc4781b7
Instruction ID: 4cd728e56a875b6990ba9124a67334f5c5c8012e54774b2d2131a0e98a71ef6a
Opcode Fuzzy Hash: 1731a715eea759e8b9de6aba56d86a3f2a20518a1ea56ab147b94816cc4781b7
Instruction Fuzzy Hash: 0D41E0B1D103489FDF14CFA9C984ADEBBB5BF48314F64812AE819AB310D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C7FD38, Relevance: 1.6, APIs: 1, Instructions: 112registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 05C7FE41

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 318666f918f969abda8dcf9d6fa7d952cf96bd8a8991c00dfc4113050b09907f
Instruction ID: 6bfa73a467a12763447df41bd7ab0b939befbf6d6a6f36c0c7388e745053382e
Opcode Fuzzy Hash: 318666f918f969abda8dcf9d6fa7d952cf96bd8a8991c00dfc4113050b09907f
Instruction Fuzzy Hash: 104137B1E05248DFDB10CFAAC884ADEBBF5BF48310F15842AE819AB751D7749905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 027F779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 027F7F01

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: be3d525f53bedac40ffe5853102505848796f760aba4d4b53f2b2bbf430b2d2f
Instruction ID: d4820cae1955ec7e294bb77c9c718da46988826c1e07522a03d8be88a8547503
Opcode Fuzzy Hash: be3d525f53bedac40ffe5853102505848796f760aba4d4b53f2b2bbf430b2d2f
Instruction Fuzzy Hash: 6B4115B5A04205CFDB54CF99C488AAAFBF5FB88314F158499E519AB321D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C7FAD0, Relevance: 1.6, APIs: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 05C7FB84

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9c93a584afa87b565444d031747cd99dc62d6178a109ee72219fbe9501c84474
Instruction ID: 5552101af51c3a221dc8046e4f44d8a3a76174008fff84da200343c22bbeffe0
Opcode Fuzzy Hash: 9c93a584afa87b565444d031747cd99dc62d6178a109ee72219fbe9501c84474
Instruction Fuzzy Hash: 4231E0B1D052498FDB10CF99C584A8EFFF5BF48314F29856AE409AB341C7B59985CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 027F6B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 027F6BEF

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 86e63d3b05da0b25d0c7ef9171011036900de72d979e588686885567567cb052
Instruction ID: be6a6a3731a4768d0926b115f4bb34388cca33d1c64a8877f6c54d2fd520f1aa
Opcode Fuzzy Hash: 86e63d3b05da0b25d0c7ef9171011036900de72d979e588686885567567cb052
Instruction Fuzzy Hash: 5F21D5B5D002489FDB10CFA9D984ADEBBF8FB48324F15841AE914A7350D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 027F6B61, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 027F6BEF

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: eaf7ccd4254c800e1074cdc9dd869e3b94af726db2e594c17b3284f9667bd92b
Instruction ID: b945c02a07c354f02967c3ce6ecca7d6f6ef286a1c63e1ab9a7cbf7f7da364a3
Opcode Fuzzy Hash: eaf7ccd4254c800e1074cdc9dd869e3b94af726db2e594c17b3284f9667bd92b
Instruction Fuzzy Hash: 3D2123B5D00208DFDB00CFA9D584AEEBBF4FB48320F15802AE918A3350D738A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05F5E508, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05F5E48A), ref: 05F5E577

Memory Dump Source

Source File: 00000003.00000002.476174199.0000000005F50000.00000040.00000001.sdmp, Offset: 05F50000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 78d69f06b52dd7ac1b4286e394018a0e865b18043640e400841b6e4f54f7ff43
Instruction ID: 1373ecc48ea90cf20a72bbd33664fe2e18a0d73f1fdbeb7ac2709282207294db
Opcode Fuzzy Hash: 78d69f06b52dd7ac1b4286e394018a0e865b18043640e400841b6e4f54f7ff43
Instruction Fuzzy Hash: B82129B1C046599FCB00CF99C9447DEFBF8BF49220F15819AD914B7641D378AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05F5CF8C, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05F5E48A), ref: 05F5E577

Memory Dump Source

Source File: 00000003.00000002.476174199.0000000005F50000.00000040.00000001.sdmp, Offset: 05F50000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a8f55a675e95c029891ee2e157c9ccd6dd2be0ce6cd7d3a3daf1ea28886f3882
Instruction ID: 3e84669b5eb23560c3856b57615830fbc715c60ce7c2e72ac45ede6e22546f9a
Opcode Fuzzy Hash: a8f55a675e95c029891ee2e157c9ccd6dd2be0ce6cd7d3a3daf1ea28886f3882
Instruction Fuzzy Hash: E21136B1C046199BCB10CF9AC4447DEFBF8AB48220F05856AD918A7240D378AA54CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 05F38D74, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,05F3B871,00000800), ref: 05F3B902

Memory Dump Source

Source File: 00000003.00000002.476137892.0000000005F30000.00000040.00000001.sdmp, Offset: 05F30000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bc0a74542a84e5a7c577d252eecbd8b52d1b0b40a1963f8d37b71f8539733546
Instruction ID: d9db6b5a6be2b59c38ac25a6faacbbe77b8a974906d7ec0e43e6cd23d6ee6252
Opcode Fuzzy Hash: bc0a74542a84e5a7c577d252eecbd8b52d1b0b40a1963f8d37b71f8539733546
Instruction Fuzzy Hash: 831114B6D042498FDB10CF9AC444BDEFBF4EB88314F04842AE919A7300C378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 027FC198, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 027FC212

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 04a7b293d6131ad5d5d87bf31b2eeeec3603e7a6422159d13c9b5fcb4e83eaf2
Instruction ID: aa8d5741c9eebd09f99f878004b35da14763ee152e8c69df8e499ce282edb515
Opcode Fuzzy Hash: 04a7b293d6131ad5d5d87bf31b2eeeec3603e7a6422159d13c9b5fcb4e83eaf2
Instruction Fuzzy Hash: 0D1197B29013488FDB50DFA9C5087DFBBF4EB48714F20802AD508A7744C738A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 027FC191, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 027FC212

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: e1d4bbfb825dd074117749789d306d6e34fe55d6b4ffeaf39353ded36d469395
Instruction ID: 829c6fb5fba1881cea79ac551571b55c944a3373a68677c238edf0a4fa7d92ca
Opcode Fuzzy Hash: e1d4bbfb825dd074117749789d306d6e34fe55d6b4ffeaf39353ded36d469395
Instruction Fuzzy Hash: A52194B2A043498FDB50DFA8D20839EBBF0FB08314F24846AD608E7344C7386908CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 027F3300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 027F4116

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c56a4a82631241416f306c7a2648f436fc8685920883cfe0f432658433cbaa20
Instruction ID: 5d217afc8138c56d4a5f33b693fa6d9f952e86281db81e616c58dfc82c4ca57d
Opcode Fuzzy Hash: c56a4a82631241416f306c7a2648f436fc8685920883cfe0f432658433cbaa20
Instruction Fuzzy Hash: 5A1120B2D046498BDB10CF9AC444BDFFBF4EB88224F01806ADA29B7700C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05F3E230, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05F3F2ED

Memory Dump Source

Source File: 00000003.00000002.476137892.0000000005F30000.00000040.00000001.sdmp, Offset: 05F30000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7b3340c39cb42ce86d5db02da8ecc61c1ec7c26fd2b37643f0ecd2931f1eef80
Instruction ID: 442f44306219277e3701a03cdb6cfa91015a6d0098a5400aba2147b1a196669d
Opcode Fuzzy Hash: 7b3340c39cb42ce86d5db02da8ecc61c1ec7c26fd2b37643f0ecd2931f1eef80
Instruction Fuzzy Hash: 74112EB5D00248CFDB20DF99D548BDEBBF8AB48224F14841AE519A7300C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 027F40AB, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 027F4116

Memory Dump Source

Source File: 00000003.00000002.470723928.00000000027F0000.00000040.00000001.sdmp, Offset: 027F0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 60f4b80626a4ed44993a8b3bcd31385fea05efa4532ecc065f82214b0244a994
Instruction ID: eaed7ec016d619c04322922f68f01a1fb5ee3bacb36fa1912191d1320c990f20
Opcode Fuzzy Hash: 60f4b80626a4ed44993a8b3bcd31385fea05efa4532ecc065f82214b0244a994
Instruction Fuzzy Hash: 7B110FB6D006498FDB10CFAAC544BDEFBF5AB88324F15846AC529B7640C378A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C7B60D, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05C7B633

Memory Dump Source

Source File: 00000003.00000002.475910700.0000000005C70000.00000040.00000001.sdmp, Offset: 05C70000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f37d5fab90c05e27e46640527088b7cef428dcae643723b7c7d49f9c49e2af8a
Instruction ID: 0be18e2873f6aed4bae4c5acce82097ce769eacd19fbfd44798194de0acb7fb2
Opcode Fuzzy Hash: f37d5fab90c05e27e46640527088b7cef428dcae643723b7c7d49f9c49e2af8a
Instruction Fuzzy Hash: 45110670D04248CFDB14CFA8C588BDDBBB1BF08308F108419E555BB6A0DB745988CB65

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report RQF 100021790.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre