Loading ...

Play interactive tourEdit tour

Analysis Report lT2TTQACRLGKK8w.exe

Overview

General Information

Sample Name:lT2TTQACRLGKK8w.exe
Analysis ID:404238
MD5:8c2987ef25996649be1a2d6f2150a30d
SHA1:2b8425dbc57e93fbb2a9bf6d45a491ccc15f0d5d
SHA256:b1f7ca6e53ff7dd757a49539f5e5c18bfeabbe24b06270ce08df45f1c2efffff
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • lT2TTQACRLGKK8w.exe (PID: 6980 cmdline: 'C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe' MD5: 8C2987EF25996649BE1A2D6F2150A30D)
    • lT2TTQACRLGKK8w.exe (PID: 7092 cmdline: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe MD5: 8C2987EF25996649BE1A2D6F2150A30D)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "office3@iykmoreentrprise.orgrwkWCM328mail.iykmoreentrprise.org"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.lT2TTQACRLGKK8w.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

                  Sigma Overview

                  No Sigma rule has matched

                  Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "office3@iykmoreentrprise.orgrwkWCM328mail.iykmoreentrprise.org"}
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: lT2TTQACRLGKK8w.exeReversingLabs: Detection: 19%
                  Machine Learning detection for sampleShow sources
                  Source: lT2TTQACRLGKK8w.exeJoe Sandbox ML: detected
                  Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                  Source: global trafficTCP traffic: 192.168.2.4:49770 -> 66.70.204.222:587
                  Source: Joe Sandbox ViewIP Address: 66.70.204.222 66.70.204.222
                  Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
                  Source: global trafficTCP traffic: 192.168.2.4:49770 -> 66.70.204.222:587
                  Source: unknownDNS traffic detected: queries for: mail.iykmoreentrprise.org
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpString found in binary or memory: http://NdOlex.com
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpString found in binary or memory: http://cps.letsencrypt.org0
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpString found in binary or memory: http://cps.root-x1.letsencrypt.org0
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpString found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912109224.0000000000F03000.00000004.00000020.sdmpString found in binary or memory: http://go.microsoft.cz
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912804837.0000000002D88000.00000004.00000001.sdmpString found in binary or memory: http://iykmoreentrprise.org
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912804837.0000000002D88000.00000004.00000001.sdmpString found in binary or memory: http://mail.iykmoreentrprise.org
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpString found in binary or memory: http://r3.i.lencr.org/0
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpString found in binary or memory: http://r3.o.lencr.org0
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655099093.0000000003121000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: lT2TTQACRLGKK8w.exeString found in binary or memory: http://vbcity.com/forums/t/51894.aspx
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%$
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                  Source: lT2TTQACRLGKK8w.exeString found in binary or memory: https://github.com/MrCylops
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912725062.0000000002D32000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912880410.0000000002DB5000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912771188.0000000002D7E000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912865775.0000000002DAD000.00000004.00000001.sdmpString found in binary or memory: https://wl0H8jlTH4n9kj.org
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                  System Summary:

                  barindex
                  .NET source code contains very large array initializationsShow sources
                  Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b56ED34DBu002dB13Du002d4E78u002dAB1Eu002dFFE9EC311CA5u007d/C4710566u002dA0DFu002d4617u002dB65Cu002d8842CDFCB5A1.csLarge array initialization: .cctor: array initializer size 11967
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_00CBA1D3
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0162C2B0
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_01629990
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B978BF8
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B977960
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B9762E8
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B9709A8
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B971918
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B971928
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B970944
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B970FEC
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B975F18
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B975F28
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B971E51
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B971E60
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B973399
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B9733A8
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B9762D8
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B972180
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B972171
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B976589
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B976523
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B974410
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B974400
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B97242B
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_00CBA42F
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_006FA1D3
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00C88060
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00C81B50
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00C84310
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00C866E8
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00C89D58
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00C8E720
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00EC46A0
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00EC4690
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00EC4672
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_006FA42F
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000000.645706234.0000000000D5C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUnauthorizedAccessException.exe> vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655099093.0000000003121000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll( vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655099093.0000000003121000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameBEpnzqbDkEzvjXIwxhKwj.exe4 vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.659378273.00000000063B0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameBEpnzqbDkEzvjXIwxhKwj.exe4 vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.911283055.000000000079C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUnauthorizedAccessException.exe> vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.911346617.0000000000B38000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912036273.0000000000ED8000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.915794812.0000000006330000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exeBinary or memory string: OriginalFilenameUnauthorizedAccessException.exe> vs lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@2/1
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lT2TTQACRLGKK8w.exe.logJump to behavior
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
                  Source: lT2TTQACRLGKK8w.exeReversingLabs: Detection: 19%
                  Source: unknownProcess created: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe 'C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe'
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess created: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess created: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: lT2TTQACRLGKK8w.exeStatic PE information: 0x9913AE82 [Sat May 20 13:58:26 2051 UTC]
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 0_2_0B975859 push 1A34BA5Ch; ret
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_3_00F656CB push ds; retf
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_3_00F66DB1 push edi; retf
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_3_00F649BB pushad ; retf
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_3_00F690BB push ss; ret
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_3_00F68FAB push es; iretd
                  Source: initial sampleStatic PE information: section name: .text entropy: 7.4929930225
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion:

                  barindex
                  Yara detected AntiVM3Show sources
                  Source: Yara matchFile source: 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 6980, type: MEMORY
                  Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                  Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                  Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeWindow / User API: threadDelayed 1865
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeWindow / User API: threadDelayed 7968
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 6984Thread sleep time: -101227s >= -30000s
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 7000Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 3120Thread sleep time: -19369081277395017s >= -30000s
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 4984Thread sleep count: 1865 > 30
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe TID: 4984Thread sleep count: 7968 > 30
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeThread delayed: delay time: 101227
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeThread delayed: delay time: 922337203685477
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: vmware
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000003.869177633.0000000000F5B000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllce\H
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                  Source: lT2TTQACRLGKK8w.exeBinary or memory string: Hyper-V RAW
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: VMWARE
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                  Source: lT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess information queried: ProcessInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeCode function: 2_2_00C88060 LdrInitializeThunk,
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeMemory allocated: page read and write | page guard

                  HIPS / PFW / Operating System Protection Evasion:

                  barindex
                  .NET source code references suspicious native API functionsShow sources
                  Source: lT2TTQACRLGKK8w.exe, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                  Source: lT2TTQACRLGKK8w.exe, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                  Source: 0.2.lT2TTQACRLGKK8w.exe.cb0000.0.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                  Source: 0.2.lT2TTQACRLGKK8w.exe.cb0000.0.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                  Source: 0.0.lT2TTQACRLGKK8w.exe.cb0000.0.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                  Source: 0.0.lT2TTQACRLGKK8w.exe.cb0000.0.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                  Source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, A/b2.csReference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
                  Source: 2.0.lT2TTQACRLGKK8w.exe.6f0000.0.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                  Source: 2.0.lT2TTQACRLGKK8w.exe.6f0000.0.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                  Source: 2.2.lT2TTQACRLGKK8w.exe.6f0000.1.unpack, ProcessClass.csReference to suspicious API methods: ('OpenProcess', 'OpenProcess@kernel32.dll')
                  Source: 2.2.lT2TTQACRLGKK8w.exe.6f0000.1.unpack, Memory.csReference to suspicious API methods: ('WriteProcessMemory', 'WriteProcessMemory@kernel32.dll'), ('ReadProcessMemory', 'ReadProcessMemory@kernel32.dll')
                  Injects a PE file into a foreign processesShow sources
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeMemory written: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe base: 400000 value starts with: 4D5A
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeProcess created: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912309734.0000000001490000.00000002.00000001.sdmpBinary or memory string: Program Manager
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912309734.0000000001490000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912309734.0000000001490000.00000002.00000001.sdmpBinary or memory string: Progman
                  Source: lT2TTQACRLGKK8w.exe, 00000002.00000002.912309734.0000000001490000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                  Stealing of Sensitive Information:

                  barindex
                  Yara detected AgentTeslaShow sources
                  Source: Yara matchFile source: 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 6980, type: MEMORY
                  Source: Yara matchFile source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.raw.unpack, type: UNPACKEDPE
                  Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                  Tries to harvest and steal browser information (history, passwords, etc)Show sources
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                  Tries to harvest and steal ftp login credentialsShow sources
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                  Tries to steal Mail credentials (via file access)Show sources
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                  Source: C:\Users\user\Desktop\lT2TTQACRLGKK8w.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                  Source: Yara matchFile source: 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092, type: MEMORY

                  Remote Access Functionality:

                  barindex
                  Yara detected AgentTeslaShow sources
                  Source: Yara matchFile source: 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 7092, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: lT2TTQACRLGKK8w.exe PID: 6980, type: MEMORY
                  Source: Yara matchFile source: 2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.lT2TTQACRLGKK8w.exe.4234ac8.3.raw.unpack, type: UNPACKEDPE

                  Mitre Att&ck Matrix

                  Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                  Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection112Masquerading1OS Credential Dumping2Query Registry1Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                  Default AccountsNative API1Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1Credentials in Registry1Security Software Discovery211Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                  Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion131Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Local System2Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                  Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSVirtualization/Sandbox Evasion131Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol11SIM Card SwapCarrier Billing Fraud
                  Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                  Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information3Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                  External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncSystem Information Discovery114Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                  Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobTimestomp1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                  Behavior Graph

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  lT2TTQACRLGKK8w.exe19%ReversingLabsByteCode-MSIL.Trojan.Injuke
                  lT2TTQACRLGKK8w.exe100%Joe Sandbox ML

                  Dropped Files

                  No Antivirus matches

                  Unpacked PE Files

                  SourceDetectionScannerLabelLinkDownload
                  2.2.lT2TTQACRLGKK8w.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                  Domains

                  SourceDetectionScannerLabelLink
                  mail.iykmoreentrprise.org1%VirustotalBrowse

                  URLs

                  SourceDetectionScannerLabelLink
                  http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                  http://iykmoreentrprise.org0%Avira URL Cloudsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://cps.letsencrypt.org00%URL Reputationsafe
                  http://cps.letsencrypt.org00%URL Reputationsafe
                  http://cps.letsencrypt.org00%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  http://go.microsoft.cz0%Avira URL Cloudsafe
                  https://wl0H8jlTH4n9kj.org0%Avira URL Cloudsafe
                  http://r3.o.lencr.org00%URL Reputationsafe
                  http://r3.o.lencr.org00%URL Reputationsafe
                  http://r3.o.lencr.org00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  http://NdOlex.com0%Avira URL Cloudsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  http://mail.iykmoreentrprise.org0%Avira URL Cloudsafe
                  https://api.ipify.org%$0%Avira URL Cloudsafe
                  http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
                  http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
                  http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
                  http://r3.i.lencr.org/00%URL Reputationsafe
                  http://r3.i.lencr.org/00%URL Reputationsafe
                  http://r3.i.lencr.org/00%URL Reputationsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  iykmoreentrprise.org
                  66.70.204.222
                  truetrue
                    unknown
                    mail.iykmoreentrprise.org
                    unknown
                    unknowntrueunknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://127.0.0.1:HTTP/1.1lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    low
                    http://iykmoreentrprise.orglT2TTQACRLGKK8w.exe, 00000002.00000002.912804837.0000000002D88000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    unknown
                    http://DynDns.comDynDNSlT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://vbcity.com/forums/t/51894.aspxlT2TTQACRLGKK8w.exefalse
                      high
                      http://cps.letsencrypt.org0lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%halT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://go.microsoft.czlT2TTQACRLGKK8w.exe, 00000002.00000002.912109224.0000000000F03000.00000004.00000020.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      https://wl0H8jlTH4n9kj.orglT2TTQACRLGKK8w.exe, 00000002.00000002.912725062.0000000002D32000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912880410.0000000002DB5000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912771188.0000000002D7E000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.912865775.0000000002DAD000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      http://r3.o.lencr.org0lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://api.ipify.org%GETMozilla/5.0lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      low
                      http://NdOlex.comlT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namelT2TTQACRLGKK8w.exe, 00000000.00000002.655099093.0000000003121000.00000004.00000001.sdmpfalse
                        high
                        https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziplT2TTQACRLGKK8w.exe, 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, lT2TTQACRLGKK8w.exe, 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.csslT2TTQACRLGKK8w.exe, 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmpfalse
                          high
                          http://mail.iykmoreentrprise.orglT2TTQACRLGKK8w.exe, 00000002.00000002.912804837.0000000002D88000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          unknown
                          https://api.ipify.org%$lT2TTQACRLGKK8w.exe, 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          low
                          http://cps.root-x1.letsencrypt.org0lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          http://r3.i.lencr.org/0lT2TTQACRLGKK8w.exe, 00000002.00000003.869228156.0000000000FA7000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          https://github.com/MrCylopslT2TTQACRLGKK8w.exefalse
                            high

                            Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public

                            IPDomainCountryFlagASNASN NameMalicious
                            66.70.204.222
                            iykmoreentrprise.orgCanada
                            16276OVHFRtrue

                            General Information

                            Joe Sandbox Version:32.0.0 Black Diamond
                            Analysis ID:404238
                            Start date:04.05.2021
                            Start time:20:36:06
                            Joe Sandbox Product:CloudBasic
                            Overall analysis duration:0h 8m 58s
                            Hypervisor based Inspection enabled:false
                            Report type:light
                            Sample file name:lT2TTQACRLGKK8w.exe
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                            Number of analysed new started processes analysed:17
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • HDC enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Detection:MAL
                            Classification:mal100.troj.spyw.evad.winEXE@3/1@2/1
                            EGA Information:Failed
                            HDC Information:Failed
                            HCA Information:
                            • Successful, ratio: 100%
                            • Number of executed functions: 0
                            • Number of non-executed functions: 0
                            Cookbook Comments:
                            • Adjust boot time
                            • Enable AMSI
                            • Found application associated with file extension: .exe
                            Warnings:
                            Show All
                            • Excluded IPs from analysis (whitelisted): 104.43.139.144, 13.88.21.125, 13.64.90.137, 40.88.32.150, 52.147.198.201, 20.82.210.154, 92.122.213.194, 92.122.213.247, 52.155.217.156, 20.54.26.129, 40.64.101.146, 2.20.142.209, 2.20.142.210, 20.50.102.62
                            • Excluded domains from analysis (whitelisted): mw1eap.displaycatalog.md.mp.microsoft.com.akadns.net, au.download.windowsupdate.com.edgesuite.net, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, arc.msn.com.nsatc.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, consumerrp-displaycatalog-aks2eap-uswest.md.mp.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, displaycatalog-uswesteap.md.mp.microsoft.com.akadns.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            20:36:55API Interceptor816x Sleep call for process: lT2TTQACRLGKK8w.exe modified

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                            66.70.204.222pd9EeXdsQtNb3dQ.exeGet hashmaliciousBrowse
                              SecuriteInfo.com.W32.MSIL_Troj.ASI.genEldorado.27642.exeGet hashmaliciousBrowse
                                MZyeln5mSFOjxMx.exeGet hashmaliciousBrowse
                                  FFrIJMwrI9cxeIZ.exeGet hashmaliciousBrowse
                                    cljz48xwqb2VSBN.exeGet hashmaliciousBrowse
                                      QTY 98657 RFQ MANDATE 020521.0003YDK.exeGet hashmaliciousBrowse
                                        foakTEjUOvL9nBY.exeGet hashmaliciousBrowse
                                          n4QstFh7YkjVcrU.exeGet hashmaliciousBrowse
                                            AVuOP2vLzIMRG88.exeGet hashmaliciousBrowse
                                              316e3796_by_Libranalysis.exeGet hashmaliciousBrowse
                                                GQTY 98657 RFQ MANDATE 28421.02AWYD.exeGet hashmaliciousBrowse
                                                  VJNPltkyHyI3CCo.exeGet hashmaliciousBrowse
                                                    0L2qr7kJMh40sxq.exeGet hashmaliciousBrowse
                                                      ApuE9QrdQxe7Um6.exeGet hashmaliciousBrowse
                                                        77iET1jNLJyV8ez.exeGet hashmaliciousBrowse
                                                          bOkrXdoYekZPyWI.exeGet hashmaliciousBrowse
                                                            ayZYB5SkqMPA06M.exeGet hashmaliciousBrowse
                                                              fyZ6iHys7ClIHFR.exeGet hashmaliciousBrowse
                                                                uMLNLd9kgPez84h.exeGet hashmaliciousBrowse
                                                                  YQfInBo2DDpDfIX.exeGet hashmaliciousBrowse

                                                                    Domains

                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext

                                                                    ASN

                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                    OVHFR165395_BHU.msiGet hashmaliciousBrowse
                                                                    • 158.69.144.121
                                                                    jEEGrwHl1H.exeGet hashmaliciousBrowse
                                                                    • 51.195.61.169
                                                                    6R9cyNLikC.exeGet hashmaliciousBrowse
                                                                    • 51.195.61.169
                                                                    c862293a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    29ec7ed7_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    c862293a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    29ec7ed7_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    37d2a6e3_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    0f003adb_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    a5a88fbb_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    d2d35294_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    58917039_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    636f06a6_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    37d2a6e3_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    0f003adb_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    a5a88fbb_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    636f06a6_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    d2d35294_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    • 167.114.113.13
                                                                    Outstanding-Debt-610716193-05042021.xlsmGet hashmaliciousBrowse
                                                                    • 51.89.73.159
                                                                    Outstanding-Debt-1840996632-05042021.xlsmGet hashmaliciousBrowse
                                                                    • 51.89.73.159

                                                                    JA3 Fingerprints

                                                                    No context

                                                                    Dropped Files

                                                                    No context

                                                                    Created / dropped Files

                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lT2TTQACRLGKK8w.exe.log
                                                                    Process:C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):1314
                                                                    Entropy (8bit):5.350128552078965
                                                                    Encrypted:false
                                                                    SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                                                    MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                                                    SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                                                    SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                                                    SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                                                    Malicious:true
                                                                    Reputation:high, very likely benign file
                                                                    Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                                                    Static File Info

                                                                    General

                                                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Entropy (8bit):7.481252144870754
                                                                    TrID:
                                                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                    • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                    • Windows Screen Saver (13104/52) 0.07%
                                                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                                                    File name:lT2TTQACRLGKK8w.exe
                                                                    File size:694272
                                                                    MD5:8c2987ef25996649be1a2d6f2150a30d
                                                                    SHA1:2b8425dbc57e93fbb2a9bf6d45a491ccc15f0d5d
                                                                    SHA256:b1f7ca6e53ff7dd757a49539f5e5c18bfeabbe24b06270ce08df45f1c2efffff
                                                                    SHA512:381ad7adbbe661b1bf4e58a94c8b885ad2f94cdb994dede6f94025c6587218653cb79c1fa0b8ecb9c8e8682c2cafb64d3247aa5d4cb99f883dbb44ed1d96e0bb
                                                                    SSDEEP:12288:Yt/TBPnNHKManc2gOAQLJtQYxMxJrw9a76Yij+fKFKATuQyrz9+srtgO3pP2:YqfQYx8J09uk6fKEDp1L5P2
                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................P.................. ........@.. ....................................@................................

                                                                    File Icon

                                                                    Icon Hash:00828e8e8686b000

                                                                    Static PE Info

                                                                    General

                                                                    Entrypoint:0x4aaa12
                                                                    Entrypoint Section:.text
                                                                    Digitally signed:false
                                                                    Imagebase:0x400000
                                                                    Subsystem:windows gui
                                                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                    DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                    Time Stamp:0x9913AE82 [Sat May 20 13:58:26 2051 UTC]
                                                                    TLS Callbacks:
                                                                    CLR (.Net) Version:v4.0.30319
                                                                    OS Version Major:4
                                                                    OS Version Minor:0
                                                                    File Version Major:4
                                                                    File Version Minor:0
                                                                    Subsystem Version Major:4
                                                                    Subsystem Version Minor:0
                                                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                    Entrypoint Preview

                                                                    Instruction
                                                                    jmp dword ptr [00402000h]
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al

                                                                    Data Directories

                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xaa9c00x4f.text
                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xac0000x60c.rsrc
                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0xae0000xc.reloc
                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0xaa9a40x1c.text
                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                    Sections

                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                    .text0x20000xa8a180xa8c00False0.79830150463data7.4929930225IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                    .rsrc0xac0000x60c0x800False0.32958984375data3.4332919236IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                    .reloc0xae0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                    Resources

                                                                    NameRVASizeTypeLanguageCountry
                                                                    RT_VERSION0xac0900x37cdata
                                                                    RT_MANIFEST0xac41c0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                    Imports

                                                                    DLLImport
                                                                    mscoree.dll_CorExeMain

                                                                    Version Infos

                                                                    DescriptionData
                                                                    Translation0x0000 0x04b0
                                                                    LegalCopyrightCopyright 2019
                                                                    Assembly Version1.0.0.0
                                                                    InternalNameUnauthorizedAccessException.exe
                                                                    FileVersion1.0.0.0
                                                                    CompanyName
                                                                    LegalTrademarks
                                                                    Comments
                                                                    ProductNameStarEggControl
                                                                    ProductVersion1.0.0.0
                                                                    FileDescriptionStarEggControl
                                                                    OriginalFilenameUnauthorizedAccessException.exe

                                                                    Network Behavior

                                                                    Network Port Distribution

                                                                    TCP Packets

                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    May 4, 2021 20:38:36.071686983 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:36.201476097 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:36.201631069 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:36.358669043 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:36.359447002 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:36.492664099 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:36.493119955 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:36.624587059 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:36.671040058 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:36.711306095 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:36.847898006 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:36.847923994 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:36.847935915 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:36.848001957 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:36.857160091 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:36.994720936 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:37.046267033 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:37.305923939 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:37.436254978 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:37.438693047 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:37.568897009 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:37.570415020 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:37.721539021 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:37.722697020 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:37.854373932 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:37.855051994 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:37.985609055 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:37.986335039 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:38.116169930 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:38.119088888 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:38.119370937 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:38.120187998 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:38.120382071 CEST49770587192.168.2.466.70.204.222
                                                                    May 4, 2021 20:38:38.251784086 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:38.251806021 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:38.252053022 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:38.252562046 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:38.253463984 CEST5874977066.70.204.222192.168.2.4
                                                                    May 4, 2021 20:38:38.296133041 CEST49770587192.168.2.466.70.204.222

                                                                    UDP Packets

                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    May 4, 2021 20:36:46.585772991 CEST6238953192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:46.634201050 CEST53623898.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:48.053796053 CEST4991053192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:48.105243921 CEST53499108.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:49.203061104 CEST5585453192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:49.254549980 CEST53558548.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:50.551326036 CEST6454953192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:50.608330965 CEST53645498.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:52.393086910 CEST6315353192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:52.442821026 CEST53631538.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:53.377943993 CEST5299153192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:53.429469109 CEST53529918.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:54.522610903 CEST5370053192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:54.582078934 CEST53537008.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:56.112008095 CEST5172653192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:56.163491011 CEST53517268.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:57.362030983 CEST5679453192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:57.410797119 CEST53567948.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:58.707501888 CEST5653453192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:58.756108999 CEST53565348.8.8.8192.168.2.4
                                                                    May 4, 2021 20:36:59.895889044 CEST5662753192.168.2.48.8.8.8
                                                                    May 4, 2021 20:36:59.947436094 CEST53566278.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:01.627568960 CEST5662153192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:01.677361012 CEST53566218.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:02.856363058 CEST6311653192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:02.907125950 CEST53631168.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:05.890660048 CEST6407853192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:05.939929008 CEST53640788.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:07.141864061 CEST6480153192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:07.192564964 CEST53648018.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:07.913377047 CEST6172153192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:07.975424051 CEST53617218.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:09.184504032 CEST5125553192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:09.236638069 CEST53512558.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:11.567977905 CEST6152253192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:11.619905949 CEST53615228.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:12.461430073 CEST5233753192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:12.512180090 CEST53523378.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:16.670963049 CEST5504653192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:16.721472979 CEST53550468.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:21.651101112 CEST4961253192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:21.709496975 CEST53496128.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:38.350974083 CEST4928553192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:38.500468969 CEST53492858.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:39.094322920 CEST5060153192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:39.154207945 CEST53506018.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:39.712543964 CEST6087553192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:39.772344112 CEST53608758.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:40.102238894 CEST5644853192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:40.167395115 CEST53564488.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:40.205920935 CEST5917253192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:40.350033045 CEST53591728.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:41.551826000 CEST6242053192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:41.609040976 CEST53624208.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:41.638432980 CEST6057953192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:41.695399046 CEST53605798.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:42.965420008 CEST5018353192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:43.028286934 CEST53501838.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:43.536386013 CEST6153153192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:43.667934895 CEST53615318.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:44.458900928 CEST4922853192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:44.516117096 CEST53492288.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:45.366816044 CEST5979453192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:45.424849987 CEST53597948.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:45.950923920 CEST5591653192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:45.999566078 CEST53559168.8.8.8192.168.2.4
                                                                    May 4, 2021 20:37:54.138750076 CEST5275253192.168.2.48.8.8.8
                                                                    May 4, 2021 20:37:54.188909054 CEST53527528.8.8.8192.168.2.4
                                                                    May 4, 2021 20:38:26.354702950 CEST6054253192.168.2.48.8.8.8
                                                                    May 4, 2021 20:38:26.406428099 CEST53605428.8.8.8192.168.2.4
                                                                    May 4, 2021 20:38:28.856625080 CEST6068953192.168.2.48.8.8.8
                                                                    May 4, 2021 20:38:28.917644978 CEST53606898.8.8.8192.168.2.4
                                                                    May 4, 2021 20:38:35.787714005 CEST6420653192.168.2.48.8.8.8
                                                                    May 4, 2021 20:38:35.867779970 CEST53642068.8.8.8192.168.2.4
                                                                    May 4, 2021 20:38:35.883652925 CEST5090453192.168.2.48.8.8.8
                                                                    May 4, 2021 20:38:35.956926107 CEST53509048.8.8.8192.168.2.4

                                                                    DNS Queries

                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                    May 4, 2021 20:38:35.787714005 CEST192.168.2.48.8.8.80xd34cStandard query (0)mail.iykmoreentrprise.orgA (IP address)IN (0x0001)
                                                                    May 4, 2021 20:38:35.883652925 CEST192.168.2.48.8.8.80x4b1bStandard query (0)mail.iykmoreentrprise.orgA (IP address)IN (0x0001)

                                                                    DNS Answers

                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                    May 4, 2021 20:38:35.867779970 CEST8.8.8.8192.168.2.40xd34cNo error (0)mail.iykmoreentrprise.orgiykmoreentrprise.orgCNAME (Canonical name)IN (0x0001)
                                                                    May 4, 2021 20:38:35.867779970 CEST8.8.8.8192.168.2.40xd34cNo error (0)iykmoreentrprise.org66.70.204.222A (IP address)IN (0x0001)
                                                                    May 4, 2021 20:38:35.956926107 CEST8.8.8.8192.168.2.40x4b1bNo error (0)mail.iykmoreentrprise.orgiykmoreentrprise.orgCNAME (Canonical name)IN (0x0001)
                                                                    May 4, 2021 20:38:35.956926107 CEST8.8.8.8192.168.2.40x4b1bNo error (0)iykmoreentrprise.org66.70.204.222A (IP address)IN (0x0001)

                                                                    SMTP Packets

                                                                    TimestampSource PortDest PortSource IPDest IPCommands
                                                                    May 4, 2021 20:38:36.358669043 CEST5874977066.70.204.222192.168.2.4220-server.wlcserver.com ESMTP Exim 4.94 #2 Tue, 04 May 2021 22:38:36 +0400
                                                                    220-We do not authorize the use of this system to transport unsolicited,
                                                                    220 and/or bulk e-mail.
                                                                    May 4, 2021 20:38:36.359447002 CEST49770587192.168.2.466.70.204.222EHLO 849224
                                                                    May 4, 2021 20:38:36.492664099 CEST5874977066.70.204.222192.168.2.4250-server.wlcserver.com Hello 849224 [84.17.52.3]
                                                                    250-SIZE 52428800
                                                                    250-8BITMIME
                                                                    250-PIPELINING
                                                                    250-X_PIPE_CONNECT
                                                                    250-STARTTLS
                                                                    250 HELP
                                                                    May 4, 2021 20:38:36.493119955 CEST49770587192.168.2.466.70.204.222STARTTLS
                                                                    May 4, 2021 20:38:36.624587059 CEST5874977066.70.204.222192.168.2.4220 TLS go ahead

                                                                    Code Manipulations

                                                                    Statistics

                                                                    Behavior

                                                                    Click to jump to process

                                                                    System Behavior

                                                                    General

                                                                    Start time:20:36:53
                                                                    Start date:04/05/2021
                                                                    Path:C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:'C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe'
                                                                    Imagebase:0xcb0000
                                                                    File size:694272 bytes
                                                                    MD5 hash:8C2987EF25996649BE1A2D6F2150A30D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:.Net C# or VB.NET
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.656573147.0000000004129000.00000004.00000001.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.655179728.0000000003174000.00000004.00000001.sdmp, Author: Joe Security
                                                                    Reputation:low

                                                                    General

                                                                    Start time:20:36:57
                                                                    Start date:04/05/2021
                                                                    Path:C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
                                                                    Wow64 process (32bit):true
                                                                    Commandline:C:\Users\user\Desktop\lT2TTQACRLGKK8w.exe
                                                                    Imagebase:0x6f0000
                                                                    File size:694272 bytes
                                                                    MD5 hash:8C2987EF25996649BE1A2D6F2150A30D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:.Net C# or VB.NET
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.911137710.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.912431014.0000000002A21000.00000004.00000001.sdmp, Author: Joe Security
                                                                    Reputation:low

                                                                    Disassembly

                                                                    Code Analysis

                                                                    Reset < >