Loading ...

Play interactive tourEdit tour

Analysis Report Purchase Inquiry 040521.exe

Overview

General Information

Sample Name:Purchase Inquiry 040521.exe
Analysis ID:404251
MD5:23495a6a0fd6123653dea6900654b7f6
SHA1:ecc59be83b68aeb85b32ba2d317cd08b87054756
SHA256:670722e76eb0821959829571a7e70310d97b254abeba166950e39df1443482f9
Tags:AgentTeslaexesigned
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
.NET source code contains very large strings
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • Purchase Inquiry 040521.exe (PID: 2764 cmdline: 'C:\Users\user\Desktop\Purchase Inquiry 040521.exe' MD5: 23495A6A0FD6123653DEA6900654B7F6)
    • Purchase Inquiry 040521.exe (PID: 404 cmdline: C:\Users\user\Desktop\Purchase Inquiry 040521.exe MD5: 23495A6A0FD6123653DEA6900654B7F6)
    • Purchase Inquiry 040521.exe (PID: 2148 cmdline: C:\Users\user\Desktop\Purchase Inquiry 040521.exe MD5: 23495A6A0FD6123653DEA6900654B7F6)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "logs@phuboatrading-vn.comof2ZCW1li4ipTfyEsmtp.phuboatrading-vn.commylogs@phuboatrading-vn.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000000.00000002.266804598.0000000006414000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000003.00000002.504601701.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000002.266680605.0000000006321000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.Purchase Inquiry 040521.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.Purchase Inquiry 040521.exe.6349038.6.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.Purchase Inquiry 040521.exe.6414a78.7.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  0.2.Purchase Inquiry 040521.exe.6349038.6.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    0.2.Purchase Inquiry 040521.exe.6414a78.7.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 0.2.Purchase Inquiry 040521.exe.6349038.6.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "logs@phuboatrading-vn.comof2ZCW1li4ipTfyEsmtp.phuboatrading-vn.commylogs@phuboatrading-vn.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Purchase Inquiry 040521.exeVirustotal: Detection: 27%Perma Link
                      Source: Purchase Inquiry 040521.exeReversingLabs: Detection: 29%
                      Machine Learning detection for sampleShow sources
                      Source: Purchase Inquiry 040521.exeJoe Sandbox ML: detected
                      Source: 3.2.Purchase Inquiry 040521.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: Purchase Inquiry 040521.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Networking:

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49707 -> 79.141.164.23:25
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49708 -> 79.141.164.23:25
                      Source: Joe Sandbox ViewASN Name: HZ-NL-ASGB HZ-NL-ASGB
                      Source: global trafficTCP traffic: 192.168.2.7:49707 -> 79.141.164.23:25
                      Source: unknownDNS traffic detected: queries for: smtp.phuboatrading-vn.com
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://ocsp.digicert.com0C
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://ocsp.digicert.com0O
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.512221865.0000000003893000.00000004.00000001.sdmpString found in binary or memory: http://smtp.phuboatrading-vn.com
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmpString found in binary or memory: http://wcmZQs.com
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: http://www.digicert.com/CPS0
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmp, Purchase Inquiry 040521.exe, 00000003.00000002.512252947.00000000038A0000.00000004.00000001.sdmp, Purchase Inquiry 040521.exe, 00000003.00000003.469438441.0000000001634000.00000004.00000001.sdmpString found in binary or memory: https://1GkG9ex28fjVgSi6.org
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%t
                      Source: Purchase Inquiry 040521.exeString found in binary or memory: https://www.digicert.com/CPS0
                      Source: Purchase Inquiry 040521.exe, 00000000.00000002.266804598.0000000006414000.00000004.00000001.sdmp, Purchase Inquiry 040521.exe, 00000003.00000002.504601701.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      Key, Mouse, Clipboard, Microphone and Screen Capturing:

                      barindex
                      Installs a global keyboard hookShow sources
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\Purchase Inquiry 040521.exeJump to behavior
                      Source: Purchase Inquiry 040521.exe, 00000000.00000002.263411623.00000000016CB000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

                      System Summary:

                      barindex
                      .NET source code contains very large stringsShow sources
                      Source: Purchase Inquiry 040521.exe, ??????????????????????????????????????/???????????????????????????.csLong String: Length: 913158
                      Source: 0.2.Purchase Inquiry 040521.exe.d70000.0.unpack, ??????????????????????????????????????/???????????????????????????.csLong String: Length: 913158
                      Source: 0.0.Purchase Inquiry 040521.exe.d70000.0.unpack, ??????????????????????????????????????/???????????????????????????.csLong String: Length: 913158
                      Source: 2.0.Purchase Inquiry 040521.exe.2e0000.0.unpack, ??????????????????????????????????????/???????????????????????????.csLong String: Length: 913158
                      Source: 2.2.Purchase Inquiry 040521.exe.2e0000.0.unpack, ??????????????????????????????????????/???????????????????????????.csLong String: Length: 913158
                      Source: 3.0.Purchase Inquiry 040521.exe.fc0000.0.unpack, ??????????????????????????????????????/???????????????????????????.csLong String: Length: 913158
                      Source: 3.2.Purchase Inquiry 040521.exe.fc0000.1.unpack, ??????????????????????????????????????/???????????????????????????.csLong String: Length: 913158
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Purchase Inquiry 040521.exe
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeCode function: 0_2_016B24500_2_016B2450
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeCode function: 0_2_016B04B00_2_016B04B0
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeCode function: 0_2_016B2A680_2_016B2A68
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeCode function: 0_2_016B04A00_2_016B04A0
                      Source: Purchase Inquiry 040521.exeStatic PE information: invalid certificate
                      Source: Purchase Inquiry 040521.exeBinary or memory string: OriginalFilename vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000000.00000000.238107067.0000000000D72000.00000002.00020000.sdmpBinary or memory string: OriginalFilename*^,^4^I^+^N^T^ vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000000.00000002.266804598.0000000006414000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDLRV WZV.exe2 vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000000.00000002.266680605.0000000006321000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSHIT.dll* vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exeBinary or memory string: OriginalFilename vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000002.00000002.256543404.00000000002E2000.00000002.00020000.sdmpBinary or memory string: OriginalFilename*^,^4^I^+^N^T^ vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.507965536.0000000001890000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000003.00000000.257704057.0000000000FC2000.00000002.00020000.sdmpBinary or memory string: OriginalFilename*^,^4^I^+^N^T^ vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.506690785.0000000001538000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.504601701.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameDLRV WZV.exe2 vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.507872968.0000000001850000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs Purchase Inquiry 040521.exe
                      Source: Purchase Inquiry 040521.exeBinary or memory string: OriginalFilename*^,^4^I^+^N^T^ vs Purchase Inquiry 040521.exe
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@5/2@1/2
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Inquiry 040521.exe.logJump to behavior
                      Source: Purchase Inquiry 040521.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: Purchase Inquiry 040521.exeVirustotal: Detection: 27%
                      Source: Purchase Inquiry 040521.exeReversingLabs: Detection: 29%
                      Source: unknownProcess created: C:\Users\user\Desktop\Purchase Inquiry 040521.exe 'C:\Users\user\Desktop\Purchase Inquiry 040521.exe'
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess created: C:\Users\user\Desktop\Purchase Inquiry 040521.exe C:\Users\user\Desktop\Purchase Inquiry 040521.exe
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess created: C:\Users\user\Desktop\Purchase Inquiry 040521.exe C:\Users\user\Desktop\Purchase Inquiry 040521.exe
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess created: C:\Users\user\Desktop\Purchase Inquiry 040521.exe C:\Users\user\Desktop\Purchase Inquiry 040521.exeJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess created: C:\Users\user\Desktop\Purchase Inquiry 040521.exe C:\Users\user\Desktop\Purchase Inquiry 040521.exeJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: Purchase Inquiry 040521.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Purchase Inquiry 040521.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                      Source: Purchase Inquiry 040521.exeStatic file information: File size 1842016 > 1048576
                      Source: Purchase Inquiry 040521.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x1bfa00
                      Source: Purchase Inquiry 040521.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Purchase Inquiry 040521.exeStatic PE information: 0xB19AE11D [Tue Jun 3 11:16:45 2064 UTC]
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeCode function: 0_2_016B606C pushfd ; ret 0_2_016B6081
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWindow / User API: threadDelayed 1334Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWindow / User API: threadDelayed 8483Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exe TID: 6092Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exe TID: 1744Thread sleep time: -12912720851596678s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exe TID: 2172Thread sleep count: 1334 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exe TID: 2172Thread sleep count: 8483 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exe TID: 1744Thread sleep count: 39 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.514848871.0000000007430000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeMemory written: C:\Users\user\Desktop\Purchase Inquiry 040521.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess created: C:\Users\user\Desktop\Purchase Inquiry 040521.exe C:\Users\user\Desktop\Purchase Inquiry 040521.exeJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeProcess created: C:\Users\user\Desktop\Purchase Inquiry 040521.exe C:\Users\user\Desktop\Purchase Inquiry 040521.exeJump to behavior
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510088195.0000000002030000.00000002.00000001.sdmpBinary or memory string: uProgram Manager
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510088195.0000000002030000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510088195.0000000002030000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Purchase Inquiry 040521.exe, 00000003.00000002.510088195.0000000002030000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Users\user\Desktop\Purchase Inquiry 040521.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Users\user\Desktop\Purchase Inquiry 040521.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.266804598.0000000006414000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.504601701.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.266680605.0000000006321000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Inquiry 040521.exe PID: 2148, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Inquiry 040521.exe PID: 2764, type: MEMORY
                      Source: Yara matchFile source: 3.2.Purchase Inquiry 040521.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Purchase Inquiry 040521.exe.6349038.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Purchase Inquiry 040521.exe.6414a78.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Purchase Inquiry 040521.exe.6349038.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Purchase Inquiry 040521.exe.6414a78.7.raw.unpack, type: UNPACKEDPE
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: C:\Users\user\Desktop\Purchase Inquiry 040521.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                      Source: Yara matchFile source: 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Inquiry 040521.exe PID: 2148, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000003.00000002.510693698.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.266804598.0000000006414000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.504601701.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.266680605.0000000006321000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Inquiry 040521.exe PID: 2148, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Inquiry 040521.exe PID: 2764, type: MEMORY
                      Source: Yara matchFile source: 3.2.Purchase Inquiry 040521.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Purchase Inquiry 040521.exe.6349038.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Purchase Inquiry 040521.exe.6414a78.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Purchase Inquiry 040521.exe.6349038.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Purchase Inquiry 040521.exe.6414a78.7.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection112Masquerading1OS Credential Dumping2Security Software Discovery111Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1Input Capture111Process Discovery2Remote Desktop ProtocolInput Capture111Exfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion131Credentials in Registry1Virtualization/Sandbox Evasion131SMB/Windows Admin SharesArchive Collected Data1Automated ExfiltrationApplication Layer Protocol11Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSApplication Window Discovery1Distributed Component Object ModelData from Local System2Scheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information1LSA SecretsRemote System Discovery1SSHClipboard Data1Data Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing1Cached Domain CredentialsSystem Information Discovery114VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsTimestomp1DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files