Loading ...

Play interactive tourEdit tour

Analysis Report jkj.exe

Overview

General Information

Sample Name:jkj.exe
Analysis ID:404218
MD5:31a54357ddfa0fae7192a6ed14894b65
SHA1:b3ff92e6b5f224a8b03456956ec45f935ba723dc
SHA256:7acc36989994a4fccf77ec05f9b9d79cd1d0b3280f54dd21eabea1b737fa43c0
Tags:AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • jkj.exe (PID: 5768 cmdline: 'C:\Users\user\Desktop\jkj.exe' MD5: 31A54357DDFA0FAE7192A6ED14894B65)
    • jkj.exe (PID: 6008 cmdline: C:\Users\user\Desktop\jkj.exe MD5: 31A54357DDFA0FAE7192A6ED14894B65)
    • jkj.exe (PID: 6092 cmdline: C:\Users\user\Desktop\jkj.exe MD5: 31A54357DDFA0FAE7192A6ED14894B65)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "info@sports024.comDANIEL3116us2.smtp.mailhostbox.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          Process Memory Space: jkj.exe PID: 5768JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.jkj.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.jkj.exe.445e700.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.jkj.exe.445e700.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  0.2.jkj.exe.431e450.3.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    0.2.jkj.exe.32af58c.1.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 0.2.jkj.exe.445e700.2.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "info@sports024.comDANIEL3116us2.smtp.mailhostbox.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: jkj.exeVirustotal: Detection: 21%Perma Link
                      Source: jkj.exeReversingLabs: Detection: 17%
                      Machine Learning detection for sampleShow sources
                      Source: jkj.exeJoe Sandbox ML: detected
                      Source: 2.2.jkj.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: jkj.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: jkj.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Networking:

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49726 -> 208.91.199.223:587
                      Source: global trafficTCP traffic: 192.168.2.5:49726 -> 208.91.199.223:587
                      Source: Joe Sandbox ViewIP Address: 208.91.199.223 208.91.199.223
                      Source: global trafficTCP traffic: 192.168.2.5:49726 -> 208.91.199.223:587
                      Source: unknownDNS traffic detected: queries for: us2.smtp.mailhostbox.com
                      Source: jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmpString found in binary or memory: http://lDWAxa.com
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: jkj.exe, 00000002.00000002.501100641.0000000002FAF000.00000004.00000001.sdmpString found in binary or memory: http://us2.smtp.mailhostbox.com
                      Source: jkj.exeString found in binary or memory: http://vbcity.com/forums/t/51894.aspx
                      Source: jkj.exeString found in binary or memory: https://github.com/MrCylops
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                      Source: jkj.exe, 00000002.00000002.501073952.0000000002FA9000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.501100641.0000000002FAF000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.500942585.0000000002F6E000.00000004.00000001.sdmpString found in binary or memory: https://woZnmpjv3WDVYC.net
                      Source: jkj.exe, 00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 2.2.jkj.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bDEE75E8Du002dE3EEu002d4C58u002dB0DBu002d0CE9CB50059Fu007d/F98C16E3u002dB035u002d43EDu002dAAE1u002d1886449A4C37.csLarge array initialization: .cctor: array initializer size 11936
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 0_2_0312C2B00_2_0312C2B0
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 0_2_031299900_2_03129990
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_00F2B4982_2_00F2B498
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_00F252002_2_00F25200
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_00F264702_2_00F26470
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012C110E2_2_012C110E
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012C5B682_2_012C5B68
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012C0FE82_2_012C0FE8
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012CAE982_2_012CAE98
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012C99B82_2_012C99B8
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012C63182_2_012C6318
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012C03102_2_012C0310
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012C63B82_2_012C63B8
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012CE2382_2_012CE238
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_012C9A182_2_012C9A18
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_02CC46A02_2_02CC46A0
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_02CC35AE2_2_02CC35AE
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_02CC46722_2_02CC4672
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_02CC53922_2_02CC5392
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 2_2_02CCDA002_2_02CCDA00
                      Source: jkj.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll( vs jkj.exe
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameZYwGteJVgFXSnvZzvhPVYhghGRH.exe4 vs jkj.exe
                      Source: jkj.exe, 00000000.00000003.233786860.00000000043DD000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs jkj.exe
                      Source: jkj.exe, 00000000.00000000.228090436.0000000000F98000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameRuntimeMethodInfo.exe> vs jkj.exe
                      Source: jkj.exe, 00000001.00000000.235506598.0000000000118000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameRuntimeMethodInfo.exe> vs jkj.exe
                      Source: jkj.exe, 00000002.00000002.496793189.0000000000BE8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs jkj.exe
                      Source: jkj.exe, 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameZYwGteJVgFXSnvZzvhPVYhghGRH.exe4 vs jkj.exe
                      Source: jkj.exe, 00000002.00000002.496712907.0000000000A58000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameRuntimeMethodInfo.exe> vs jkj.exe
                      Source: jkj.exe, 00000002.00000002.498271905.000000000111A000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs jkj.exe
                      Source: jkj.exe, 00000002.00000002.498837681.0000000001210000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs jkj.exe
                      Source: jkj.exeBinary or memory string: OriginalFilenameRuntimeMethodInfo.exe> vs jkj.exe
                      Source: jkj.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: jkj.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: 2.2.jkj.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 2.2.jkj.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@5/1@1/1
                      Source: C:\Users\user\Desktop\jkj.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jkj.exe.logJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeMutant created: \Sessions\1\BaseNamedObjects\oOlwZszkyqJJchNAeoYFpWZ
                      Source: jkj.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\jkj.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\jkj.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\jkj.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
                      Source: jkj.exeVirustotal: Detection: 21%
                      Source: jkj.exeReversingLabs: Detection: 17%
                      Source: unknownProcess created: C:\Users\user\Desktop\jkj.exe 'C:\Users\user\Desktop\jkj.exe'
                      Source: C:\Users\user\Desktop\jkj.exeProcess created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exe
                      Source: C:\Users\user\Desktop\jkj.exeProcess created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exe
                      Source: C:\Users\user\Desktop\jkj.exeProcess created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exeJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exeJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: jkj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: jkj.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: jkj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: jkj.exeStatic PE information: 0xB8BD3437 [Mon Mar 19 18:30:15 2068 UTC]
                      Source: C:\Users\user\Desktop\jkj.exeCode function: 0_2_0312AC31 push 5E042847h; ret 0_2_0312ACC8
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.64113001914
                      Source: C:\Users\user\Desktop\jkj.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: jkj.exe PID: 5768, type: MEMORY
                      Source: Yara matchFile source: 0.2.jkj.exe.32af58c.1.raw.unpack, type: UNPACKEDPE
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\jkj.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\jkj.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\jkj.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeWindow / User API: threadDelayed 4576Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeWindow / User API: threadDelayed 5223Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exe TID: 6012Thread sleep time: -102026s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exe TID: 5384Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exe TID: 3884Thread sleep time: -20291418481080494s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exe TID: 4440Thread sleep count: 4576 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exe TID: 4440Thread sleep count: 5223 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\jkj.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\jkj.exeThread delayed: delay time: 102026Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: jkj.exe, 00000002.00000002.505607331.00000000069C0000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Users\user\Desktop\jkj.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      .NET source code references suspicious native API functionsShow sources
                      Source: jkj.exe, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                      Source: jkj.exe, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                      Source: 0.0.jkj.exe.ec0000.0.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                      Source: 0.0.jkj.exe.ec0000.0.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                      Source: 0.2.jkj.exe.ec0000.0.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                      Source: 0.2.jkj.exe.ec0000.0.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                      Source: 1.2.jkj.exe.40000.0.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                      Source: 1.2.jkj.exe.40000.0.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                      Source: 1.0.jkj.exe.40000.0.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                      Source: 1.0.jkj.exe.40000.0.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                      Source: 2.2.jkj.exe.400000.0.unpack, A/b2.csReference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
                      Source: 2.2.jkj.exe.980000.1.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                      Source: 2.2.jkj.exe.980000.1.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                      Source: 2.0.jkj.exe.980000.0.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                      Source: 2.0.jkj.exe.980000.0.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                      Source: C:\Users\user\Desktop\jkj.exeProcess created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exeJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeProcess created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exeJump to behavior
                      Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
                      Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
                      Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Users\user\Desktop\jkj.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Users\user\Desktop\jkj.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: jkj.exe PID: 5768, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: jkj.exe PID: 6092, type: MEMORY
                      Source: Yara matchFile source: 2.2.jkj.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.jkj.exe.445e700.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.jkj.exe.445e700.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.jkj.exe.431e450.3.raw.unpack, type: UNPACKEDPE
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\jkj.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\jkj.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\jkj.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Users\user\Desktop\jkj.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: C:\Users\user\Desktop\jkj.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities