Play interactive tour

Edit tour

Analysis Report jkj.exe

Overview

General Information

Sample Name:	jkj.exe
Analysis ID:	404218
MD5:	31a54357ddfa0fae7192a6ed14894b65
SHA1:	b3ff92e6b5f224a8b03456956ec45f935ba723dc
SHA256:	7acc36989994a4fccf77ec05f9b9d79cd1d0b3280f54dd21eabea1b737fa43c0
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

jkj.exe (PID: 5768 cmdline: 'C:\Users\user\Desktop\jkj.exe' MD5: 31A54357DDFA0FAE7192A6ED14894B65)

jkj.exe (PID: 6008 cmdline: C:\Users\user\Desktop\jkj.exe MD5: 31A54357DDFA0FAE7192A6ED14894B65)

jkj.exe (PID: 6092 cmdline: C:\Users\user\Desktop\jkj.exe MD5: 31A54357DDFA0FAE7192A6ED14894B65)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "info@sports024.comDANIEL3116us2.smtp.mailhostbox.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jkj.exe PID: 5768	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: jkj.exe PID: 5768	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: jkj.exe PID: 6092	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: jkj.exe PID: 6092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.jkj.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jkj.exe.445e700.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jkj.exe.445e700.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jkj.exe.431e450.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.jkj.exe.32af58c.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.jkj.exe.445e700.2.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "info@sports024.comDANIEL3116us2.smtp.mailhostbox.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: jkj.exe	Virustotal: Detection: 21%			Perma Link
Source: jkj.exe	ReversingLabs: Detection: 17%

Machine Learning detection for sample

Show sources

Source: jkj.exe

Joe Sandbox ML: detected

Source: 2.2.jkj.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: jkj.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: jkj.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49726 -> 208.91.199.223:587

Source: global traffic

TCP traffic: 192.168.2.5:49726 -> 208.91.199.223:587

Source: Joe Sandbox View

IP Address: 208.91.199.223 208.91.199.223

Source: global traffic

TCP traffic: 192.168.2.5:49726 -> 208.91.199.223:587

Source: unknown

DNS traffic detected: queries for: us2.smtp.mailhostbox.com

Source: jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	String found in binary or memory: http://lDWAxa.com
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jkj.exe, 00000002.00000002.501100641.0000000002FAF000.00000004.00000001.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: jkj.exe	String found in binary or memory: http://vbcity.com/forums/t/51894.aspx
Source: jkj.exe	String found in binary or memory: https://github.com/MrCylops
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: jkj.exe, 00000002.00000002.501073952.0000000002FA9000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.501100641.0000000002FAF000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.500942585.0000000002F6E000.00000004.00000001.sdmp	String found in binary or memory: https://woZnmpjv3WDVYC.net
Source: jkj.exe, 00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 2.2.jkj.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bDEE75E8Du002dE3EEu002d4C58u002dB0DBu002d0CE9CB50059Fu007d/F98C16E3u002dB035u002d43EDu002dAAE1u002d1886449A4C37.cs

Large array initialization: .cctor: array initializer size 11936

Source: C:\Users\user\Desktop\jkj.exe	Code function: 0_2_0312C2B0	0_2_0312C2B0
Source: C:\Users\user\Desktop\jkj.exe	Code function: 0_2_03129990	0_2_03129990
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_00F2B498	2_2_00F2B498
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_00F25200	2_2_00F25200
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_00F26470	2_2_00F26470
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012C110E	2_2_012C110E
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012C5B68	2_2_012C5B68
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012C0FE8	2_2_012C0FE8
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012CAE98	2_2_012CAE98
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012C99B8	2_2_012C99B8
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012C6318	2_2_012C6318
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012C0310	2_2_012C0310
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012C63B8	2_2_012C63B8
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012CE238	2_2_012CE238
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_012C9A18	2_2_012C9A18
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_02CC46A0	2_2_02CC46A0
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_02CC35AE	2_2_02CC35AE
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_02CC4672	2_2_02CC4672
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_02CC5392	2_2_02CC5392
Source: C:\Users\user\Desktop\jkj.exe	Code function: 2_2_02CCDA00	2_2_02CCDA00

Source: jkj.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs jkj.exe
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameZYwGteJVgFXSnvZzvhPVYhghGRH.exe4 vs jkj.exe
Source: jkj.exe, 00000000.00000003.233786860.00000000043DD000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs jkj.exe
Source: jkj.exe, 00000000.00000000.228090436.0000000000F98000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRuntimeMethodInfo.exe> vs jkj.exe
Source: jkj.exe, 00000001.00000000.235506598.0000000000118000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRuntimeMethodInfo.exe> vs jkj.exe
Source: jkj.exe, 00000002.00000002.496793189.0000000000BE8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs jkj.exe
Source: jkj.exe, 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameZYwGteJVgFXSnvZzvhPVYhghGRH.exe4 vs jkj.exe
Source: jkj.exe, 00000002.00000002.496712907.0000000000A58000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRuntimeMethodInfo.exe> vs jkj.exe
Source: jkj.exe, 00000002.00000002.498271905.000000000111A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs jkj.exe
Source: jkj.exe, 00000002.00000002.498837681.0000000001210000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs jkj.exe
Source: jkj.exe	Binary or memory string: OriginalFilenameRuntimeMethodInfo.exe> vs jkj.exe

Source: jkj.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: jkj.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 2.2.jkj.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.jkj.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@1/1

Source: C:\Users\user\Desktop\jkj.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jkj.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe

Mutant created: \Sessions\1\BaseNamedObjects\oOlwZszkyqJJchNAeoYFpWZ

Source: jkj.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\jkj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jkj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\jkj.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: jkj.exe	Virustotal: Detection: 21%
Source: jkj.exe	ReversingLabs: Detection: 17%

Source: unknown	Process created: C:\Users\user\Desktop\jkj.exe 'C:\Users\user\Desktop\jkj.exe'
Source: C:\Users\user\Desktop\jkj.exe	Process created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exe
Source: C:\Users\user\Desktop\jkj.exe	Process created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exe
Source: C:\Users\user\Desktop\jkj.exe	Process created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exe	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exe	Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: jkj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: jkj.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: jkj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: jkj.exe

Static PE information: 0xB8BD3437 [Mon Mar 19 18:30:15 2068 UTC]

Source: C:\Users\user\Desktop\jkj.exe

Code function: 0_2_0312AC31 push 5E042847h; ret

0_2_0312ACC8

Source: initial sample

Static PE information: section name: .text entropy: 7.64113001914

Source: C:\Users\user\Desktop\jkj.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jkj.exe PID: 5768, type: MEMORY
Source: Yara match	File source: 0.2.jkj.exe.32af58c.1.raw.unpack, type: UNPACKEDPE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\jkj.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\jkj.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\jkj.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe	Window / User API: threadDelayed 4576			Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Window / User API: threadDelayed 5223			Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe TID: 6012	Thread sleep time: -102026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe TID: 5384	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe TID: 3884	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe TID: 4440	Thread sleep count: 4576 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe TID: 4440	Thread sleep count: 5223 > 30	Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\jkj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\jkj.exe	Thread delayed: delay time: 102026	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: jkj.exe, 00000002.00000002.505607331.00000000069C0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\jkj.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

.NET source code references suspicious native API functions

Show sources

Source: jkj.exe, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: jkj.exe, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 0.0.jkj.exe.ec0000.0.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 0.0.jkj.exe.ec0000.0.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 0.2.jkj.exe.ec0000.0.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 0.2.jkj.exe.ec0000.0.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 1.2.jkj.exe.40000.0.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 1.2.jkj.exe.40000.0.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 1.0.jkj.exe.40000.0.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 1.0.jkj.exe.40000.0.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 2.2.jkj.exe.400000.0.unpack, A/b2.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Source: 2.2.jkj.exe.980000.1.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 2.2.jkj.exe.980000.1.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 2.0.jkj.exe.980000.0.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 2.0.jkj.exe.980000.0.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')

Source: C:\Users\user\Desktop\jkj.exe	Process created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exe			Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Process created: C:\Users\user\Desktop\jkj.exe C:\Users\user\Desktop\jkj.exe			Jump to behavior

Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: jkj.exe, 00000002.00000002.499038696.00000000016A0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Users\user\Desktop\jkj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Users\user\Desktop\jkj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\jkj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jkj.exe PID: 5768, type: MEMORY
Source: Yara match	File source: Process Memory Space: jkj.exe PID: 6092, type: MEMORY
Source: Yara match	File source: 2.2.jkj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jkj.exe.445e700.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jkj.exe.445e700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jkj.exe.431e450.3.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\jkj.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\jkj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\jkj.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\jkj.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\jkj.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jkj.exe PID: 6092, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jkj.exe PID: 5768, type: MEMORY
Source: Yara match	File source: Process Memory Space: jkj.exe PID: 6092, type: MEMORY
Source: Yara match	File source: 2.2.jkj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jkj.exe.445e700.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jkj.exe.445e700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.jkj.exe.431e450.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
jkj.exe	22%	Virustotal		Browse
jkj.exe	17%	ReversingLabs	ByteCode-MSIL.Trojan.Injuke
jkj.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.jkj.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://lDWAxa.com	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://woZnmpjv3WDVYC.net	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.199.223	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://lDWAxa.com	jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://vbcity.com/forums/t/51894.aspx	jkj.exe	false		high
https://woZnmpjv3WDVYC.net	jkj.exe, 00000002.00000002.501073952.0000000002FA9000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.501100641.0000000002FAF000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.500942585.0000000002F6E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	jkj.exe, 00000002.00000002.501100641.0000000002FAF000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	jkj.exe, 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	jkj.exe, 00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmp, jkj.exe, 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	jkj.exe, 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp	false		high
https://github.com/MrCylops	jkj.exe	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.199.223	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	404218
Start date:	04.05.2021
Start time:	20:10:18
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	jkj.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@1/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.8% (good quality ratio 0.5%) Quality average: 47.4% Quality standard deviation: 34.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 39 Number of non-executed functions: 2
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 93.184.220.29, 104.43.193.48, 131.253.33.200, 13.107.22.200, 20.82.210.154, 52.147.198.201, 13.88.21.125, 92.122.145.220, 23.57.80.111, 92.122.213.247, 92.122.213.194, 20.54.26.129 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, skypedataprdcolcus15.cloudapp.net, dual-a-0001.dc-msedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:11:09	API Interceptor	838x Sleep call for process: jkj.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
208.91.199.223	Mlj6rE49Bf.exe	Get hash	malicious	Browse
	DHL Shipment Delivery Notification.exe	Get hash	malicious	Browse
	QuoteXrequestX-DAX31312.exe	Get hash	malicious	Browse
	LM Approved Invoice-03-05-2021.doc	Get hash	malicious	Browse
	razi.exe	Get hash	malicious	Browse
	Project Enquiry - KHI To LSG.exe	Get hash	malicious	Browse
	LM Approved Invoice-02-05-2021.doc	Get hash	malicious	Browse
	KJ29joA7RS.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.624.32220.exe	Get hash	malicious	Browse
	PO.exe	Get hash	malicious	Browse
	Fattura proforma-700004616.doc.exe	Get hash	malicious	Browse
	017a3915_by_Libranalysis.exe	Get hash	malicious	Browse
	Pending payment.exe	Get hash	malicious	Browse
	quotation.exe	Get hash	malicious	Browse
	Copy of the Invoice 022021.pdf.exe	Get hash	malicious	Browse
	0bMDP1V3eX.exe	Get hash	malicious	Browse
	NEW ENQUIRY 200283.exe	Get hash	malicious	Browse
	TT Copy pdf.exe	Get hash	malicious	Browse
	Signed Contract.doc	Get hash	malicious	Browse
	1Nggo6oJzH.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us2.smtp.mailhostbox.com	1g1NLI6i33.exe	Get hash	malicious	Browse	208.91.199.224
	Mlj6rE49Bf.exe	Get hash	malicious	Browse	208.91.199.223
	DHL Shipment Delivery Notification.exe	Get hash	malicious	Browse	208.91.199.223
	PO.xlsx	Get hash	malicious	Browse	208.91.199.224
	Order Request .pdf.exe	Get hash	malicious	Browse	208.91.198.143
	QuoteXrequestX-DAX31312.exe	Get hash	malicious	Browse	208.91.199.223
	P I.exe	Get hash	malicious	Browse	208.91.198.143
	LM Approved Invoice-04-05-2021.doc	Get hash	malicious	Browse	208.91.199.223
	Purchase Orde.pdf.exe	Get hash	malicious	Browse	208.91.199.224
	LM Approved Invoice-03-05-2021.doc	Get hash	malicious	Browse	208.91.199.223
	REQUEST FOR PRICE QUOTE - URGENT.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	razi.exe	Get hash	malicious	Browse	208.91.199.223
	Product Sample.xlsx	Get hash	malicious	Browse	208.91.199.225
	RQF_001.exe	Get hash	malicious	Browse	208.91.198.143
	REQUEST FOR PRICE QUOTE - URGENT.exe	Get hash	malicious	Browse	208.91.199.224
	Project Enquiry - KHI To LSG.exe	Get hash	malicious	Browse	208.91.199.223
	quotation pdf.exe	Get hash	malicious	Browse	208.91.199.225
	RFQ.doc	Get hash	malicious	Browse	208.91.199.225
	YdenPtYdbt.exe	Get hash	malicious	Browse	208.91.198.143
	LM Approved Invoice-02-05-2021.doc	Get hash	malicious	Browse	208.91.199.223

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	1g1NLI6i33.exe	Get hash	malicious	Browse	208.91.199.224
	Mlj6rE49Bf.exe	Get hash	malicious	Browse	208.91.199.223
	DHL Shipment Delivery Notification.exe	Get hash	malicious	Browse	208.91.199.223
	PO.xlsx	Get hash	malicious	Browse	208.91.199.224
	Order Request .pdf.exe	Get hash	malicious	Browse	208.91.198.143
	QuoteXrequestX-DAX31312.exe	Get hash	malicious	Browse	208.91.199.223
	items.doc	Get hash	malicious	Browse	162.215.241.145
	P I.exe	Get hash	malicious	Browse	208.91.198.143
	LM Approved Invoice-04-05-2021.doc	Get hash	malicious	Browse	208.91.198.143
	Purchase Orde.pdf.exe	Get hash	malicious	Browse	208.91.199.224
	LM Approved Invoice-03-05-2021.doc	Get hash	malicious	Browse	208.91.199.224
	4GGwmv0AJm.exe	Get hash	malicious	Browse	209.99.16.216
	REQUEST FOR PRICE QUOTE - URGENT.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	7A124B54.xlsm	Get hash	malicious	Browse	119.18.52.7
	Tree Top.html	Get hash	malicious	Browse	208.91.199.242
	razi.exe	Get hash	malicious	Browse	208.91.199.223
	af8241fb_by_Libranalysis.exe	Get hash	malicious	Browse	162.215.241.145
	Product Sample.xlsx	Get hash	malicious	Browse	208.91.199.225
	RQF_001.exe	Get hash	malicious	Browse	208.91.198.143
	REQUEST FOR PRICE QUOTE - URGENT.exe	Get hash	malicious	Browse	208.91.199.224

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jkj.exe.log Download File
Process:	C:\Users\user\Desktop\jkj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.630590447772719
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	jkj.exe
File size:	888832
MD5:	31a54357ddfa0fae7192a6ed14894b65
SHA1:	b3ff92e6b5f224a8b03456956ec45f935ba723dc
SHA256:	7acc36989994a4fccf77ec05f9b9d79cd1d0b3280f54dd21eabea1b737fa43c0
SHA512:	ec7d25b07c19201d14816b74c1e4ab4d21dbe69002de934ae4c1d345e9c9123c84d9a062e7f4e62c242545495d61429884260113e09354fc1c2e9b991491f971
SSDEEP:	24576:GD9GxccMElpA8wMrZwmoZ2dB4fK9eAyA:0scfEo8wM1wdZ2TQKKA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...74................P..J...D.......i... ........@.. ....................................@................................

File Icon


Icon Hash:	7908246363490058

Static PE Info

General
Entrypoint:	0x4d69e2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xB8BD3437 [Mon Mar 19 18:30:15 2068 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd6990	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd8000	0x41b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd6974	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd49e8	0xd4a00	False	0.840543016975	data	7.64113001914	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xd8000	0x41b8	0x4200	False	0.268465909091	data	4.35713142514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xd8190	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0xd85f8	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0xd96a0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4294901502, next used block 4294901502
RT_GROUP_ICON	0xdbc48	0x30	data
RT_VERSION	0xdbc78	0x354	data
RT_MANIFEST	0xdbfcc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	RuntimeMethodInfo.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	StarEggControl
ProductVersion	1.0.0.0
FileDescription	StarEggControl
OriginalFilename	RuntimeMethodInfo.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/04/21-20:12:48.502288	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49726	587	192.168.2.5	208.91.199.223

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 20:12:46.913716078 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:47.087155104 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:47.090238094 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:47.432715893 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:47.433199883 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:47.611485958 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:47.611517906 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:47.613662958 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:47.789761066 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:47.790353060 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:47.965897083 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:47.966749907 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:48.141268969 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:48.141745090 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:48.324353933 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:48.324718952 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:48.498337030 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:48.502288103 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:48.502607107 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:48.502758026 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:48.502891064 CEST	49726	587	192.168.2.5	208.91.199.223
May 4, 2021 20:12:48.676038027 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:48.676142931 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:48.777257919 CEST	587	49726	208.91.199.223	192.168.2.5
May 4, 2021 20:12:48.829780102 CEST	49726	587	192.168.2.5	208.91.199.223

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 20:11:01.582371950 CEST	53	54302	8.8.8.8	192.168.2.5
May 4, 2021 20:11:01.699302912 CEST	53784	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:01.751375914 CEST	53	53784	8.8.8.8	192.168.2.5
May 4, 2021 20:11:02.617105961 CEST	65307	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:02.665641069 CEST	53	65307	8.8.8.8	192.168.2.5
May 4, 2021 20:11:02.734883070 CEST	64344	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:02.791644096 CEST	62060	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:02.800209045 CEST	53	64344	8.8.8.8	192.168.2.5
May 4, 2021 20:11:02.844089031 CEST	53	62060	8.8.8.8	192.168.2.5
May 4, 2021 20:11:03.527709007 CEST	61805	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:03.579211950 CEST	53	61805	8.8.8.8	192.168.2.5
May 4, 2021 20:11:04.346605062 CEST	54795	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:04.395932913 CEST	53	54795	8.8.8.8	192.168.2.5
May 4, 2021 20:11:05.474508047 CEST	49557	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:05.523334980 CEST	53	49557	8.8.8.8	192.168.2.5
May 4, 2021 20:11:06.758213043 CEST	61733	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:06.811484098 CEST	65447	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:06.819508076 CEST	53	61733	8.8.8.8	192.168.2.5
May 4, 2021 20:11:06.865134954 CEST	53	65447	8.8.8.8	192.168.2.5
May 4, 2021 20:11:09.488428116 CEST	52441	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:09.540055037 CEST	53	52441	8.8.8.8	192.168.2.5
May 4, 2021 20:11:10.611155987 CEST	62176	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:10.663057089 CEST	53	62176	8.8.8.8	192.168.2.5
May 4, 2021 20:11:12.457477093 CEST	59596	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:12.506244898 CEST	53	59596	8.8.8.8	192.168.2.5
May 4, 2021 20:11:13.664741039 CEST	65296	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:13.716322899 CEST	53	65296	8.8.8.8	192.168.2.5
May 4, 2021 20:11:14.954590082 CEST	63183	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:15.003299952 CEST	53	63183	8.8.8.8	192.168.2.5
May 4, 2021 20:11:16.177145958 CEST	60151	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:16.226171970 CEST	53	60151	8.8.8.8	192.168.2.5
May 4, 2021 20:11:27.496263981 CEST	56969	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:27.579133034 CEST	53	56969	8.8.8.8	192.168.2.5
May 4, 2021 20:11:37.824891090 CEST	55161	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:37.873591900 CEST	53	55161	8.8.8.8	192.168.2.5
May 4, 2021 20:11:41.876666069 CEST	54757	53	192.168.2.5	8.8.8.8
May 4, 2021 20:11:41.940392971 CEST	53	54757	8.8.8.8	192.168.2.5
May 4, 2021 20:12:12.828351974 CEST	49992	53	192.168.2.5	8.8.8.8
May 4, 2021 20:12:12.879664898 CEST	53	49992	8.8.8.8	192.168.2.5
May 4, 2021 20:12:17.535614014 CEST	60075	53	192.168.2.5	8.8.8.8
May 4, 2021 20:12:17.597836018 CEST	53	60075	8.8.8.8	192.168.2.5
May 4, 2021 20:12:34.614037037 CEST	55016	53	192.168.2.5	8.8.8.8
May 4, 2021 20:12:34.679261923 CEST	53	55016	8.8.8.8	192.168.2.5
May 4, 2021 20:12:46.825263023 CEST	64345	53	192.168.2.5	8.8.8.8
May 4, 2021 20:12:46.888087988 CEST	53	64345	8.8.8.8	192.168.2.5
May 4, 2021 20:12:57.989813089 CEST	57128	53	192.168.2.5	8.8.8.8
May 4, 2021 20:12:58.038499117 CEST	53	57128	8.8.8.8	192.168.2.5
May 4, 2021 20:13:00.669133902 CEST	54791	53	192.168.2.5	8.8.8.8
May 4, 2021 20:13:00.742022991 CEST	53	54791	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 4, 2021 20:12:46.825263023 CEST	192.168.2.5	8.8.8.8	0x6d9	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
May 4, 2021 20:12:46.888087988 CEST	8.8.8.8	192.168.2.5	0x6d9	No error (0)	us2.smtp.mailhostbox.com	208.91.199.223	A (IP address)	IN (0x0001)
May 4, 2021 20:12:46.888087988 CEST	8.8.8.8	192.168.2.5	0x6d9	No error (0)	us2.smtp.mailhostbox.com	208.91.199.224	A (IP address)	IN (0x0001)
May 4, 2021 20:12:46.888087988 CEST	8.8.8.8	192.168.2.5	0x6d9	No error (0)	us2.smtp.mailhostbox.com	208.91.198.143	A (IP address)	IN (0x0001)
May 4, 2021 20:12:46.888087988 CEST	8.8.8.8	192.168.2.5	0x6d9	No error (0)	us2.smtp.mailhostbox.com	208.91.199.225	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 4, 2021 20:12:47.432715893 CEST	587	49726	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
May 4, 2021 20:12:47.433199883 CEST	49726	587	192.168.2.5	208.91.199.223	EHLO 436432
May 4, 2021 20:12:47.611517906 CEST	587	49726	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
May 4, 2021 20:12:47.613662958 CEST	49726	587	192.168.2.5	208.91.199.223	AUTH login aW5mb0BzcG9ydHMwMjQuY29t
May 4, 2021 20:12:47.789761066 CEST	587	49726	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
May 4, 2021 20:12:47.965897083 CEST	587	49726	208.91.199.223	192.168.2.5	235 2.7.0 Authentication successful
May 4, 2021 20:12:47.966749907 CEST	49726	587	192.168.2.5	208.91.199.223	MAIL FROM:<info@sports024.com>
May 4, 2021 20:12:48.141268969 CEST	587	49726	208.91.199.223	192.168.2.5	250 2.1.0 Ok
May 4, 2021 20:12:48.141745090 CEST	49726	587	192.168.2.5	208.91.199.223	RCPT TO:<info@sports024.com>
May 4, 2021 20:12:48.324353933 CEST	587	49726	208.91.199.223	192.168.2.5	250 2.1.5 Ok
May 4, 2021 20:12:48.324718952 CEST	49726	587	192.168.2.5	208.91.199.223	DATA
May 4, 2021 20:12:48.498337030 CEST	587	49726	208.91.199.223	192.168.2.5	354 End data with <CR><LF>.<CR><LF>
May 4, 2021 20:12:48.502891064 CEST	49726	587	192.168.2.5	208.91.199.223	.
May 4, 2021 20:12:48.777257919 CEST	587	49726	208.91.199.223	192.168.2.5	250 2.0.0 Ok: queued as 3D455D7B01

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: jkj.exe PID: 5768 Parent PID: 5668

General

Start time:	20:11:08
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\jkj.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\jkj.exe'
Imagebase:	0xec0000
File size:	888832 bytes
MD5 hash:	31A54357DDFA0FAE7192A6ED14894B65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.239111016.0000000003281000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.242218894.0000000004289000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: jkj.exe PID: 6008 Parent PID: 5768

General

Start time:	20:11:11
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\jkj.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\jkj.exe
Imagebase:	0x40000
File size:	888832 bytes
MD5 hash:	31A54357DDFA0FAE7192A6ED14894B65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: jkj.exe PID: 6092 Parent PID: 5768

General

Start time:	20:11:12
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\jkj.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\jkj.exe
Imagebase:	0x980000
File size:	888832 bytes
MD5 hash:	31A54357DDFA0FAE7192A6ED14894B65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.496080669.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.499467282.0000000002D01000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: jkj.exe PID: 5768 Parent PID: 5668 jkj.exeCOMMON

Executed Functions

Function 0312DB29, Relevance: 1.7, APIs: 1, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11b73eafeb62322401e643dd1744e21d6eb9a674f604ea2cbe9148196655cd1a
Instruction ID: a3acc7f2a398ecb5be8047e32473a80b543cbd3e196d637707d8bf08892a3a8f
Opcode Fuzzy Hash: 11b73eafeb62322401e643dd1744e21d6eb9a674f604ea2cbe9148196655cd1a
Instruction Fuzzy Hash: E2919D71C093989FCF06CFA4D854ACDBFB1EF4A300F19809AE858AB262D3359859DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0312BBB8, Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0312BE0E

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8ef4d97fc94da2ebc5ffc9af3074c3c076bc54f5100ac454283d685fdb1ce9f0
Instruction ID: 49653600dedcfadc0439f7661f8e2fa868060107d2c42ca2951922b043f6036f
Opcode Fuzzy Hash: 8ef4d97fc94da2ebc5ffc9af3074c3c076bc54f5100ac454283d685fdb1ce9f0
Instruction Fuzzy Hash: A6814570A08B158FDB24CF2AC44075ABBF5FF88214F048A2DD54ADBA50DB35E865CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0312B214, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0312DD8A

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3703d958e478085d6a698d507f54b6dcced87854e3153fdc8ef0d28e0de11cdc
Instruction ID: 60509dd94cb8ee6a0b05a5e7d13528c3bec191b93e99a44697eabba7475c426c
Opcode Fuzzy Hash: 3703d958e478085d6a698d507f54b6dcced87854e3153fdc8ef0d28e0de11cdc
Instruction Fuzzy Hash: 9651D0B1D00358EFDB14CF99D984ADEBFB5BF48314F24852AE819AB250D7709895CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0312DC6D, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0312DD8A

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8a00ac4374f40b76cb3e3b5827a5d7ef0b7193d1b897deff129077d5dbcb03fc
Instruction ID: a7f5457cbc994d30b7fb69351382784bd547c0bbb4b7d2e299b4c3092185349a
Opcode Fuzzy Hash: 8a00ac4374f40b76cb3e3b5827a5d7ef0b7193d1b897deff129077d5dbcb03fc
Instruction Fuzzy Hash: BA51DDB1D00359EFDB14CF99D884ADEBFB5BF88310F24812AE819AB250D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03126D41, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03126E3F

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4cba4c5202f3db282ce27a7275300dd7a75534af41ed95787defe90de0b744d6
Instruction ID: e8963806350a7b56d6995d1d2655d25704bcca232c886479f0e29ec99fcd490c
Opcode Fuzzy Hash: 4cba4c5202f3db282ce27a7275300dd7a75534af41ed95787defe90de0b744d6
Instruction Fuzzy Hash: E4415876900258AFCF01CF99D944AEEBFF5EB49320F04805AE944A7260D7759964DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 03126E77, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03126E3F

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b403b7056d3fe3235c3561e6d79be850150cd8d17740a881b8f889922bdf812c
Instruction ID: 12bac6ccaea0c8d948a22988ea6f02fb50b35addd4720e9cf730e74341bb6430
Opcode Fuzzy Hash: b403b7056d3fe3235c3561e6d79be850150cd8d17740a881b8f889922bdf812c
Instruction Fuzzy Hash: C7312179A45340DFF709DB68E49976EBBA1F78C302F54802AE9418B385EF784844DB22

Uniqueness

Uniqueness Score: -1.00%

Function 03126DB0, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03126E3F

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9834932beacbc739bff20a169d473449ee9be0f214f64eee3c9e6a6a23447689
Instruction ID: 4efe71c7503ad57f6667ddf9e319ddb285501af85bd60c5fa3db1e35a3d40e7f
Opcode Fuzzy Hash: 9834932beacbc739bff20a169d473449ee9be0f214f64eee3c9e6a6a23447689
Instruction Fuzzy Hash: 1721E3B5904258AFDB10CFA9D984ADEBBF8FB48324F14841AE914B7350D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03126DB8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03126E3F

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 785cf116bd1b0b7a391dda9771b82c167b84ae1a0b6b12462c421b7107c750d8
Instruction ID: 57197474c5198beabebb9074df2dba2921178c565f1b826b4c9c7e642eab874a
Opcode Fuzzy Hash: 785cf116bd1b0b7a391dda9771b82c167b84ae1a0b6b12462c421b7107c750d8
Instruction Fuzzy Hash: D921E4B59002589FDB10CFA9D984ADEBFF8EB48324F14841AE914B3350D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0312B0D8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0312BE89,00000800,00000000,00000000), ref: 0312C09A

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 00449f46b62873a8d9b6b050dfb552656dc15e6906d590b4e5fa133fc2d2e922
Instruction ID: 7c17ae10139e6749ee6f8942eb451f2622c9ac34587a86729c989f8bed490f4f
Opcode Fuzzy Hash: 00449f46b62873a8d9b6b050dfb552656dc15e6906d590b4e5fa133fc2d2e922
Instruction Fuzzy Hash: 1B1103B6904218DFCB14CF9AD444BDEFBF4EB88354F04842AE915B7200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0312C028, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0312BE89,00000800,00000000,00000000), ref: 0312C09A

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ee3cb7f2236fce4b4ccb18b2e78e2a6a15b13d9f960e0caabc3a08d9751786e1
Instruction ID: e4984e8831ae24b8393fba87e3530925867d0cb77195429a03c5cb5a62025a64
Opcode Fuzzy Hash: ee3cb7f2236fce4b4ccb18b2e78e2a6a15b13d9f960e0caabc3a08d9751786e1
Instruction Fuzzy Hash: 8E1144B68003099FCB14CF9AC848BDEFBF4EB88364F14841AD915B7200C375A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0312BDA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0312BE0E

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 552a92062fc0326a18df1aedd0f01023a4fca14ce67d0f5a11b49e21e0fea49b
Instruction ID: cc1749b4e1e2ad4b6b1076af7ae3911677888af5027eb671aaed269685cc126b
Opcode Fuzzy Hash: 552a92062fc0326a18df1aedd0f01023a4fca14ce67d0f5a11b49e21e0fea49b
Instruction Fuzzy Hash: C511DCB6D046598FCB10CF9AD844ADEFBF4EB88224F14842AD929B7600D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0312DEC0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0312DF1D

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 4f637abe4fc3bfd15ce5785f45413e17a8e9ab69f798c3eebbd52aa5f1f0ed9e
Instruction ID: 8edc6dc714492729f2da74610577e0221c6054805283f141ab8fe2e26bffaa47
Opcode Fuzzy Hash: 4f637abe4fc3bfd15ce5785f45413e17a8e9ab69f798c3eebbd52aa5f1f0ed9e
Instruction Fuzzy Hash: 2E1112B58002489FDB10CF9AD488BDEFBF8EB88324F14841AE919B7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0312DEB9, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0312DF1D

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 7b05d06c81a480eebc40cd56ba64aeefe14108a0c3f0934f64d547f5e08f3117
Instruction ID: ff409c088ac46787a3b09e695d4781842e5b5fd64f6565ed424a64ffe5b9c15c
Opcode Fuzzy Hash: 7b05d06c81a480eebc40cd56ba64aeefe14108a0c3f0934f64d547f5e08f3117
Instruction Fuzzy Hash: 371112B5904249CFDB10CF99D584BDEBBF4EB88324F14881AE969B7700C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0174D4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238682507.000000000174D000.00000040.00000001.sdmp, Offset: 0174D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59c805284a942ad2ad368bd9a377029f9fbbb2aca3303fb7fd2eefd6b80171c
Instruction ID: a639a136775cc79dfb5445468e926755a65558bea86ff4943ad00a7efb72a0da
Opcode Fuzzy Hash: b59c805284a942ad2ad368bd9a377029f9fbbb2aca3303fb7fd2eefd6b80171c
Instruction Fuzzy Hash: 932125B1608204DFDB21CF94D9C0B26FB65FB98328F3485A9E9494B206C736D856DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0175D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238738151.000000000175D000.00000040.00000001.sdmp, Offset: 0175D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd64b152438cb99b3eb0c90fa39d76049815d6e5a002ab0516a91fcd3365fb5b
Instruction ID: 52350b8188fcbb8e34f8164a554ba3de0ce4a0c5f66f2d9f8af18bffdbc74b36
Opcode Fuzzy Hash: dd64b152438cb99b3eb0c90fa39d76049815d6e5a002ab0516a91fcd3365fb5b
Instruction Fuzzy Hash: 8E2103B1608244DFDB61DF54D9C0B26FB61EB88254F20C5A9DD0D4B246C3B6D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0175D005, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238738151.000000000175D000.00000040.00000001.sdmp, Offset: 0175D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd78d8b4a89b39c0fdc6a1a8c67e98b5b03e2d958e2445125c230d45ba4cee1
Instruction ID: 791a834936551032892f7dcfd527696cdcad90c559f2d853bfae3b77936423e5
Opcode Fuzzy Hash: acd78d8b4a89b39c0fdc6a1a8c67e98b5b03e2d958e2445125c230d45ba4cee1
Instruction Fuzzy Hash: B321BE715083849FCB12CF24D994B15BF71EB46214F28C5EAD8498F2A7C37AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0174D4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238682507.000000000174D000.00000040.00000001.sdmp, Offset: 0174D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af74d119f5eccf0fc27d3fcee38edaf6600dc4b2768a2458d5ce5b639dbddb0b
Instruction ID: 924f29d85b26ea86c57a55a5607ac7595365d6c6296183d5d8179b6575d6af71
Opcode Fuzzy Hash: af74d119f5eccf0fc27d3fcee38edaf6600dc4b2768a2458d5ce5b639dbddb0b
Instruction Fuzzy Hash: 8B11B176504280CFCF12CF54D5C4B16FF71FB94324F2486A9D8494B656C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0174D749, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238682507.000000000174D000.00000040.00000001.sdmp, Offset: 0174D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecb5bd56bda7ad2868003668e520c59cbfdba7538935dfb39e5715fdfbcc8af
Instruction ID: 50aa6b2a408dc00f8fd7deecaf644a0a5beccbee023280f2ea593a5f5ccf6ed8
Opcode Fuzzy Hash: 0ecb5bd56bda7ad2868003668e520c59cbfdba7538935dfb39e5715fdfbcc8af
Instruction Fuzzy Hash: 3D01F77100C3849BEB328A96CCC4766FBD8EF51374F08859AEA444B247C3789444C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0174D748, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238682507.000000000174D000.00000040.00000001.sdmp, Offset: 0174D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 371300289f7266d27807a69600f79c43034d4bce439e00a4f8f9420b780be6b6
Instruction ID: bc2d212cd2e81af2a49ebbae48e80bb9655c399cf1e86b4ea1a8b4f23549ec65
Opcode Fuzzy Hash: 371300289f7266d27807a69600f79c43034d4bce439e00a4f8f9420b780be6b6
Instruction Fuzzy Hash: CCF06272408784AFEB218A5ADCC4B66FF98EB51734F18C45AED485B287C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0312C2B0, Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93030f4c67946cef0e89fe026f56b2169b155fe62c975cb219dd0c8f8ad6457b
Instruction ID: a16967468647b2cf8c3fca639be1dc48ee5f84f480133f22035b1ab13f689861
Opcode Fuzzy Hash: 93030f4c67946cef0e89fe026f56b2169b155fe62c975cb219dd0c8f8ad6457b
Instruction Fuzzy Hash: 17525BB1500746CFD718EF24E4C85997BB2FB4A328F915208D2635B6D8D3B865CACFA4

Uniqueness

Uniqueness Score: -1.00%

Function 03129990, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.238973308.0000000003120000.00000040.00000001.sdmp, Offset: 03120000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e407da19e7284a5449c0a1bfa15759cb83541493d68389318eb3e0a2e06917cd
Instruction ID: eee20f64f4c7c1021a1981c683629835d44058a98bc6532e0ebe8856e6e1ffdf
Opcode Fuzzy Hash: e407da19e7284a5449c0a1bfa15759cb83541493d68389318eb3e0a2e06917cd
Instruction Fuzzy Hash: 01A17236E10729CFCF05DFA5C8845DDBBB2FF89300B15856AE905BB221EB31A965CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: jkj.exe PID: 6092 Parent PID: 5768 jkj.exeCOMMON

Executed Functions

Function 00F2B498, Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.497246980.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a294b55f659f6693617842a2c6ffc25dc49c00fae905aba6127e7e9fa4b74341
Instruction ID: 980bdb58f0d47156b1cc96de30ed2e714a3224f50c3896d0262dbebca4fbf574
Opcode Fuzzy Hash: a294b55f659f6693617842a2c6ffc25dc49c00fae905aba6127e7e9fa4b74341
Instruction Fuzzy Hash: 43F16B30E00219CFDB10DFA8D844BADBBF1FF88314F158569E909AB265DBB0E985DB41

Uniqueness

Uniqueness Score: -1.00%

Function 02CC6940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 02CC69A0
GetCurrentThread.KERNEL32 ref: 02CC69DD
GetCurrentProcess.KERNEL32 ref: 02CC6A1A
GetCurrentThreadId.KERNEL32 ref: 02CC6A73

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0a8ccee987a31b0ae1bc18ce4650e8b6758869398546a9777d94f9245e330340
Instruction ID: bc5de077ec8fa06e9d17b56ba25308a60585701745574d393f0e60bb8fc7e60f
Opcode Fuzzy Hash: 0a8ccee987a31b0ae1bc18ce4650e8b6758869398546a9777d94f9245e330340
Instruction Fuzzy Hash: 9F5156B0A143488FDB14CFA9D688B9EBBF5EF88314F20845DE409A7390DB749984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02CC3D42, Relevance: 1.8, APIs: 1, Instructions: 302COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CC4116

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d5df7b1b3aac409e3e4d58e7cef10184be3482ad2f4c85cf828bba6ac22ae445
Instruction ID: a784aa55452077afddc33fda7c08f6c0dbe4d6fd7677f2a511e9741e50beb580
Opcode Fuzzy Hash: d5df7b1b3aac409e3e4d58e7cef10184be3482ad2f4c85cf828bba6ac22ae445
Instruction Fuzzy Hash: 84C18B70A047458FCB14EF79D48466EBBF2FF88204B2489AED41ADB794DB34E9058F90

Uniqueness

Uniqueness Score: -1.00%

Function 012CDE58, Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.498984504.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05da7b86d2886342266e6911f16437cff7abbd786cfda931c8bf4d5992c7529
Instruction ID: efcbf47fa1e42ea05a769ea8f8adbda8cabe623a5b67bedc2d4b1370a9a27145
Opcode Fuzzy Hash: e05da7b86d2886342266e6911f16437cff7abbd786cfda931c8bf4d5992c7529
Instruction Fuzzy Hash: E1413A71E1835A8FCB00DFA9C8006EEBBF0AF85210F05866ED608E7241DB749885CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02CC5084, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02CC51A2

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c5090e8bf03a03f1dbdc87e9fda00d30230821f8b3b3ce77e4ef78b762d1ab70
Instruction ID: aed966a17f01b641e4a2853517c8c5a9135f160d21a8ab59fd722dac58573502
Opcode Fuzzy Hash: c5090e8bf03a03f1dbdc87e9fda00d30230821f8b3b3ce77e4ef78b762d1ab70
Instruction Fuzzy Hash: 8C51CDB1D103089FDB14CF99C984ADEBBB5BF88354F64812AE819AB210D774A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02CC5090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02CC51A2

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9a747fa9ed70bf50c00aadae9180dd4d7c7b3a05fd44141f51b4385b62011d8e
Instruction ID: 155050bbee7966b37ce1ba9ac6fc7da4a98cc9ce41aa27eb5dc0a479237358bf
Opcode Fuzzy Hash: 9a747fa9ed70bf50c00aadae9180dd4d7c7b3a05fd44141f51b4385b62011d8e
Instruction Fuzzy Hash: FA41C0B1D003489FDF14CF99C984ADEBBB5BF88354F64812AE819AB310D774A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02CC779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02CC7F09

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: bd289cb262e5ce095515b12483e585579b9cb0484ed428eb72fdb983836f4738
Instruction ID: a88d54773f7fa26e562a47adf67129ab2f7d4f4bdbbb5a67e16bc354c3053054
Opcode Fuzzy Hash: bd289cb262e5ce095515b12483e585579b9cb0484ed428eb72fdb983836f4738
Instruction Fuzzy Hash: 374149B5A003458FDB04CF99C488AAAFBF9FF88314F25849CE419AB310D771A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02CCC189, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02CCC212

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 9d7877e3fa333afa41071f01bc6e01706efcaf14d4249ebf105b7e1c966dc65d
Instruction ID: f101a73d937bbe9600d79f317d49d6bd60225d23cb3e78c12669ec3dd63fd545
Opcode Fuzzy Hash: 9d7877e3fa333afa41071f01bc6e01706efcaf14d4249ebf105b7e1c966dc65d
Instruction Fuzzy Hash: 893190758063848EDB50DFA5E94939EBFF0AB55318F14805AD488E7382CB795A48CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02CC6B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02CC6BEF

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 552f60c8df54d0dbccad8ce4001367a56b05a92d54323b2a15691c4ac75fc5ff
Instruction ID: d3b4a830e78dba91a401bff20e52d6dc4397b3edb383b682d060c131136f01e6
Opcode Fuzzy Hash: 552f60c8df54d0dbccad8ce4001367a56b05a92d54323b2a15691c4ac75fc5ff
Instruction Fuzzy Hash: 3421F5B59042489FDB10CF99D984ADEBBF8FB48324F14841AE914A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02CC6B62, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02CC6BEF

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 18f2e8ea4fecb5d3aba4fba0d9e223ee2a8256d2635478020fe2f67531ada517
Instruction ID: 301d5faa6a5029fff7874b3d5e511ed80b1589a660ec61a337e7e04af881d9e7
Opcode Fuzzy Hash: 18f2e8ea4fecb5d3aba4fba0d9e223ee2a8256d2635478020fe2f67531ada517
Instruction Fuzzy Hash: 6721E4B5D012489FDB00CFA9D984AEEBBF4FB48314F15841AE915B7310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012CC9A0, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,012CDEAA), ref: 012CDF97

Memory Dump Source

Source File: 00000002.00000002.498984504.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 27a7d0ecb3fb9bee752c7c89655a76bc7d082dfbbc604d22803c723d5d9bad48
Instruction ID: db02bfab99592575178aa54566f44c72fc3f20d10a882b99406b4e569a93375a
Opcode Fuzzy Hash: 27a7d0ecb3fb9bee752c7c89655a76bc7d082dfbbc604d22803c723d5d9bad48
Instruction Fuzzy Hash: 021133B1C1865A9FCB00CF9AC5447AEFBB4FB48624F01852AE918B7200D378A945CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F265D4, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,00000000,?,00F27819,00000800), ref: 00F278AA

Memory Dump Source

Source File: 00000002.00000002.497246980.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7f26cae9a4853342e3e88b4ede91b66703fc90c4c01ec780a04abfcee4fbc91a
Instruction ID: bded64004f9d510a84180c8314efa18280bc1f36d6362b3a9d7db3b8548f28fe
Opcode Fuzzy Hash: 7f26cae9a4853342e3e88b4ede91b66703fc90c4c01ec780a04abfcee4fbc91a
Instruction Fuzzy Hash: AE11F4B2D043188BCB10DF9AD848ADEBBF4EB88364F14842AE515A7200C3B4A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012CDF28, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,012CDEAA), ref: 012CDF97

Memory Dump Source

Source File: 00000002.00000002.498984504.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2afd5dd165cc62c5dde229bd579896c99124f41c506d395c8060a637596d9169
Instruction ID: d3b36f3458cc5c7a73674a91139cf83c6ea99a986b59cb52e5e2d9ba3e4a3041
Opcode Fuzzy Hash: 2afd5dd165cc62c5dde229bd579896c99124f41c506d395c8060a637596d9169
Instruction Fuzzy Hash: A81133B1C0461A9FCB00CF9AC544BDEFBB4BB48324F01812AE918B7240D378A955CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 02CCC198, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02CCC212

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 93288f3d2e79860917a3f8284fd94a3753a69b0e1aaa52917b416e2f74b0198b
Instruction ID: 574794d5b8f6403801ea226208db9587ec30186f867484399ad09ab34a27506b
Opcode Fuzzy Hash: 93288f3d2e79860917a3f8284fd94a3753a69b0e1aaa52917b416e2f74b0198b
Instruction Fuzzy Hash: A41156719013058FDB50EFAAD94879EBBF4EB88314F20852AD409F7740DB786A44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F27839, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,00000000,?,00F27819,00000800), ref: 00F278AA

Memory Dump Source

Source File: 00000002.00000002.497246980.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 967d6fab4d44bbed3c58747d2dede3b085fc2935fbb1bf8f672ebc0e95709f6f
Instruction ID: 915fc613e98d9bf6e491fc9876619ba26fe695dff5d5d400a9a06023823fa2a0
Opcode Fuzzy Hash: 967d6fab4d44bbed3c58747d2dede3b085fc2935fbb1bf8f672ebc0e95709f6f
Instruction Fuzzy Hash: 7E1117B2D053488FCB10CF99D848ADEFBF4EB88364F14842ED815A7200C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02CC3300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CC4116

Memory Dump Source

Source File: 00000002.00000002.499370368.0000000002CC0000.00000040.00000001.sdmp, Offset: 02CC0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 39ac5cedaea3dea0ff60034bdb0a23e7df07e73644dd4009ecb2c8d99fda2006
Instruction ID: 8e7564bc9be3bbe9159a0d441921437a961fd4d5aac868ce9fbd47acb134d4ae
Opcode Fuzzy Hash: 39ac5cedaea3dea0ff60034bdb0a23e7df07e73644dd4009ecb2c8d99fda2006
Instruction Fuzzy Hash: CB11F0B19046498BDB24CF9AD844BDEBBF4EB89224F11842ED829B7700D374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A3C0, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00F2B2D5

Memory Dump Source

Source File: 00000002.00000002.497246980.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: fd7a55e8f68dc0ff2d50674d05a5c160022357866f23de356d5a0700e8dc44da
Instruction ID: 72fbc298167f9c2ceddc883920d0235d69b228df7b60d120fa0b8ab55e540325
Opcode Fuzzy Hash: fd7a55e8f68dc0ff2d50674d05a5c160022357866f23de356d5a0700e8dc44da
Instruction Fuzzy Hash: 2411FEB1904759CFCB10CF9AE888B9EBBF4EB48324F108459E919A7640D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F2B278, Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00F2B2D5

Memory Dump Source

Source File: 00000002.00000002.497246980.0000000000F20000.00000040.00000001.sdmp, Offset: 00F20000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 14c556c0c9f29680f3a6c375074ff6d31b9c19de5f895c8e924fe169fd4d37d3
Instruction ID: 0ba095867d3ee49e820c35f95858519318e6054854e4352991576a5b89441f34
Opcode Fuzzy Hash: 14c556c0c9f29680f3a6c375074ff6d31b9c19de5f895c8e924fe169fd4d37d3
Instruction Fuzzy Hash: 581145B0908348CFCB10CF99D488BDEBBF4EB48364F10845AD518A7310C378A944CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02ADD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.499186111.0000000002ADD000.00000040.00000001.sdmp, Offset: 02ADD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2a2a6886770573ec3008a2de9491bfa03fac78eaa659b960c9ae215d3f5e24
Instruction ID: 24f0f2e7edd9bbc5f6b406758e66ce72c7099f2b833fa15ec3092627dd7e81e5
Opcode Fuzzy Hash: dd2a2a6886770573ec3008a2de9491bfa03fac78eaa659b960c9ae215d3f5e24
Instruction Fuzzy Hash: 8B2137B2608604DFDB10DF14D9C0B26BB65FBC8318F64C569D80B4B246CB36D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02ADD005, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.499186111.0000000002ADD000.00000040.00000001.sdmp, Offset: 02ADD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6bd5461b0c272402c727190c015ad2448417354620a0ba2a77970776a8b6ee
Instruction ID: 898101a8a6c07d16af5fe43dcc044ac5be49078a4fce584d5f851d016f36281b
Opcode Fuzzy Hash: 2c6bd5461b0c272402c727190c015ad2448417354620a0ba2a77970776a8b6ee
Instruction Fuzzy Hash: 5921A4755097C08FCB12CF20D9D4B15BF71EB86214F28C5DAD84A8B697C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report jkj.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre