Loading ...

Play interactive tourEdit tour

Analysis Report ATuRNgegI7kl7Ua.exe

Overview

General Information

Sample Name:ATuRNgegI7kl7Ua.exe
Analysis ID:404156
MD5:ec217acdf26636dd01ccba3dc7df5066
SHA1:768c321ffe79e38f92682477a2b9b0e6122721ab
SHA256:e27c7feb3112b0f8d3aa4195962fc2c430074179cbf6811874b49691c486e26f
Tags:AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • ATuRNgegI7kl7Ua.exe (PID: 5856 cmdline: 'C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe' MD5: EC217ACDF26636DD01CCBA3DC7DF5066)
    • ATuRNgegI7kl7Ua.exe (PID: 1368 cmdline: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe MD5: EC217ACDF26636DD01CCBA3DC7DF5066)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "victo@chefoowork.comYi-yIzLFE-*bmail.chefoowork.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.480281925.0000000002E11000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000004.00000002.480281925.0000000002E11000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000004.00000002.475257684.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.239732017.0000000003F39000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.ATuRNgegI7kl7Ua.exe.4045970.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              4.2.ATuRNgegI7kl7Ua.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.ATuRNgegI7kl7Ua.exe.4045970.4.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

                  Sigma Overview

                  No Sigma rule has matched

                  Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: 0.2.ATuRNgegI7kl7Ua.exe.4045970.4.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "victo@chefoowork.comYi-yIzLFE-*bmail.chefoowork.com"}
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: ATuRNgegI7kl7Ua.exeReversingLabs: Detection: 21%
                  Machine Learning detection for sampleShow sources
                  Source: ATuRNgegI7kl7Ua.exeJoe Sandbox ML: detected
                  Source: 4.2.ATuRNgegI7kl7Ua.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                  Source: ATuRNgegI7kl7Ua.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: ATuRNgegI7kl7Ua.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: global trafficTCP traffic: 192.168.2.3:49742 -> 67.21.94.15:587
                  Source: Joe Sandbox ViewIP Address: 67.21.94.15 67.21.94.15
                  Source: Joe Sandbox ViewASN Name: ST-BGPUS ST-BGPUS
                  Source: global trafficTCP traffic: 192.168.2.3:49742 -> 67.21.94.15:587
                  Source: unknownDNS traffic detected: queries for: mail.chefoowork.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.480281925.0000000002E11000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.480281925.0000000002E11000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.482397144.00000000030B4000.00000004.00000001.sdmp, ATuRNgegI7kl7Ua.exe, 00000004.00000002.480281925.0000000002E11000.00000004.00000001.sdmp, ATuRNgegI7kl7Ua.exe, 00000004.00000002.482558346.00000000030E6000.00000004.00000001.sdmpString found in binary or memory: http://H5aErSJgJW.org
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.482432785.00000000030BC000.00000004.00000001.sdmpString found in binary or memory: http://chefoowork.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485921088.0000000006860000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485952823.000000000688E000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485921088.0000000006860000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485921088.0000000006860000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485921088.0000000006860000.00000004.00000001.sdmpString found in binary or memory: http://crt.comodoca
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.480281925.0000000002E11000.00000004.00000001.sdmpString found in binary or memory: http://kFANsF.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.482432785.00000000030BC000.00000004.00000001.sdmpString found in binary or memory: http://mail.chefoowork.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485921088.0000000006860000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235516874.0000000002F31000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.213030960.00000000060A4000.00000004.00000001.sdmp, ATuRNgegI7kl7Ua.exe, 00000000.00000003.212707591.00000000060A3000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.212707591.00000000060A3000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com=k(
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.212738820.00000000060A3000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comC
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.212656056.00000000060A3000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comP
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.213030960.00000000060A4000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comn)
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.212707591.00000000060A3000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comn-u
                  Source: ATuRNgegI7kl7Ua.exeString found in binary or memory: http://www.churchsw.org/church-projector-project
                  Source: ATuRNgegI7kl7Ua.exeString found in binary or memory: http://www.churchsw.org/repository/Bibles/
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.214734850.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers(o
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.214664649.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.214709420.00000000060AC000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/P
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmp, ATuRNgegI7kl7Ua.exe, 00000000.00000003.215924440.00000000060AC000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.215924440.00000000060AC000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlm
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmp, ATuRNgegI7kl7Ua.exe, 00000000.00000003.215586670.00000000060AC000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.215586670.00000000060AC000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlh
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.216371701.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers6o
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.222970335.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersB
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.215126918.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersBo
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.215126918.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersF
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.222970335.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersco
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.214795644.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersersto
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.216085467.00000000060D5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersto
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244672949.00000000060A0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comgrita
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244672949.00000000060A0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comldvan
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244672949.00000000060A0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.como
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.210334592.00000000060BB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.212255802.00000000060AF000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnN
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.217799053.00000000060AC000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.222533395.00000000060E6000.00000004.00000001.sdmp, ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.218026145.00000000060AC000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmn
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.211933873.00000000060B0000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.211933873.00000000060B0000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.211933873.00000000060B0000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krF
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.211933873.00000000060B0000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krP
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.211933873.00000000060B0000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krimP
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.211933873.00000000060B0000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krormal
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmp, ATuRNgegI7kl7Ua.exe, 00000000.00000003.212707591.00000000060A3000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.210857080.00000000060BB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comtnP
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.244730006.0000000006190000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000003.212561377.00000000060A3000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485921088.0000000006860000.00000004.00000001.sdmpString found in binary or memory: https://sectigo.com/CPS0
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.239732017.0000000003F39000.00000004.00000001.sdmp, ATuRNgegI7kl7Ua.exe, 00000004.00000002.475257684.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.480281925.0000000002E11000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                  System Summary:

                  barindex
                  .NET source code contains very large array initializationsShow sources
                  Source: 4.2.ATuRNgegI7kl7Ua.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b7886AC67u002d7403u002d4406u002dAF72u002d05A9164D1071u007d/EB70D18Cu002d8D26u002d4E65u002d8652u002d0B60DEBB409A.csLarge array initialization: .cctor: array initializer size 11936
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 0_2_0539C2B00_2_0539C2B0
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 0_2_053999900_2_05399990
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 0_2_05F100400_2_05F10040
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_01152D504_2_01152D50
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_0115B1604_2_0115B160
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_0115F5C04_2_0115F5C0
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_01151FE04_2_01151FE0
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011526184_2_01152618
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_01159DB84_2_01159DB8
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011619B04_2_011619B0
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011698004_2_01169800
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011654204_2_01165420
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_0116E8984_2_0116E898
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011676704_2_01167670
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011631984_2_01163198
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011650084_2_01165008
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_0116B7774_2_0116B777
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_0116B7D84_2_0116B7D8
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011CB6984_2_011CB698
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011C665C4_2_011C665C
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.245592032.0000000007C70000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll( vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.247797720.00000000090C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.234577759.0000000000C2A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameWorkItem.exeB vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235616668.0000000002F77000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameucrmwGUXJrIkJLDEpMlrx.exe4 vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.239732017.0000000003F39000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.245503196.00000000077F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameIEFRAME.DLLD vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485661781.00000000064E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.475863357.0000000000AFA000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameWorkItem.exeB vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.475998305.0000000000EF8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.475257684.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameucrmwGUXJrIkJLDEpMlrx.exe4 vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exeBinary or memory string: OriginalFilenameWorkItem.exeB vs ATuRNgegI7kl7Ua.exe
                  Source: ATuRNgegI7kl7Ua.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: ATuRNgegI7kl7Ua.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: 4.2.ATuRNgegI7kl7Ua.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: 4.2.ATuRNgegI7kl7Ua.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@2/1
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ATuRNgegI7kl7Ua.exe.logJump to behavior
                  Source: ATuRNgegI7kl7Ua.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
                  Source: ATuRNgegI7kl7Ua.exeReversingLabs: Detection: 21%
                  Source: unknownProcess created: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe 'C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe'
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess created: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess created: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                  Source: ATuRNgegI7kl7Ua.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: ATuRNgegI7kl7Ua.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 0_2_00B8B220 push es; retf 0_2_00B8B4AB
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 0_2_00B8A8C2 push es; retf 0_2_00B8B4AB
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_00A5B220 push es; retf 4_2_00A5B4AB
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_00A5A8C2 push es; retf 4_2_00A5B4AB
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_01157A37 push edi; retn 0000h4_2_01157A39
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_0116E3F0 push esp; ret 4_2_0116E439
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_011C9A01 push es; ret 4_2_011C9A10
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_012AE32E push eax; ret 4_2_012AE349
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_012AD95C push eax; ret 4_2_012AD95D
                  Source: initial sampleStatic PE information: section name: .text entropy: 7.65248683317
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion:

                  barindex
                  Yara detected AntiVM3Show sources
                  Source: Yara matchFile source: 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ATuRNgegI7kl7Ua.exe PID: 5856, type: MEMORY
                  Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                  Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                  Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeWindow / User API: threadDelayed 3156Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeWindow / User API: threadDelayed 6693Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe TID: 5816Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe TID: 6016Thread sleep time: -104884s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe TID: 5948Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe TID: 5404Thread sleep time: -23980767295822402s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe TID: 5796Thread sleep count: 3156 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe TID: 5796Thread sleep count: 6693 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeThread delayed: delay time: 104884Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: vmware
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: VMWARE
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.239732017.0000000003F39000.00000004.00000001.sdmpBinary or memory string: HgFSg+
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                  Source: ATuRNgegI7kl7Ua.exe, 00000000.00000002.235727199.0000000002FAC000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.485921088.0000000006860000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeCode function: 4_2_01165420 LdrInitializeThunk,4_2_01165420
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeMemory allocated: page read and write | page guardJump to behavior

                  HIPS / PFW / Operating System Protection Evasion:

                  barindex
                  Injects a PE file into a foreign processesShow sources
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeMemory written: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe base: 400000 value starts with: 4D5AJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeProcess created: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeJump to behavior
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.479818863.00000000017D0000.00000002.00000001.sdmpBinary or memory string: Program Manager
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.479818863.00000000017D0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.479818863.00000000017D0000.00000002.00000001.sdmpBinary or memory string: Progman
                  Source: ATuRNgegI7kl7Ua.exe, 00000004.00000002.479818863.00000000017D0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ATuRNgegI7kl7Ua.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInfor