Play interactive tour

Edit tour

Analysis Report lT2TTQACRLGKK8w.exe

Overview

General Information

Sample Name:	lT2TTQACRLGKK8w.exe
Analysis ID:	404238
MD5:	8c2987ef25996649be1a2d6f2150a30d
SHA1:	2b8425dbc57e93fbb2a9bf6d45a491ccc15f0d5d
SHA256:	b1f7ca6e53ff7dd757a49539f5e5c18bfeabbe24b06270ce08df45f1c2efffff
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

lT2TTQACRLGKK8w.exe (PID: 6980 cmdline: 'C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe' MD5: 8C2987EF25996649BE1A2D6F2150A30D)

lT2TTQACRLGKK8w.exe (PID: 7092 cmdline: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe MD5: 8C2987EF25996649BE1A2D6F2150A30D)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "office3@iykmoreentrprise.orgrwkWCM328mail.iykmoreentrprise.org"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: lT2TTQACRLGKK8w.exe PID: 6980	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: lT2TTQACRLGKK8w.exe PID: 6980	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "office3@iykmoreentrprise.orgrwkWCM328mail.iykmoreentrprise.org"}

Multi AV Scanner detection for submitted file

Show sources

Source: lT2TTQACRLGKK8w.exe

ReversingLabs: Detection: 19%

Machine Learning detection for sample

Show sources

Source: lT2TTQACRLGKK8w.exe

Joe Sandbox ML: detected

Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: lT2TTQACRLGKK8w.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: lT2TTQACRLGKK8w.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0B978380
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0B979318
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0B978371
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0B979010
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0B9784AC

Source: global traffic

TCP traffic: 192.168.2.4:49770 -> 66.70.204.222:587

Source: Joe Sandbox View

IP Address: 66.70.204.222 66.70.204.222

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: global traffic

TCP traffic: 192.168.2.4:49770 -> 66.70.204.222:587

Source: unknown

DNS traffic detected: queries for: mail.iykmoreentrprise.org

Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	String found in binary or memory: http://NdOlex.com
Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912109224.0000000000F03000.00000004.00000020.sdmp	String found in binary or memory: http://go.microsoft.cz
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912804837.0000000002D88000.00000004.00000001.sdmp	String found in binary or memory: http://iykmoreentrprise.org
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912804837.0000000002D88000.00000004.00000001.sdmp	String found in binary or memory: http://mail.iykmoreentrprise.org
Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655099093.0000000003121000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lT2TTQACRLGKK8w.exe	String found in binary or memory: http://vbcity.com/forums/t/51894.aspx
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: lT2TTQACRLGKK8w.exe	String found in binary or memory: https://github.com/MrCylops
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912725062.0000000002D32000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912880410.0000000002DB5000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912771188.0000000002D7E000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912865775.0000000002DAD000.00000004.00000001.sdmp	String found in binary or memory: https://wl0H8jlTH4n9kj.org
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b56ED34DBu002dB13Du002d4E78u002dAB1Eu002dFFE9EC311CA5u007d/C4710566u002dA0DFu002d4617u002dB65Cu002d8842CDFCB5A1.cs

Large array initialization: .cctor: array initializer size 11967

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_00CBA1D3	0_2_00CBA1D3
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0162C2B0	0_2_0162C2B0
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_01629990	0_2_01629990
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B978BF8	0_2_0B978BF8
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B977960	0_2_0B977960
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B9762E8	0_2_0B9762E8
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B9709A8	0_2_0B9709A8
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B971918	0_2_0B971918
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B971928	0_2_0B971928
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B970944	0_2_0B970944
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B970FEC	0_2_0B970FEC
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B975F18	0_2_0B975F18
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B975F28	0_2_0B975F28
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B971E51	0_2_0B971E51
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B971E60	0_2_0B971E60
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B973399	0_2_0B973399
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B9733A8	0_2_0B9733A8
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B9762D8	0_2_0B9762D8
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B972180	0_2_0B972180
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B972171	0_2_0B972171
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B976589	0_2_0B976589
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B976523	0_2_0B976523
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B974410	0_2_0B974410
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B974400	0_2_0B974400
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B97242B	0_2_0B97242B
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_00CBA42F	0_2_00CBA42F
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_006FA1D3	2_2_006FA1D3
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00C88060	2_2_00C88060
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00C81B50	2_2_00C81B50
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00C84310	2_2_00C84310
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00C866E8	2_2_00C866E8
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00C89D58	2_2_00C89D58
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00C8E720	2_2_00C8E720
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00EC46A0	2_2_00EC46A0
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00EC4690	2_2_00EC4690
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_00EC4672	2_2_00EC4672
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_2_006FA42F	2_2_006FA42F

Source: lT2TTQACRLGKK8w.exe, 00000000.00000000.645706234.0000000000D5C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUnauthorizedAccessException.exe> vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655099093.0000000003121000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655099093.0000000003121000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBEpnzqbDkEzvjXIwxhKwj.exe4 vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.659378273.00000000063B0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameBEpnzqbDkEzvjXIwxhKwj.exe4 vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.911283055.000000000079C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUnauthorizedAccessException.exe> vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.911346617.0000000000B38000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912036273.0000000000ED8000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.915794812.0000000006330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs lT2TTQACRLGKK8w.exe
Source: lT2TTQACRLGKK8w.exe	Binary or memory string: OriginalFilenameUnauthorizedAccessException.exe> vs lT2TTQACRLGKK8w.exe

Source: lT2TTQACRLGKK8w.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: lT2TTQACRLGKK8w.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/1

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lT2TTQACRLGKK8w.exe.log

Jump to behavior

Source: lT2TTQACRLGKK8w.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: lT2TTQACRLGKK8w.exe

ReversingLabs: Detection: 19%

Source: unknown	Process created: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe 'C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe'
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process created: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process created: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: lT2TTQACRLGKK8w.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: lT2TTQACRLGKK8w.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: lT2TTQACRLGKK8w.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: lT2TTQACRLGKK8w.exe

Static PE information: 0x9913AE82 [Sat May 20 13:58:26 2051 UTC]

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 0_2_0B975859 push 1A34BA5Ch; ret	0_2_0B975865
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_3_00F656CB push ds; retf	2_3_00F658D9
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_3_00F66DB1 push edi; retf	2_3_00F66DB2
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_3_00F649BB pushad ; retf	2_3_00F649BC
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_3_00F690BB push ss; ret	2_3_00F69119
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Code function: 2_3_00F68FAB push es; iretd	2_3_00F6902F

Source: initial sample

Static PE information: section name: .text entropy: 7.4929930225

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 6980, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Window / User API: threadDelayed 1865			Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Window / User API: threadDelayed 7968			Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 6984	Thread sleep time: -101227s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 7000	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 3120	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 4984	Thread sleep count: 1865 > 30	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 4984	Thread sleep count: 7968 > 30	Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Thread delayed: delay time: 101227	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869177633.0000000000F5B000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllce\H
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: lT2TTQACRLGKK8w.exe	Binary or memory string: Hyper-V RAW
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Code function: 2_2_00C88060 LdrInitializeThunk,

2_2_00C88060

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

.NET source code references suspicious native API functions

Show sources

Source: lT2TTQACRLGKK8w.exe, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: lT2TTQACRLGKK8w.exe, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 0.2.lT2TTQACRLGKK8w.exe.cb0000.0.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 0.2.lT2TTQACRLGKK8w.exe.cb0000.0.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 0.0.lT2TTQACRLGKK8w.exe.cb0000.0.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 0.0.lT2TTQACRLGKK8w.exe.cb0000.0.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, A/b2.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Source: 2.0.lT2TTQACRLGKK8w.exe.6f0000.0.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
Source: 2.0.lT2TTQACRLGKK8w.exe.6f0000.0.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 2.2.lT2TTQACRLGKK8w.exe.6f0000.1.unpack, ProcessClass.cs	Reference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
Source: 2.2.lT2TTQACRLGKK8w.exe.6f0000.1.unpack, Memory.cs	Reference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Memory written: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Process created: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Jump to behavior

Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912309734.0000000001490000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912309734.0000000001490000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912309734.0000000001490000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912309734.0000000001490000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092, type: MEMORY
Source: Yara match	File source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092, type: MEMORY
Source: Yara match	File source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
lT2TTQACRLGKK8w.exe	19%	ReversingLabs	ByteCode-MSIL.Trojan.Injuke
lT2TTQACRLGKK8w.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
mail.iykmoreentrprise.org	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://iykmoreentrprise.org	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://go.microsoft.cz	0%	Avira URL Cloud	safe
https://wl0H8jlTH4n9kj.org	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://NdOlex.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://mail.iykmoreentrprise.org	0%	Avira URL Cloud	safe
https://api.ipify.org%$	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
iykmoreentrprise.org	66.70.204.222	true	true		unknown
mail.iykmoreentrprise.org	unknown	unknown	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://iykmoreentrprise.org	lT2TTQACRLGKK8w.exe, 00000002.00000002.912804837.0000000002D88000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNS	lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://vbcity.com/forums/t/51894.aspx	lT2TTQACRLGKK8w.exe	false		high
http://cps.letsencrypt.org0	lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://go.microsoft.cz	lT2TTQACRLGKK8w.exe, 00000002.00000002.912109224.0000000000F03000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://wl0H8jlTH4n9kj.org	lT2TTQACRLGKK8w.exe, 00000002.00000002.912725062.0000000002D32000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912880410.0000000002DB5000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912771188.0000000002D7E000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912865775.0000000002DAD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.ipify.org%GETMozilla/5.0	lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://NdOlex.com	lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	lT2TTQACRLGKK8w.exe, 00000000.00000002.655099093.0000000003121000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	lT2TTQACRLGKK8w.exe, 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp	false		high
http://mail.iykmoreentrprise.org	lT2TTQACRLGKK8w.exe, 00000002.00000002.912804837.0000000002D88000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%$	lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://cps.root-x1.letsencrypt.org0	lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://r3.i.lencr.org/0	lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/MrCylops	lT2TTQACRLGKK8w.exe	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.70.204.222	iykmoreentrprise.org	Canada		16276	OVHFR	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	404238
Start date:	04.05.2021
Start time:	20:36:06
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	lT2TTQACRLGKK8w.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 21
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Excluded IPs from analysis (whitelisted): 104.43.139.144, 13.88.21.125, 13.64.90.137, 40.88.32.150, 52.147.198.201, 20.82.210.154, 92.122.213.194, 92.122.213.247, 52.155.217.156, 20.54.26.129, 40.64.101.146, 2.20.142.209, 2.20.142.210, 20.50.102.62 Excluded domains from analysis (whitelisted): mw1eap.displaycatalog.md.mp.microsoft.com.akadns.net, au.download.windowsupdate.com.edgesuite.net, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, arc.msn.com.nsatc.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, consumerrp-displaycatalog-aks2eap-uswest.md.mp.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, displaycatalog-uswesteap.md.mp.microsoft.com.akadns.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:36:55	API Interceptor	816x Sleep call for process: lT2TTQACRLGKK8w.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
66.70.204.222	pd9EeXdsQtNb3dQ.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.MSIL_Troj.ASI.genEldorado.27642.exe	Get hash	malicious	Browse
	MZyeln5mSFOjxMx.exe	Get hash	malicious	Browse
	FFrIJMwrI9cxeIZ.exe	Get hash	malicious	Browse
	cljz48xwqb2VSBN.exe	Get hash	malicious	Browse
	QTY 98657 RFQ MANDATE 020521.0003YDK.exe	Get hash	malicious	Browse
	foakTEjUOvL9nBY.exe	Get hash	malicious	Browse
	n4QstFh7YkjVcrU.exe	Get hash	malicious	Browse
	AVuOP2vLzIMRG88.exe	Get hash	malicious	Browse
	316e3796_by_Libranalysis.exe	Get hash	malicious	Browse
	GQTY 98657 RFQ MANDATE 28421.02AWYD.exe	Get hash	malicious	Browse
	VJNPltkyHyI3CCo.exe	Get hash	malicious	Browse
	0L2qr7kJMh40sxq.exe	Get hash	malicious	Browse
	ApuE9QrdQxe7Um6.exe	Get hash	malicious	Browse
	77iET1jNLJyV8ez.exe	Get hash	malicious	Browse
	bOkrXdoYekZPyWI.exe	Get hash	malicious	Browse
	ayZYB5SkqMPA06M.exe	Get hash	malicious	Browse
	fyZ6iHys7ClIHFR.exe	Get hash	malicious	Browse
	uMLNLd9kgPez84h.exe	Get hash	malicious	Browse
	YQfInBo2DDpDfIX.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	165395_BHU.msi	Get hash	malicious	Browse	158.69.144.121
	jEEGrwHl1H.exe	Get hash	malicious	Browse	51.195.61.169
	6R9cyNLikC.exe	Get hash	malicious	Browse	51.195.61.169
	c862293a_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	29ec7ed7_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	c862293a_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	29ec7ed7_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	37d2a6e3_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	0f003adb_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	a5a88fbb_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	d2d35294_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	58917039_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	636f06a6_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	37d2a6e3_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	0f003adb_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	a5a88fbb_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	636f06a6_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	d2d35294_by_Libranalysis.dll	Get hash	malicious	Browse	167.114.113.13
	Outstanding-Debt-610716193-05042021.xlsm	Get hash	malicious	Browse	51.89.73.159
	Outstanding-Debt-1840996632-05042021.xlsm	Get hash	malicious	Browse	51.89.73.159

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lT2TTQACRLGKK8w.exe.log Download File
Process:	C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.481252144870754
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	lT2TTQACRLGKK8w.exe
File size:	694272
MD5:	8c2987ef25996649be1a2d6f2150a30d
SHA1:	2b8425dbc57e93fbb2a9bf6d45a491ccc15f0d5d
SHA256:	b1f7ca6e53ff7dd757a49539f5e5c18bfeabbe24b06270ce08df45f1c2efffff
SHA512:	381ad7adbbe661b1bf4e58a94c8b885ad2f94cdb994dede6f94025c6587218653cb79c1fa0b8ecb9c8e8682c2cafb64d3247aa5d4cb99f883dbb44ed1d96e0bb
SSDEEP:	12288:Yt/TBPnNHKManc2gOAQLJtQYxMxJrw9a76Yij+fKFKATuQyrz9+srtgO3pP2:YqfQYx8J09uk6fKEDp1L5P2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................P.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4aaa12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x9913AE82 [Sat May 20 13:58:26 2051 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaa9c0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x60c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xaa9a4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa8a18	0xa8c00	False	0.79830150463	data	7.4929930225	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x60c	0x800	False	0.32958984375	data	3.4332919236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xac090	0x37c	data
RT_MANIFEST	0xac41c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	UnauthorizedAccessException.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	StarEggControl
ProductVersion	1.0.0.0
FileDescription	StarEggControl
OriginalFilename	UnauthorizedAccessException.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 20:38:36.071686983 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:36.201476097 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:36.201631069 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:36.358669043 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:36.359447002 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:36.492664099 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:36.493119955 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:36.624587059 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:36.671040058 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:36.711306095 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:36.847898006 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:36.847923994 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:36.847935915 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:36.848001957 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:36.857160091 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:36.994720936 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:37.046267033 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:37.305923939 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:37.436254978 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:37.438693047 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:37.568897009 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:37.570415020 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:37.721539021 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:37.722697020 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:37.854373932 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:37.855051994 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:37.985609055 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:37.986335039 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:38.116169930 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:38.119088888 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:38.119370937 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:38.120187998 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:38.120382071 CEST	49770	587	192.168.2.4	66.70.204.222
May 4, 2021 20:38:38.251784086 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:38.251806021 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:38.252053022 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:38.252562046 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:38.253463984 CEST	587	49770	66.70.204.222	192.168.2.4
May 4, 2021 20:38:38.296133041 CEST	49770	587	192.168.2.4	66.70.204.222

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 20:36:46.585772991 CEST	62389	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:46.634201050 CEST	53	62389	8.8.8.8	192.168.2.4
May 4, 2021 20:36:48.053796053 CEST	49910	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:48.105243921 CEST	53	49910	8.8.8.8	192.168.2.4
May 4, 2021 20:36:49.203061104 CEST	55854	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:49.254549980 CEST	53	55854	8.8.8.8	192.168.2.4
May 4, 2021 20:36:50.551326036 CEST	64549	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:50.608330965 CEST	53	64549	8.8.8.8	192.168.2.4
May 4, 2021 20:36:52.393086910 CEST	63153	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:52.442821026 CEST	53	63153	8.8.8.8	192.168.2.4
May 4, 2021 20:36:53.377943993 CEST	52991	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:53.429469109 CEST	53	52991	8.8.8.8	192.168.2.4
May 4, 2021 20:36:54.522610903 CEST	53700	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:54.582078934 CEST	53	53700	8.8.8.8	192.168.2.4
May 4, 2021 20:36:56.112008095 CEST	51726	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:56.163491011 CEST	53	51726	8.8.8.8	192.168.2.4
May 4, 2021 20:36:57.362030983 CEST	56794	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:57.410797119 CEST	53	56794	8.8.8.8	192.168.2.4
May 4, 2021 20:36:58.707501888 CEST	56534	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:58.756108999 CEST	53	56534	8.8.8.8	192.168.2.4
May 4, 2021 20:36:59.895889044 CEST	56627	53	192.168.2.4	8.8.8.8
May 4, 2021 20:36:59.947436094 CEST	53	56627	8.8.8.8	192.168.2.4
May 4, 2021 20:37:01.627568960 CEST	56621	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:01.677361012 CEST	53	56621	8.8.8.8	192.168.2.4
May 4, 2021 20:37:02.856363058 CEST	63116	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:02.907125950 CEST	53	63116	8.8.8.8	192.168.2.4
May 4, 2021 20:37:05.890660048 CEST	64078	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:05.939929008 CEST	53	64078	8.8.8.8	192.168.2.4
May 4, 2021 20:37:07.141864061 CEST	64801	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:07.192564964 CEST	53	64801	8.8.8.8	192.168.2.4
May 4, 2021 20:37:07.913377047 CEST	61721	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:07.975424051 CEST	53	61721	8.8.8.8	192.168.2.4
May 4, 2021 20:37:09.184504032 CEST	51255	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:09.236638069 CEST	53	51255	8.8.8.8	192.168.2.4
May 4, 2021 20:37:11.567977905 CEST	61522	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:11.619905949 CEST	53	61522	8.8.8.8	192.168.2.4
May 4, 2021 20:37:12.461430073 CEST	52337	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:12.512180090 CEST	53	52337	8.8.8.8	192.168.2.4
May 4, 2021 20:37:16.670963049 CEST	55046	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:16.721472979 CEST	53	55046	8.8.8.8	192.168.2.4
May 4, 2021 20:37:21.651101112 CEST	49612	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:21.709496975 CEST	53	49612	8.8.8.8	192.168.2.4
May 4, 2021 20:37:38.350974083 CEST	49285	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:38.500468969 CEST	53	49285	8.8.8.8	192.168.2.4
May 4, 2021 20:37:39.094322920 CEST	50601	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:39.154207945 CEST	53	50601	8.8.8.8	192.168.2.4
May 4, 2021 20:37:39.712543964 CEST	60875	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:39.772344112 CEST	53	60875	8.8.8.8	192.168.2.4
May 4, 2021 20:37:40.102238894 CEST	56448	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:40.167395115 CEST	53	56448	8.8.8.8	192.168.2.4
May 4, 2021 20:37:40.205920935 CEST	59172	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:40.350033045 CEST	53	59172	8.8.8.8	192.168.2.4
May 4, 2021 20:37:41.551826000 CEST	62420	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:41.609040976 CEST	53	62420	8.8.8.8	192.168.2.4
May 4, 2021 20:37:41.638432980 CEST	60579	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:41.695399046 CEST	53	60579	8.8.8.8	192.168.2.4
May 4, 2021 20:37:42.965420008 CEST	50183	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:43.028286934 CEST	53	50183	8.8.8.8	192.168.2.4
May 4, 2021 20:37:43.536386013 CEST	61531	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:43.667934895 CEST	53	61531	8.8.8.8	192.168.2.4
May 4, 2021 20:37:44.458900928 CEST	49228	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:44.516117096 CEST	53	49228	8.8.8.8	192.168.2.4
May 4, 2021 20:37:45.366816044 CEST	59794	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:45.424849987 CEST	53	59794	8.8.8.8	192.168.2.4
May 4, 2021 20:37:45.950923920 CEST	55916	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:45.999566078 CEST	53	55916	8.8.8.8	192.168.2.4
May 4, 2021 20:37:54.138750076 CEST	52752	53	192.168.2.4	8.8.8.8
May 4, 2021 20:37:54.188909054 CEST	53	52752	8.8.8.8	192.168.2.4
May 4, 2021 20:38:26.354702950 CEST	60542	53	192.168.2.4	8.8.8.8
May 4, 2021 20:38:26.406428099 CEST	53	60542	8.8.8.8	192.168.2.4
May 4, 2021 20:38:28.856625080 CEST	60689	53	192.168.2.4	8.8.8.8
May 4, 2021 20:38:28.917644978 CEST	53	60689	8.8.8.8	192.168.2.4
May 4, 2021 20:38:35.787714005 CEST	64206	53	192.168.2.4	8.8.8.8
May 4, 2021 20:38:35.867779970 CEST	53	64206	8.8.8.8	192.168.2.4
May 4, 2021 20:38:35.883652925 CEST	50904	53	192.168.2.4	8.8.8.8
May 4, 2021 20:38:35.956926107 CEST	53	50904	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 4, 2021 20:38:35.787714005 CEST	192.168.2.4	8.8.8.8	0xd34c	Standard query (0)	mail.iykmoreentrprise.org	A (IP address)	IN (0x0001)
May 4, 2021 20:38:35.883652925 CEST	192.168.2.4	8.8.8.8	0x4b1b	Standard query (0)	mail.iykmoreentrprise.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 4, 2021 20:38:35.867779970 CEST	8.8.8.8	192.168.2.4	0xd34c	No error (0)	mail.iykmoreentrprise.org	iykmoreentrprise.org		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 20:38:35.867779970 CEST	8.8.8.8	192.168.2.4	0xd34c	No error (0)	iykmoreentrprise.org		66.70.204.222	A (IP address)	IN (0x0001)
May 4, 2021 20:38:35.956926107 CEST	8.8.8.8	192.168.2.4	0x4b1b	No error (0)	mail.iykmoreentrprise.org	iykmoreentrprise.org		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 20:38:35.956926107 CEST	8.8.8.8	192.168.2.4	0x4b1b	No error (0)	iykmoreentrprise.org		66.70.204.222	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 4, 2021 20:38:36.358669043 CEST	587	49770	66.70.204.222	192.168.2.4	220-server.wlcserver.com ESMTP Exim 4.94 #2 Tue, 04 May 2021 22:38:36 +0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 4, 2021 20:38:36.359447002 CEST	49770	587	192.168.2.4	66.70.204.222	EHLO 849224
May 4, 2021 20:38:36.492664099 CEST	587	49770	66.70.204.222	192.168.2.4	250-server.wlcserver.com Hello 849224 [84.17.52.3] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-STARTTLS 250 HELP
May 4, 2021 20:38:36.493119955 CEST	49770	587	192.168.2.4	66.70.204.222	STARTTLS
May 4, 2021 20:38:36.624587059 CEST	587	49770	66.70.204.222	192.168.2.4	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: lT2TTQACRLGKK8w.exe PID: 6980 Parent PID: 5972

General

Start time:	20:36:53
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe'
Imagebase:	0xcb0000
File size:	694272 bytes
MD5 hash:	8C2987EF25996649BE1A2D6F2150A30D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: lT2TTQACRLGKK8w.exe PID: 7092 Parent PID: 6980

General

Start time:	20:36:57
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
Imagebase:	0x6f0000
File size:	694272 bytes
MD5 hash:	8C2987EF25996649BE1A2D6F2150A30D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: lT2TTQACRLGKK8w.exe PID: 6980 Parent PID: 5972 lT2TTQACRLGKK8w.exeCOMMON

Executed Functions

Function 0B9762E8, Relevance: 3.9, Strings: 3, Instructions: 181COMMON

Download Yara Rule

Strings

!, xrefs: 0B9763FA
!, xrefs: 0B976364
BB0, xrefs: 0B9764EF

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: BB0$!$!
API String ID: 0-2146233108
Opcode ID: 9a8c9e4100942e2d9935fc4e1c60d17f1599af3392eb37607fc5f88f750d9c56
Instruction ID: 7a5fe64f37c8d5e65927ceab94aabeac3deec37774d8f4aac817f9c5fde067cc
Opcode Fuzzy Hash: 9a8c9e4100942e2d9935fc4e1c60d17f1599af3392eb37607fc5f88f750d9c56
Instruction Fuzzy Hash: 07714A70E44629CBDB28CF66C840BADBBF6FB88300F10C5EA951DA6254EB745A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0B9762D8, Relevance: 3.9, Strings: 3, Instructions: 177COMMON

Download Yara Rule

Strings

!, xrefs: 0B9763FA
!, xrefs: 0B976364
BB0, xrefs: 0B9764EF

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: BB0$!$!
API String ID: 0-2146233108
Opcode ID: aa6faa82bfb90fc83538fbaeac2599cf7aea191144cd74579bba4b76dbc70211
Instruction ID: b843706e581e7ce13abc279238330ed2c928e38b4c87eb5ac732491be135a7be
Opcode Fuzzy Hash: aa6faa82bfb90fc83538fbaeac2599cf7aea191144cd74579bba4b76dbc70211
Instruction Fuzzy Hash: 02714970E40629CBDB28CF66C840B9DBBF2FB88300F14C5EAD519A7254EB709A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0B976523, Relevance: 3.9, Strings: 3, Instructions: 152COMMON

Download Yara Rule

Strings

!, xrefs: 0B9763FA
!, xrefs: 0B976364
BB0, xrefs: 0B9764EF

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: BB0$!$!
API String ID: 0-2146233108
Opcode ID: 2a9d542db2fd1e7b8ac311f9e950bf0aa33208122c57bb9723eb16dd081f5833
Instruction ID: 3ac5b74e03a796e5eb85c94106813495fbc66687377536ddec57e3243d5e7950
Opcode Fuzzy Hash: 2a9d542db2fd1e7b8ac311f9e950bf0aa33208122c57bb9723eb16dd081f5833
Instruction Fuzzy Hash: 1C611874D5562ACFDB64CF65C840BDDBBF2FB88300F1085EAD119A6254EB709A85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0B976589, Relevance: 3.9, Strings: 3, Instructions: 144COMMON

Download Yara Rule

Strings

!, xrefs: 0B9763FA
!, xrefs: 0B976364
BB0, xrefs: 0B9764EF

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: BB0$!$!
API String ID: 0-2146233108
Opcode ID: cd0aacbd983c8b0908662bef398fb7257f7ce2a4cf02f3ceb08d3658868df65e
Instruction ID: 97ce72644262d9880e2351f1c7c4d973da60a71905c08efb56cd0ca90aa3f97a
Opcode Fuzzy Hash: cd0aacbd983c8b0908662bef398fb7257f7ce2a4cf02f3ceb08d3658868df65e
Instruction Fuzzy Hash: 79511770E5562ACFDB64CF65C840BADBBF2FB89300F1085E6D119A3250EB749A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0B978BF8, Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a99b28d38120adb7b42e432a8ae131400088f30eb672f64bacf0fd46f046ee5
Instruction ID: da5e4f3903c2bbb216108c7e53afbb03f770fd4855c81c0db50eaacab52bc593
Opcode Fuzzy Hash: 4a99b28d38120adb7b42e432a8ae131400088f30eb672f64bacf0fd46f046ee5
Instruction Fuzzy Hash: 39E1B070B016159FDB29EB76C894BAEB7FBAFC8704F14446DD1468B290CB35E901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B977960, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7058bd159056f2eb42807cd257fc3961a28441ef9961cce8c7e37f4664ae3ab5
Instruction ID: cd17f9dccf25acbf7b6e2cd931afdffb240e88925b272ff4347e3ed305c581f1
Opcode Fuzzy Hash: 7058bd159056f2eb42807cd257fc3961a28441ef9961cce8c7e37f4664ae3ab5
Instruction Fuzzy Hash: 22B16F31A40215DFDB14EFA9C984AADB7F6EF88304F168469E815AB3A1D734ED40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0B978380, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2dbf14708c7538cb72dbfeadec5141379ec4cbf9bc1d9d33fec39bd5b92fc8
Instruction ID: 42382a06949c3962e75046ab67b792ac706688eaaf7cc5984fce11c62c5272b7
Opcode Fuzzy Hash: 4d2dbf14708c7538cb72dbfeadec5141379ec4cbf9bc1d9d33fec39bd5b92fc8
Instruction Fuzzy Hash: 81319870D99119EBCB10EFB7D5886FEBBF9AB49640F205825D515F3240E7708501CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0B978371, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188f93a45354aca719aacac451df55a61df3a0bc401bede33b80a817c17a3073
Instruction ID: 59a5aec7db109af85a84bde070c88fac2cdab25ae611827180a3fa824b38b288
Opcode Fuzzy Hash: 188f93a45354aca719aacac451df55a61df3a0bc401bede33b80a817c17a3073
Instruction Fuzzy Hash: 6C319370D8921DEBCB10EFA6D5886FEBBF5AB0A700F205815E512F3340DBB08945CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0B9784AC, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b1da7922cf88b5c482894e9459dd2ecf2bf8291aa14e884bb8619668ea0386
Instruction ID: e64564f77ff806bf8af66cc735a1d75ec84416d8976a5bc3c588d21b1e087e7b
Opcode Fuzzy Hash: 78b1da7922cf88b5c482894e9459dd2ecf2bf8291aa14e884bb8619668ea0386
Instruction Fuzzy Hash: FD01AD70E8C259EFDB10AFA2D8D85BDBBF0AB4A640F205559E052B7251EBB88501CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01626B80, Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01626BF0
GetCurrentThread.KERNEL32 ref: 01626C2D
GetCurrentProcess.KERNEL32 ref: 01626C6A
GetCurrentThreadId.KERNEL32 ref: 01626CC3

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 620da53a44cb7476ee95efe9c3512369ccdfc3d9aaf9c87de54eacba17f3c6af
Instruction ID: 4b328beb1420de86e9bade0a461195d0015e85038ca1f5050590b5c40dc7436a
Opcode Fuzzy Hash: 620da53a44cb7476ee95efe9c3512369ccdfc3d9aaf9c87de54eacba17f3c6af
Instruction Fuzzy Hash: BB5163B0D007488FEB14DFAAD988B9EBBF0EF48314F248469E509A7290D774A844CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01626B90, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01626BF0
GetCurrentThread.KERNEL32 ref: 01626C2D
GetCurrentProcess.KERNEL32 ref: 01626C6A
GetCurrentThreadId.KERNEL32 ref: 01626CC3

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7e791c557074d0a2613fc83034c739a93ca63e0d2a3f1631c1fd9d35da1644ba
Instruction ID: 27f3c8a9b7de89d1f57244a4a6567958b98108b9a820c2733d7b26912be0563f
Opcode Fuzzy Hash: 7e791c557074d0a2613fc83034c739a93ca63e0d2a3f1631c1fd9d35da1644ba
Instruction Fuzzy Hash: BB5164B4D006498FEB14DFAAD948BDEBBF0EF48314F248429E519A3390D774A844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0B974D8D, Relevance: 1.7, APIs: 1, Instructions: 244processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B974FCE

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3a1421c01c294ec40a6a25cedaaa8ca0b5085033e8f2b6cf5837d3288f757395
Instruction ID: 7148040cc67cbb5da2745396d341aa71813ccc8a5bd01953d7e2f2fa7d139bc6
Opcode Fuzzy Hash: 3a1421c01c294ec40a6a25cedaaa8ca0b5085033e8f2b6cf5837d3288f757395
Instruction Fuzzy Hash: ECA15971D00219CFEB10DFA4C881BADBBF6BF48314F158569E809A7350DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0B974D98, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B974FCE

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a41ebf88b7b740d4211a565e4c8ceca46d0cf4d2bd247a0c68d61f02a623672e
Instruction ID: ae0375b0b8982b5a8c377d0a1123cda98142200d8d92a423451d6c6d0b769b19
Opcode Fuzzy Hash: a41ebf88b7b740d4211a565e4c8ceca46d0cf4d2bd247a0c68d61f02a623672e
Instruction Fuzzy Hash: 87915971D00219CFEB10EFA4C881BEDBAF6BF49314F158569E809A7350DB749A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0162BBB8, Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0162BE0E

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 699414b8e5e10c5962d342bd46da8fd4d44b186087a1cf1c8ba66ac7f232b2c4
Instruction ID: 8e28c5ef00ece1b6e8c95171544d866344872c4f9b96f9e0ca14800348d08500
Opcode Fuzzy Hash: 699414b8e5e10c5962d342bd46da8fd4d44b186087a1cf1c8ba66ac7f232b2c4
Instruction Fuzzy Hash: 5C711270A00B159FE725DF2AC85079ABBF1FF88204F048A2DD59AD7B40DB75E8458F91

Uniqueness

Uniqueness Score: -1.00%

Function 0162DC6D, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0162DD8A

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 22869651ba22ab939aa211e4676fa9388e106c6e06edb431eec106af5b677558
Instruction ID: a85b1a66ba2f415313d66b2a601bfc7d99b8b611b166f9539b7bd78a83b11c58
Opcode Fuzzy Hash: 22869651ba22ab939aa211e4676fa9388e106c6e06edb431eec106af5b677558
Instruction Fuzzy Hash: 5C51C1B1D00719EFEF14CF9AC884ADEBBB5BF48314F24852AE819AB250D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0162DC78, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0162DD8A

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 42b2680f9935e93466bd428c093ac88019c0874b9c13c33b84bba848c610f65f
Instruction ID: af7c93c8c85676e54cab52e86671365dc5b52c11fec4f677c60b5d49833c016a
Opcode Fuzzy Hash: 42b2680f9935e93466bd428c093ac88019c0874b9c13c33b84bba848c610f65f
Instruction Fuzzy Hash: 3F41C0B1D00719DFDF14CFAAC884ADEBBB5BF48314F24852AE819AB250D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01626D41, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01626E3F

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fd4897f5f578799381146b8db090aa522f0408e5f84368eb82efa0cc87949a1c
Instruction ID: a25c22ec9204f4f6bdade4a5f8f657ff24840fbd74d60df0035e18992257ff2e
Opcode Fuzzy Hash: fd4897f5f578799381146b8db090aa522f0408e5f84368eb82efa0cc87949a1c
Instruction Fuzzy Hash: 5C414876900259AFDB01CF99D884ADEBFF9FF49320F05802AEA44A7350D735A954DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0B974B08, Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B974BA0

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 998f291c6111cf134128dabc096aaa03ab8506cac823531a0be41de7726188ca
Instruction ID: 8c8da6f17aa7a29279eb21940980620b2a2a29b76810d79a4c92fb509344cb11
Opcode Fuzzy Hash: 998f291c6111cf134128dabc096aaa03ab8506cac823531a0be41de7726188ca
Instruction Fuzzy Hash: 7A2124719002599FCF10DFAAC881BEEBBF4FB48314F14842AE918A7341DB789944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B974B10, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B974BA0

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a2cc74228f9c37fa61493017f81db9ed5db8dcb53b577802fbe82aab20f1cd9b
Instruction ID: 690049824f9e55511808a7183d70d26f8ca19a6aae5ea407ae19df3105782171
Opcode Fuzzy Hash: a2cc74228f9c37fa61493017f81db9ed5db8dcb53b577802fbe82aab20f1cd9b
Instruction Fuzzy Hash: 8F2135719003599FCB10CFAAC880BEEBBF4FF48314F00842AE918A7341C7789944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B974330, Relevance: 1.6, APIs: 1, Instructions: 66threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0B9743B6

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 9bc9b3432fa072f93183e80333007ec6515112b31792b0b7e8aab7eccfca8086
Instruction ID: 7c357fcbce9bbd2bd777611f4dc14e4ea80602e2b665e08651ab67492c72d8cc
Opcode Fuzzy Hash: 9bc9b3432fa072f93183e80333007ec6515112b31792b0b7e8aab7eccfca8086
Instruction Fuzzy Hash: 392168B1D003098FDB10DFAAC5857EEBBF4EF48224F14842AE559A7341DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B974BF8, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B974C80

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 648e8377ac335f72d87881aa906720eb5a92becc05e6a4657ca69054244096c0
Instruction ID: 85831d8e2fde5e9d9ab1539d1469917cca479a85f5f53791e2dceea2f156c240
Opcode Fuzzy Hash: 648e8377ac335f72d87881aa906720eb5a92becc05e6a4657ca69054244096c0
Instruction Fuzzy Hash: 272136B19003599FCF10DFAAC884BEEBBF4FF48324F54842AE558A7240C7789944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01626DB0, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01626E3F

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3d5f1c50e1fe79142c8bcd6fd32bd3beb210620ee4afe66fae8df9f7d4c03708
Instruction ID: 2f7669c5dd39c2ef2c59e2c3b8325c31999a3b7a9d3b6a1848aed4771e20d645
Opcode Fuzzy Hash: 3d5f1c50e1fe79142c8bcd6fd32bd3beb210620ee4afe66fae8df9f7d4c03708
Instruction Fuzzy Hash: 2E21E5B59002589FDB10CF99D984BDEBBF8FB48324F14801AE954A3350D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B974338, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0B9743B6

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: b7b770a1f802e9f1cc9cfb863e83240472bfc308ce1d0332363d74f7a8fed387
Instruction ID: d981ce00749120508c945118cc31a5cbdb3853091143e557fba69d49c225d711
Opcode Fuzzy Hash: b7b770a1f802e9f1cc9cfb863e83240472bfc308ce1d0332363d74f7a8fed387
Instruction Fuzzy Hash: C8213871D003098FDB10DFAAC5847EEBBF4AF48224F54842AD559A7341DB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B974C00, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B974C80

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 517bedf6ae08f024a2202e918a130fc8d6da5199b4026a14c16b53dc1214b70a
Instruction ID: d75179437f3cc1e2c48fd96304286c6881383dd99beef6d0cc78a288cd905f8e
Opcode Fuzzy Hash: 517bedf6ae08f024a2202e918a130fc8d6da5199b4026a14c16b53dc1214b70a
Instruction Fuzzy Hash: 872114B19003599FDB10DFAAC884BEEBBF5FF48324F54842AE558A7250C7789944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01626DB8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01626E3F

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0de30867a489720aae1057e973f591b6a76bb22057efb720291373dc4535ee2f
Instruction ID: 37ef8cceb7879113ac074c68c38407f959d0af7285fc8a8d8dbba23add507bd1
Opcode Fuzzy Hash: 0de30867a489720aae1057e973f591b6a76bb22057efb720291373dc4535ee2f
Instruction Fuzzy Hash: DA21E6B59002589FDB10CF99D984BDEBBF8EB48320F14801AE954A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0162B0D8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0162BE89,00000800,00000000,00000000), ref: 0162C09A

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 254ce9eac8532e599c3c03f1209faa550201a540a730f5c49f99631677bb77db
Instruction ID: d99064647b0b44e2412789c49c214916765e417da9937e17cea7f19997eb5e8a
Opcode Fuzzy Hash: 254ce9eac8532e599c3c03f1209faa550201a540a730f5c49f99631677bb77db
Instruction Fuzzy Hash: 091114B6D006199FDB10CF9AD844BDEFBF4EB49324F04842EE515A7200C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0162C028, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0162BE89,00000800,00000000,00000000), ref: 0162C09A

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e9c20e0e0371d1326e5beb18b0bae4970d056f7cbdff3919ef8fd3a11274c66e
Instruction ID: 106649e9814cb9cae59e33d7f5b458a26bb784a08443270b242e23f09e0c1119
Opcode Fuzzy Hash: e9c20e0e0371d1326e5beb18b0bae4970d056f7cbdff3919ef8fd3a11274c66e
Instruction Fuzzy Hash: 5811F2B6D002098FDB14CFAAD844BDEFBF4AB89324F15852ED515A7200C379A949CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B974A50, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B974ABE

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 612b36ca55e5f36ecbdb0d951fac58ebc237c1c6be71ba08e8542e12607b659a
Instruction ID: 241c3c8ff703a0ddeacff2b30680112f8da112c77226a87e254b298e75e447a9
Opcode Fuzzy Hash: 612b36ca55e5f36ecbdb0d951fac58ebc237c1c6be71ba08e8542e12607b659a
Instruction Fuzzy Hash: 071167719002499FDF10DFAAC844BEFBBF9EF88324F158429E515A7250C779A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B973E78, Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0B973EE2

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 47bb55cf62a08d769af0098213c2f33806803c16e69d6de3c14cc5404519ce10
Instruction ID: fb4e36bf5bfd9044b3fa05150f131011e4d8446ab9b2445b69f56f11b8802c7b
Opcode Fuzzy Hash: 47bb55cf62a08d769af0098213c2f33806803c16e69d6de3c14cc5404519ce10
Instruction Fuzzy Hash: D01188B19042598BDB10DFAAC8457EEFBF8EF88224F14842AD515A3200CB78A945CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0B974A4F, Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B974ABE

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 58bccbede3b12086722376b54db3ada52c967e035a6a12729294b0a615a282f1
Instruction ID: 3e93282ccfa4a4d0be776d9c513062af99b69a97e71f380fc8e56634985ccc73
Opcode Fuzzy Hash: 58bccbede3b12086722376b54db3ada52c967e035a6a12729294b0a615a282f1
Instruction Fuzzy Hash: 141176B2900249CFDF10CFAAC9447EEBBF5AF48324F15882AE515A7250C7799940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0B973E80, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0B973EE2

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f2100989faf6d820d27de7481196db77ecade157d64ffa4b3ebf718294b6c339
Instruction ID: 35d4b80bb483ee37ec60908a557d74600c2a32a17dea4ecf26f6a9ba0b143c18
Opcode Fuzzy Hash: f2100989faf6d820d27de7481196db77ecade157d64ffa4b3ebf718294b6c339
Instruction Fuzzy Hash: 1B1136B1D043498BDB10DFAAC4457EFFBF8AF88224F14842AD519A7240CB79A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B9795C1, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0B979620

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7076d8880b852d318f3c8f305123dbc085b0d0f24d8f3bac27ecb08e63c8cede
Instruction ID: 3bdfeab17845ba36bf89f0826d04d2341f385c1e58de3482cc1c081e261a348e
Opcode Fuzzy Hash: 7076d8880b852d318f3c8f305123dbc085b0d0f24d8f3bac27ecb08e63c8cede
Instruction Fuzzy Hash: 281133B18003499FDB20DF9AD585BEEBBF8EB48324F14842AD558A7740D738A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B973F90, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0B977DB5

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2f29e9447573b64a98375514fb73e678b2a565607a0b5b296e90855d5166268a
Instruction ID: 9f9bf75a1e349c9887db7192ec107a71aacff6fa05367e984875197fc27797bf
Opcode Fuzzy Hash: 2f29e9447573b64a98375514fb73e678b2a565607a0b5b296e90855d5166268a
Instruction Fuzzy Hash: B01103B58003499FDB10DF9AC488BEEBBF8EB58324F14841AE555A7200C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B9795C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0B979620

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: daa27498a547801cb96324431d47bc8cbb078ad54811c4d4e27bf55317212b86
Instruction ID: 2928da396df3f910eb5b9bca0dab37401369bb4f13f81d31ccd1cf060106d187
Opcode Fuzzy Hash: daa27498a547801cb96324431d47bc8cbb078ad54811c4d4e27bf55317212b86
Instruction Fuzzy Hash: EC1133B18002498FDB20DF9AD585BDEBBF8EB48320F14842AD558A7240C738A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B977D50, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0B977DB5

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: cecf5704d60ad178c0e42aac8d0668d2da4fd194fb09a40e6f6a4991865af23f
Instruction ID: 3fbecc64fd61debb5594c256ab96f32bbb61221dca30811e64d3e8d10850e97e
Opcode Fuzzy Hash: cecf5704d60ad178c0e42aac8d0668d2da4fd194fb09a40e6f6a4991865af23f
Instruction Fuzzy Hash: B91115B58003499FDB10DF9AD885BDEBFF8FB48324F14841AE554A7600D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0162BDA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0162BE0E

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a4b2198fcbc971ba04d454e8587da59659d0a70dbdb6fdfbaefc18cc4b6298c0
Instruction ID: edde54de6d853b9ceec0340d1bbd1d01427109d99fe116907d0f49a27cf30250
Opcode Fuzzy Hash: a4b2198fcbc971ba04d454e8587da59659d0a70dbdb6fdfbaefc18cc4b6298c0
Instruction Fuzzy Hash: 2F11E3B5D006598FDB10CF9AC844BDEFBF4EF88224F14842AD959A7600C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0162DEC0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0162DF1D

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 01027dea71c62621b25d29dfc013fcb30b3a5ed2cf6d476725bcf07e640d7970
Instruction ID: ee4e7d9019e0a935e160828bbc6b753dee464a3ae1c6aafee95e41d7eef50390
Opcode Fuzzy Hash: 01027dea71c62621b25d29dfc013fcb30b3a5ed2cf6d476725bcf07e640d7970
Instruction Fuzzy Hash: 361112B58002499FDB10CF9AD884BDEBBF8EB88320F14841AE955A3340C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0162DEB9, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0162DF1D

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 86d9c55b2a8d11866fabeec6d63d23d16e90efbc76fc09eee47f1f8623f21b95
Instruction ID: a7ee21e1c003155f9a288b9df38312705a5dd934d3facb5253266add694bd5ed
Opcode Fuzzy Hash: 86d9c55b2a8d11866fabeec6d63d23d16e90efbc76fc09eee47f1f8623f21b95
Instruction Fuzzy Hash: EE1100B69002498FDB10CF99D585BDEBBF8EB48320F24841AE959A7740C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0B971E51, Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

V(*t, xrefs: 0B971EB1
G7jY, xrefs: 0B9720B2
UDOV, xrefs: 0B971F09

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: G7jY$UDOV$V(*t
API String ID: 0-555326040
Opcode ID: f14741eccc3b337f434d7d8a112bec3b2004e31b17cd983e1afc61be12893add
Instruction ID: 47db32a8c752f1b1a1261e7c0297063ab962b6419084f3210d646e4372696419
Opcode Fuzzy Hash: f14741eccc3b337f434d7d8a112bec3b2004e31b17cd983e1afc61be12893add
Instruction Fuzzy Hash: A8717970E0521A8FCB04DFAAD4819AEFBF2AF89310F14D52AD415F7354E7349A818FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B971E60, Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

V(*t, xrefs: 0B971EB1
G7jY, xrefs: 0B9720B2
UDOV, xrefs: 0B971F09

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: G7jY$UDOV$V(*t
API String ID: 0-555326040
Opcode ID: 27bc0ca657275a4d538538f30ae562ee36d42a7bec5ec37fe849f005236688ea
Instruction ID: c4db2a90a1b06d92cc24229d263318ad1869de0117dd22a73e67665dc570cc1c
Opcode Fuzzy Hash: 27bc0ca657275a4d538538f30ae562ee36d42a7bec5ec37fe849f005236688ea
Instruction Fuzzy Hash: CA716B70E0521A8FCB04DFA9D4819AEFBF2AF89310F14D52AD415B7354E7349A818FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B971928, Relevance: 2.8, Strings: 2, Instructions: 276COMMON

Download Yara Rule

Strings

G-}, xrefs: 0B971AE8
gG , xrefs: 0B971BE3

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: G-}$gG
API String ID: 0-1573944241
Opcode ID: efd1ab3a812a8ce32f5aeed8fd04ca804249f43f80ab686fd6703270e9826041
Instruction ID: 404313d1d0140d171db4ec7e957358c443f39e4f0ae76a1f49cd0c324bb6f113
Opcode Fuzzy Hash: efd1ab3a812a8ce32f5aeed8fd04ca804249f43f80ab686fd6703270e9826041
Instruction Fuzzy Hash: 69B13770E052298BCB04EFA9D5816AEFBF2BF88350F24D526C415FB319E7349942CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0B971918, Relevance: 2.8, Strings: 2, Instructions: 272COMMON

Download Yara Rule

Strings

G-}, xrefs: 0B971AE8
gG , xrefs: 0B971BE3

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: G-}$gG
API String ID: 0-1573944241
Opcode ID: 43cdc56c482592acf542f20545528580d5ae281b1838e1309fc4a7cfa513106a
Instruction ID: e6ccc06af9eeb601cbec57de9c020414c7f05efe36ad149c08fcfb2ff3edefd5
Opcode Fuzzy Hash: 43cdc56c482592acf542f20545528580d5ae281b1838e1309fc4a7cfa513106a
Instruction Fuzzy Hash: 76B14770E052298BCB04DFA9D9806AEFBF2BF88340F24D526C415FB319E7349942CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0B975F28, Relevance: 2.7, Strings: 2, Instructions: 222COMMON

Download Yara Rule

Strings

e,, xrefs: 0B976153
5RJQ, xrefs: 0B97611F

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: e,$5RJQ
API String ID: 0-520041971
Opcode ID: 8488b8ca170bdc7e8e50d42941a78a202a24e0b5a40e3d3ce95d1dc66a0fed6d
Instruction ID: 442422b121cb28795f45efb14348022a3372a2116e60d6e07fa692c7ac45a3c0
Opcode Fuzzy Hash: 8488b8ca170bdc7e8e50d42941a78a202a24e0b5a40e3d3ce95d1dc66a0fed6d
Instruction Fuzzy Hash: B891F5B4E45209CFCB48DFAAD5819DEBBF2EF8A300F20942AD415BB314D7319A059F95

Uniqueness

Uniqueness Score: -1.00%

Function 0B975F18, Relevance: 2.7, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

e,, xrefs: 0B976153
5RJQ, xrefs: 0B97611F

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID: e,$5RJQ
API String ID: 0-520041971
Opcode ID: c04269fe83eb7fef05c293d23070f58e202437ceacd9c5e1c8fb57a088a9aed5
Instruction ID: 486ad521acc4b4d4431a9a5bb86f5499e85a61d35eaad5651a59624286053025
Opcode Fuzzy Hash: c04269fe83eb7fef05c293d23070f58e202437ceacd9c5e1c8fb57a088a9aed5
Instruction Fuzzy Hash: EF91F4B4E45209CFCB48DFAAD5819DEBBF2FB8A300F20942AD415BB314D7319A059F95

Uniqueness

Uniqueness Score: -1.00%

Function 00CBA1D3, Relevance: 2.6, Instructions: 2618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.653962922.0000000000CB2000.00000002.00020000.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.653956727.0000000000CB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.654094661.0000000000D5C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6b1aaa47f2a3158745b213bf65dc26481f7c6aee25f7a4c21ca548ada64ccb
Instruction ID: 2cd3984454dd874a265b5715d0642cfd60849213c253a07363efd3fc5c7f0bb8
Opcode Fuzzy Hash: 4c6b1aaa47f2a3158745b213bf65dc26481f7c6aee25f7a4c21ca548ada64ccb
Instruction Fuzzy Hash: 3723596140E7C29FD7038B785D722E5BFB5AE6322470E48D7C4C08F1A3E21519AADB76

Uniqueness

Uniqueness Score: -1.00%

Function 0162C2B0, Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d777ff720866cdc9a882d573573d91ca8fb6cd5d4bc6ac4470574a911dc7272f
Instruction ID: 3c459857f9cd50b2a50fba07589bf526d4c81ded55ec621cb30bc027263acc7e
Opcode Fuzzy Hash: d777ff720866cdc9a882d573573d91ca8fb6cd5d4bc6ac4470574a911dc7272f
Instruction Fuzzy Hash: 84527BB9501B46CFD730CF18EC881997BB1FB41318F906209DA635BAD9D3B865AACF44

Uniqueness

Uniqueness Score: -1.00%

Function 0B979010, Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea315f5bccc48deeb4925aae3eeedc2ece3913d19f6815da434fa52fec968da4
Instruction ID: 47cac68bf38a310d29faa8845855043b3757778fc27847cd0c349d83699e8be8
Opcode Fuzzy Hash: ea315f5bccc48deeb4925aae3eeedc2ece3913d19f6815da434fa52fec968da4
Instruction Fuzzy Hash: B8C1AE30B45214AFDB14EFA8C994BAEB7F6EF89304F258069E505AB3A5CB35DD04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0B972180, Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124b7d9ea340f0638fc726f5db5933f7a53544bd7e8937ec30df343291767522
Instruction ID: 7d0fa26b48f660d6ac88b40617eda416ebfc95accb6436e532a1f7720793cf71
Opcode Fuzzy Hash: 124b7d9ea340f0638fc726f5db5933f7a53544bd7e8937ec30df343291767522
Instruction Fuzzy Hash: C8D13674E152198FCB14DFA9C980AAEFBF2BF8A300F24C569D518AB355D7309A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0B972171, Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d98941068a40f9b6e3a91305a9562d87960bd89a62ad3902c28a6e5e6829ef
Instruction ID: 9cc643d89501b34c8b74ca3cc5d489ebb1469b2fdae62405c9098c91bb723105
Opcode Fuzzy Hash: 77d98941068a40f9b6e3a91305a9562d87960bd89a62ad3902c28a6e5e6829ef
Instruction Fuzzy Hash: 18D14674E152198FCB14DFA9C980AAEFBF2BF8A300F24C569D518AB355D7309A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01629990, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.654817138.0000000001620000.00000040.00000001.sdmp, Offset: 01620000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b87fad0daa8e259c7a419493bad36a60047658af1198bbceaae1d86158877aa
Instruction ID: 09d097d500d8a3815a032379fe45d85095871b297bb989e53bdae3e94d93c0c5
Opcode Fuzzy Hash: 7b87fad0daa8e259c7a419493bad36a60047658af1198bbceaae1d86158877aa
Instruction Fuzzy Hash: 23A16132E00A2A8FCF15DFA9CC445DDBBB2FF85304B15856AE905BB225EB31A955CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0B97242B, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a7a44c1dd1d5ad6b625a19917acbf9b25e8099db4b476f39f80f6b735b77d9
Instruction ID: 39f601c760265a8ea83160891c6ea2599eb6adcb2f6f0293f202028a8cceb63e
Opcode Fuzzy Hash: d0a7a44c1dd1d5ad6b625a19917acbf9b25e8099db4b476f39f80f6b735b77d9
Instruction Fuzzy Hash: A9C16674E152198FCB14DFA8C980AAEFBF2FF4A300F248169D518AB355D730AA41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0B9733A8, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ec92445efce5f4aededa16679655e0994bc16f9bd3b18c31b66a2fe335a33e
Instruction ID: feac5e51ee9cbd866fc5582b6d2bb2f2c658deee63449952d4792cd347f13af8
Opcode Fuzzy Hash: 57ec92445efce5f4aededa16679655e0994bc16f9bd3b18c31b66a2fe335a33e
Instruction Fuzzy Hash: 9651F570E15219CFDB58DF69D880B9EBBF2FF88200F10C1AAD509A7360DB319A859F55

Uniqueness

Uniqueness Score: -1.00%

Function 0B973399, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8620b48ff80ba91708ae20f22aec112dd4b191b147acf530adc6198e2860b6
Instruction ID: 28b8c2e53415b87a549f620cf8d854d51e0b9171a74bb5e3482bf88626948594
Opcode Fuzzy Hash: ac8620b48ff80ba91708ae20f22aec112dd4b191b147acf530adc6198e2860b6
Instruction Fuzzy Hash: 99511570E15218CFDB58DF69C880B9EBBF2BF88200F14C1A9D909A7360DB319A85DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0B970944, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d5e005488c383e6db59f070624ac4b412bbc4c16a893592efd7d5024d198b6
Instruction ID: 135a875a63ce087f62a866095ac40b4d45e1902e3660fa38878eef3c3289bffa
Opcode Fuzzy Hash: d2d5e005488c383e6db59f070624ac4b412bbc4c16a893592efd7d5024d198b6
Instruction Fuzzy Hash: A241CE71E5520ADFCB08CFA9C885B9EFBF2FF88204F148465C519AB256D730AA11CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0B9709A8, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facf78b68602d1ea70f94c3012512d54a27cc30b0918783e71fdac42f3c08d34
Instruction ID: 07310b7ba557156f987a2a53891155a816e5c6967b60609551bd86c8c6840a12
Opcode Fuzzy Hash: facf78b68602d1ea70f94c3012512d54a27cc30b0918783e71fdac42f3c08d34
Instruction Fuzzy Hash: 1B415671E152199FDB18CFAAD981A9EFBF6FF88200F14C06AD519B7354D7309A41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0B970FEC, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86365d2bdef22f18b67376392e530449432e3a0463add63a57bdc33aa89276f5
Instruction ID: c5190bea9de870cfc7241319e5be30a88c1826b3c6fb1ee44dbcf03272ab9c42
Opcode Fuzzy Hash: 86365d2bdef22f18b67376392e530449432e3a0463add63a57bdc33aa89276f5
Instruction Fuzzy Hash: 7D316F70E152658FDB09CF6AC84169AFBF3BFC9200F18C4A9C588AB256DB309905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0B974410, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78daf44668a034b55312f6489b426561b93d545d46a06822f7d73f627e919f9c
Instruction ID: eef01a3adcbed9a7ef27cae0fcef90b593d2234ee574e509f73c510392a989fa
Opcode Fuzzy Hash: 78daf44668a034b55312f6489b426561b93d545d46a06822f7d73f627e919f9c
Instruction Fuzzy Hash: E021F471E116199BDB08CFABE94069EFBF7BBC8200F24C17AD408A7315EB305A018B91

Uniqueness

Uniqueness Score: -1.00%

Function 0B974400, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d37a94737197eebf2ee111f463bbdbe77e82543122256d4f1af44faae95dbd09
Instruction ID: 9a6cc6f7ab11fa2e74194b14fba75338ecee395d705d906ef0be9fe61f2dea32
Opcode Fuzzy Hash: d37a94737197eebf2ee111f463bbdbe77e82543122256d4f1af44faae95dbd09
Instruction Fuzzy Hash: 292159B1E106189BDB18CFABD94169EFAF7BFC8200F24C03AD408A7314EB305A05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0B979318, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659585305.000000000B970000.00000040.00000001.sdmp, Offset: 0B970000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4cf844fb26f7b26a4db0858fa50beb651fb923d14bef6204d23da8068963ca9
Instruction ID: 87a4ac83e768139adafc1291c29be73ac526d8fc02079b9367a61064cd0ce6fb
Opcode Fuzzy Hash: d4cf844fb26f7b26a4db0858fa50beb651fb923d14bef6204d23da8068963ca9
Instruction Fuzzy Hash: 5D115A70D492589BDB24AFA5C458BEEBBF4BB8E300F149469D011B72C0DB788948CB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: lT2TTQACRLGKK8w.exe PID: 7092 Parent PID: 6980 lT2TTQACRLGKK8w.exeCOMMON

Executed Functions

Function 00C88060, Relevance: 9.8, APIs: 1, Strings: 4, Instructions: 1010COMMON

Download Yara Rule

Strings

\, xrefs: 00C8829E
\, xrefs: 00C881A9
\, xrefs: 00C88263
\, xrefs: 00C880D9

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID:
String ID: \$\$\$\
API String ID: 0-3238275731
Opcode ID: cd9ebe10e63070451ccf8261e3aafb616e83b4243213ae5946e0f0fbd8fad1bf
Instruction ID: e542a9b54e46820f48d49ef2edf537e976af553e955349f0851d17ef704d35ca
Opcode Fuzzy Hash: cd9ebe10e63070451ccf8261e3aafb616e83b4243213ae5946e0f0fbd8fad1bf
Instruction Fuzzy Hash: D6928131E006198FDB24EF78C9557AEB7F2AF89304F5086A9D509AB351EF349D85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00C84310, Relevance: 6.9, APIs: 2, Strings: 1, Instructions: 1687COMMON

Download Yara Rule

Strings

D0l, xrefs: 00C85592

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID:
String ID: D0l
API String ID: 0-2225038300
Opcode ID: dcaa9a987d402ed95888ab43cc9b7e170b10b3023b02370fe1466fe3260291bc
Instruction ID: 970512c4873b1d0e703b05ecd4bdccfdc5be6a23ac97226c27668b309c72cf83
Opcode Fuzzy Hash: dcaa9a987d402ed95888ab43cc9b7e170b10b3023b02370fe1466fe3260291bc
Instruction Fuzzy Hash: 1DB26834F183455FFB17AA349C5476EFAE2AB81718F94C8A5E495DF3A2CB34AC018394

Uniqueness

Uniqueness Score: -1.00%

Function 00EC691F, Relevance: 6.1, APIs: 4, Instructions: 136threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00EC69A0
GetCurrentThread.KERNEL32 ref: 00EC69DD
GetCurrentProcess.KERNEL32 ref: 00EC6A1A
GetCurrentThreadId.KERNEL32 ref: 00EC6A73

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3aa8eaa9f986dcec000a181fcd77a0f09a96071d3026a39913fe8a14a9ecaef6
Instruction ID: be9dee701a025ecddc5a4d5e3650c3408415ddf2a136c05254f63fbd80b04ac3
Opcode Fuzzy Hash: 3aa8eaa9f986dcec000a181fcd77a0f09a96071d3026a39913fe8a14a9ecaef6
Instruction Fuzzy Hash: 425186B09043898FEB10CFA9D548B9EBFF0EF89304F14805EE448BB261D775A845CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EC6940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00EC69A0
GetCurrentThread.KERNEL32 ref: 00EC69DD
GetCurrentProcess.KERNEL32 ref: 00EC6A1A
GetCurrentThreadId.KERNEL32 ref: 00EC6A73

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0baae67734b6a4f03dff4bdbb167c46f2adb2d04a96347b47d6c06e58c440c30
Instruction ID: 0b0c50c988035cbb06d40c66b43e692aee963a286b297320a2efc04de2b13de9
Opcode Fuzzy Hash: 0baae67734b6a4f03dff4bdbb167c46f2adb2d04a96347b47d6c06e58c440c30
Instruction Fuzzy Hash: 425146B09006499FEB10CFAAD648B9EBBF0EF88314F24845DE459B7360D775A845CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00C89BE8, Relevance: 3.1, APIs: 2, Instructions: 81COMMON

Download Yara Rule

APIs

UserClientDllInitialize.USER32 ref: 00C89C70
UserClientDllInitialize.USER32 ref: 00C89CAE

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: ClientInitializeUser
String ID:
API String ID: 4216687631-0
Opcode ID: 0fdcfe88d6e20e96b230b64026a92194ba956e47ea6a509f924b255c8cc4cb19
Instruction ID: dbc8b7fc919ae0f0e2b9825959a7394d49a3b4dbce211d379584dc70022ecf8a
Opcode Fuzzy Hash: 0fdcfe88d6e20e96b230b64026a92194ba956e47ea6a509f924b255c8cc4cb19
Instruction Fuzzy Hash: 0621D830B042058FCB41EB7DD8456AE7BF1EB8A305B15C4A5E149EB392EB38DC068B61

Uniqueness

Uniqueness Score: -1.00%

Function 00C8E338, Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543de51b523f305f0c91b22f0b28081d27683e2a06272c09739d4e74a39088b2
Instruction ID: 4e30602834595b331da47b7c36df17d37ab90e0237375e092b0400a9b7819e97
Opcode Fuzzy Hash: 543de51b523f305f0c91b22f0b28081d27683e2a06272c09739d4e74a39088b2
Instruction Fuzzy Hash: 31412372E043958FCB00DFB9D8046EEBBB0EF89314F05856AD518A7251DB789D45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00EC5090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00EC51A2

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1a49682a701b97be521114146de74e7066317e34586bc95168f672d3316c4771
Instruction ID: e9d5f1b2bff30fee938be6f8b1ec1fd1ec04f12163c12a227369e6e3953a9cc9
Opcode Fuzzy Hash: 1a49682a701b97be521114146de74e7066317e34586bc95168f672d3316c4771
Instruction Fuzzy Hash: 5241C0B1D00749DFDF14CF99C984ADEBBB5BF88314F24812AE819AB210D775A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C8BF20, Relevance: 1.6, APIs: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00C8C024

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4d9003ee8418d7bc4a8151760e9a1b88b71161476b996e7e7d1218af265049cb
Instruction ID: 0e340346e3b73b16581208edfbbed233ea79042faf91c8fa5c04dfa36d4447d9
Opcode Fuzzy Hash: 4d9003ee8418d7bc4a8151760e9a1b88b71161476b996e7e7d1218af265049cb
Instruction Fuzzy Hash: BD4153B0904249CFDB00CFA9C584A8EFBF5AF49318F29C16AE418AB341D775A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C8C1CC, Relevance: 1.6, APIs: 1, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00C8C291

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 455698579ca165b560ae656b18aafd15a2edc047867430b8abf21a8c2a2128f0
Instruction ID: ad9cc3064754c044b6e26393bffdaf62ab7adaaac8e771d6b5796b2262e1fb9d
Opcode Fuzzy Hash: 455698579ca165b560ae656b18aafd15a2edc047867430b8abf21a8c2a2128f0
Instruction Fuzzy Hash: 904101B1D00258DFDB20DFEAC984B9EBBF5BF48314F14842AE819AB250D7749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EC779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00EC7F09

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 23adb1fb27278a6f256429eb685b4ab2160d8d3d3ae3c7b71b0d9a0d722fb512
Instruction ID: 8d13b244582ce47554f6f24e370a509e9e453950c743e8b9d5169e8728716eba
Opcode Fuzzy Hash: 23adb1fb27278a6f256429eb685b4ab2160d8d3d3ae3c7b71b0d9a0d722fb512
Instruction Fuzzy Hash: 5F416AB9A002458FDB14CF99C488FAABBF5FF88314F24849DE559A7310C775A842CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C87E60, Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00C8C291

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4107c17d0f8a4135391bda0cd9b602f5d79d178e78e486f2c6ad2f9f0703f3f7
Instruction ID: 7643f08db05c7fc7d0cfa04c651cd814eed03d7d12d849b8714894f43b746998
Opcode Fuzzy Hash: 4107c17d0f8a4135391bda0cd9b602f5d79d178e78e486f2c6ad2f9f0703f3f7
Instruction Fuzzy Hash: 3431D0B1D00258DFCB20DFDAC884A9EBBF5BF48314F15802AE819AB254D7749945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C87E54, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00C8C024

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 531d0788c53548afa2c4aebd29bc27027857f26aa041be4f9525d1377bd42d96
Instruction ID: 4e8503a67bcd2d400083adcec5ca9b0bc789be6754c10c6cafcfe9882442ca1e
Opcode Fuzzy Hash: 531d0788c53548afa2c4aebd29bc27027857f26aa041be4f9525d1377bd42d96
Instruction Fuzzy Hash: 4C3102B0D00249CFDB14CFA9C584A8EFFF5AF48304F25816AE408AB241C775A985CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00EC6B62, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00EC6BEF

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c58d3cde1dc789b219418c2e9347a2f0ee9aaaf29e3560ffcf02857064830866
Instruction ID: e09706129b58d0e897ae4ad2cef037bd77e35f65ef20ba8f57c7b32a602c8c27
Opcode Fuzzy Hash: c58d3cde1dc789b219418c2e9347a2f0ee9aaaf29e3560ffcf02857064830866
Instruction Fuzzy Hash: 8421D2B59002499FDB10CF99D584ADEFBF4FF48324F14842AE958A7310D378AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EC6B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00EC6BEF

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a47abc185dfc3240426b5d295783f128457b151dc4b7f6210a379c4380930477
Instruction ID: 1ed6ebb13f2bb9c34f086ca7fc25be71bc5c366f12b7be9da7df25d39b388c63
Opcode Fuzzy Hash: a47abc185dfc3240426b5d295783f128457b151dc4b7f6210a379c4380930477
Instruction Fuzzy Hash: 2821C4B59002499FDB10CF99D584BDEBBF8FB48324F14842AE958A3310D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ECC1A8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00ECC222

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 605df1ab3793c50bc00d424d71e91b5e617007b15c78c1a3c05560e169fd56fe
Instruction ID: 9a515919031b19f933bce0be4c80b526c78dcd0e992ad9aec48f1a2269a96df5
Opcode Fuzzy Hash: 605df1ab3793c50bc00d424d71e91b5e617007b15c78c1a3c05560e169fd56fe
Instruction Fuzzy Hash: 87118C709057498FDB10DFAAD90879EBBF4EB49328F24842DD408B7641D739A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C8E408, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00C8E477

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 40d7b22359e5e18453c59e5eb5899a8542c0f25b03127a0117740d5081ccc57f
Instruction ID: 2e2928ff8944c3c80c94b18953be2710f966162d2613d2d4cb6624ca6c5cc0d7
Opcode Fuzzy Hash: 40d7b22359e5e18453c59e5eb5899a8542c0f25b03127a0117740d5081ccc57f
Instruction Fuzzy Hash: AD1130B1C00669CBDB00CFAAD544BDEFBB4BF48324F15816AD828B7240D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EC40AA, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00EC4116

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f9db4615281cccf455121e3b37306120dcdf320a3edc24d8369e81a0eb0ef53f
Instruction ID: ccd92bddb06b5d54bdc8eff78f1f9f88eb26d8d15f6123c1916d315f1ac5d64f
Opcode Fuzzy Hash: f9db4615281cccf455121e3b37306120dcdf320a3edc24d8369e81a0eb0ef53f
Instruction Fuzzy Hash: 2011EFB68006498BDB10CF9AC444BDEFBF4EF89324F15852AD469B7240D379A946CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EC3300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00EC4116

Memory Dump Source

Source File: 00000002.00000002.911988923.0000000000EC0000.00000040.00000001.sdmp, Offset: 00EC0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1cb807ca6fb434b4f1c3c7be76179ff53213c4000a7bb629bec4f89b7ab684de
Instruction ID: adaf6a6dfe9b6e0abd9d4bf1d21f61c06b73305660a47da44844bcfc8f663db0
Opcode Fuzzy Hash: 1cb807ca6fb434b4f1c3c7be76179ff53213c4000a7bb629bec4f89b7ab684de
Instruction Fuzzy Hash: 171123B58006498BDB20CF9AC444BDEBBF4EB88324F14842AD969B7200D375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C89C97, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

UserClientDllInitialize.USER32 ref: 00C89CAE

Memory Dump Source

Source File: 00000002.00000002.911508838.0000000000C80000.00000040.00000001.sdmp, Offset: 00C80000, based on PE: false

Similarity

API ID: ClientInitializeUser
String ID:
API String ID: 4216687631-0
Opcode ID: bc4bc2a796cbb821ac031a6ec1eda5e425ad43336c113163e49fad603fc6ff17
Instruction ID: 39e844d1d2d5701c7054f56eb11d62dbb42b60ec5ef31b4d5bb0d937c3ff7748
Opcode Fuzzy Hash: bc4bc2a796cbb821ac031a6ec1eda5e425ad43336c113163e49fad603fc6ff17
Instruction Fuzzy Hash: 85E0C976B001158FCF04E7B8E856AED73F1EBC931571590A5E60AE7295DA389C028761

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report lT2TTQACRLGKK8w.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre