Play interactive tour

Edit tour

Analysis Report Ko4zQgTBHv.exe

Overview

General Information

Sample Name:	Ko4zQgTBHv.exe
Analysis ID:	412502
MD5:	02bc365a934e558eb634e19dd2d33e64
SHA1:	a7fcb0381c4f68ebea3dda4508a789a23eb9f637
SHA256:	bd97a138f3c0b9b078c119bcb59793ceca55120411c95635cc4d12c01406c2cd
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

Ko4zQgTBHv.exe (PID: 6484 cmdline: 'C:\Users\user\Desktop\Ko4zQgTBHv.exe' MD5: 02BC365A934E558EB634E19DD2D33E64)

schtasks.exe (PID: 6660 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vZvprBd' /XML 'C:\Users\user\AppData\Local\Temp\tmpF3F1.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Ko4zQgTBHv.exe (PID: 6704 cmdline: C:\Users\user\Desktop\Ko4zQgTBHv.exe MD5: 02BC365A934E558EB634E19DD2D33E64)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "jojo@glimpse-it.co@Mexico1.,mail.privateemail.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: Ko4zQgTBHv.exe PID: 6704	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Ko4zQgTBHv.exe PID: 6704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ko4zQgTBHv.exe PID: 6484	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Ko4zQgTBHv.exe PID: 6484	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.Ko4zQgTBHv.exe.3daed20.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Ko4zQgTBHv.exe.3daed20.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.Ko4zQgTBHv.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.Ko4zQgTBHv.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Ko4zQgTBHv.exe.3daed20.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Ko4zQgTBHv.exe.3daed20.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "jojo@glimpse-it.co@Mexico1.,mail.privateemail.com"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\vZvprBd.exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Show sources

Source: Ko4zQgTBHv.exe	Virustotal: Detection: 21%			Perma Link
Source: Ko4zQgTBHv.exe	ReversingLabs: Detection: 34%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\vZvprBd.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: Ko4zQgTBHv.exe

Joe Sandbox ML: detected

Source: 4.2.Ko4zQgTBHv.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: Ko4zQgTBHv.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Ko4zQgTBHv.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\Administrator\Desktop\Client\Temp\BILGqcSRbt\src\obj\Debug\ScopelessEnumAttribute.pdb source: Ko4zQgTBHv.exe

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h

0_2_0B58CAD8

Source: global traffic

TCP traffic: 192.168.2.6:49752 -> 198.54.122.60:587

Source: Joe Sandbox View

IP Address: 198.54.122.60 198.54.122.60

Source: global traffic

TCP traffic: 192.168.2.6:49752 -> 198.54.122.60:587

Source: unknown

DNS traffic detected: queries for: mail.privateemail.com

Source: Ko4zQgTBHv.exe, 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Ko4zQgTBHv.exe, 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Ko4zQgTBHv.exe, 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	String found in binary or memory: http://bplSZH.com
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://checkip.dyndns.org/
Source: Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Ko4zQgTBHv.exe, 00000004.00000002.599485446.00000000066CB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSA
Source: Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: Ko4zQgTBHv.exe, 00000004.00000002.596057980.0000000002C3C000.00000004.00000001.sdmp	String found in binary or memory: http://mail.privateemail.com
Source: Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Ko4zQgTBHv.exe, 00000000.00000002.342093039.0000000002D01000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://servermanager.miixit.org/
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://servermanager.miixit.org/E
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://servermanager.miixit.org/downloads/
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://servermanager.miixit.org/hits/hit_index.php?k=
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://servermanager.miixit.org/hits/hit_index.php?k=1
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://servermanager.miixit.org/index_ru.html
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://servermanager.miixit.org/index_ru.htmlk
Source: Ko4zQgTBHv.exe	String found in binary or memory: http://servermanager.miixit.org/report/reporter_index.php?name=
Source: Ko4zQgTBHv.exe, 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp	String found in binary or memory: https://o3u5ap5OYRcXqxyqT.org
Source: Ko4zQgTBHv.exe, 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp	String found in binary or memory: https://o3u5ap5OYRcXqxyqT.org8
Source: Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.c
Source: Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: Ko4zQgTBHv.exe	String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC
Source: Ko4zQgTBHv.exe, 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp, Ko4zQgTBHv.exe, 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Ko4zQgTBHv.exe, 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Ko4zQgTBHv.exe

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_00807DA2	0_2_00807DA2
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B583B18	0_2_0B583B18
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B5893A0	0_2_0B5893A0
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B588660	0_2_0B588660
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B58A218	0_2_0B58A218
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B588D08	0_2_0B588D08
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B583B09	0_2_0B583B09
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B585BD0	0_2_0B585BD0
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B585BCB	0_2_0B585BCB
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B589390	0_2_0B589390
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B588651	0_2_0B588651
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B589E48	0_2_0B589E48
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B58A207	0_2_0B58A207
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B589E39	0_2_0B589E39
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B5866C8	0_2_0B5866C8
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B5842F0	0_2_0B5842F0
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B5842E1	0_2_0B5842E1
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B5866B8	0_2_0B5866B8
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B58A539	0_2_0B58A539
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B584998	0_2_0B584998
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B584993	0_2_0B584993
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B58A450	0_2_0B58A450
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B580040	0_2_0B580040
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B584010	0_2_0B584010
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B580006	0_2_0B580006
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B584020	0_2_0B584020
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B588CFB	0_2_0B588CFB
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B58A4A7	0_2_0B58A4A7
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_006C7DA2	4_2_006C7DA2
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_029146A0	4_2_029146A0
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_029145B0	4_2_029145B0
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_0291DA01	4_2_0291DA01
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D07540	4_2_05D07540
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D094F8	4_2_05D094F8
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D06C70	4_2_05D06C70
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D06928	4_2_05D06928
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_06195608	4_2_06195608
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_061906D0	4_2_061906D0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\vZvprBd.exe BD97A138F3C0B9B078C119BCB59793CECA55120411C95635CC4D12C01406C2CD

Source: Ko4zQgTBHv.exe	Binary or memory string: OriginalFilename vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000000.00000002.346803709.000000000BB10000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000000.00000002.347104132.000000000BC00000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000000.00000002.347104132.000000000BC00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameScopelessEnumAttribute.exeF vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: l,\\StringFileInfo\\000004B0\\OriginalFilename vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000000.00000002.342228241.0000000002D99000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000000.00000002.342093039.0000000002D01000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCYbtWKpyduSheqLLdYLNwktYyalD.exe4 vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe	Binary or memory string: OriginalFilename vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000004.00000002.593856787.0000000001010000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000004.00000002.592490851.0000000000B58000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCYbtWKpyduSheqLLdYLNwktYyalD.exe4 vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000004.00000002.593872285.0000000001020000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe, 00000004.00000002.593770195.0000000000F50000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Ko4zQgTBHv.exe
Source: Ko4zQgTBHv.exe	Binary or memory string: OriginalFilenameScopelessEnumAttribute.exeF vs Ko4zQgTBHv.exe

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Section loaded: onecoreuapcommonproxystub.dll

Jump to behavior

Source: Ko4zQgTBHv.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Ko4zQgTBHv.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vZvprBd.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/4@1/1

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

File created: C:\Users\user\AppData\Roaming\vZvprBd.exe

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Mutant created: \Sessions\1\BaseNamedObjects\QUCIgI
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6668:120:WilError_01

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

File created: C:\Users\user\AppData\Local\Temp\tmpF3F1.tmp

Jump to behavior

Source: Ko4zQgTBHv.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: Ko4zQgTBHv.exe	Virustotal: Detection: 21%
Source: Ko4zQgTBHv.exe	ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

File read: C:\Users\user\Desktop\Ko4zQgTBHv.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ko4zQgTBHv.exe 'C:\Users\user\Desktop\Ko4zQgTBHv.exe'
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vZvprBd' /XML 'C:\Users\user\AppData\Local\Temp\tmpF3F1.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process created: C:\Users\user\Desktop\Ko4zQgTBHv.exe C:\Users\user\Desktop\Ko4zQgTBHv.exe
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vZvprBd' /XML 'C:\Users\user\AppData\Local\Temp\tmpF3F1.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process created: C:\Users\user\Desktop\Ko4zQgTBHv.exe C:\Users\user\Desktop\Ko4zQgTBHv.exe	Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Ko4zQgTBHv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Ko4zQgTBHv.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Ko4zQgTBHv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\Administrator\Desktop\Client\Temp\BILGqcSRbt\src\obj\Debug\ScopelessEnumAttribute.pdb source: Ko4zQgTBHv.exe

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0080761D push es; retf	0_2_0080764E
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_00807656 push es; retf	0_2_00807684
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 0_2_0B5847DB push esi; retf	0_2_0B5847E4
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_006C7656 push es; retf	4_2_006C7684
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_006C761D push es; retf	4_2_006C764E
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D025C3 push esp; retf	4_2_05D025E2
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D025F3 push ebp; retf	4_2_05D02602
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D025B3 push ebx; retf	4_2_05D025C2
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D025A3 push edx; retf	4_2_05D025B2
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D0257C push eax; retf	4_2_05D02582
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D02663 push 0A6405CAh; retf	4_2_05D0267E
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D02603 push edi; retf	4_2_05D02622
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D021C9 push ecx; retf 0005h	4_2_05D021CA
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D01140 push ds; retf	4_2_05D0114E
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D050F7 push edi; retf	4_2_05D050FE
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D01048 push ds; retf	4_2_05D0105A
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D01077 push ds; retf	4_2_05D01078
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D01068 push ds; retf	4_2_05D01069
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D0B374 push 968C00CCh; retf 0005h	4_2_05D0B37A
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D052D0 push edi; retf	4_2_05D052D6
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D0122B push ds; retf	4_2_05D01236
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D0BCC0 pushfd ; retf 0005h	4_2_05D0BEBA
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D0BF08 pushfd ; retf 0005h	4_2_05D0BF0A
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Code function: 4_2_05D04EEC push ebp; retf	4_2_05D04EF6

Source: initial sample	Static PE information: section name: .text entropy: 7.89033690485
Source: initial sample	Static PE information: section name: .text entropy: 7.89033690485

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

File created: C:\Users\user\AppData\Roaming\vZvprBd.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vZvprBd' /XML 'C:\Users\user\AppData\Local\Temp\tmpF3F1.tmp'

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ko4zQgTBHv.exe PID: 6484, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Window / User API: threadDelayed 355			Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Window / User API: threadDelayed 9462			Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe TID: 6488	Thread sleep time: -104535s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe TID: 6488	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe TID: 6512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe TID: 6720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe TID: 6920	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe TID: 6924	Thread sleep count: 355 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe TID: 6924	Thread sleep count: 9462 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe TID: 6920	Thread sleep count: 39 > 30	Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Thread delayed: delay time: 104535	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Memory written: C:\Users\user\Desktop\Ko4zQgTBHv.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vZvprBd' /XML 'C:\Users\user\AppData\Local\Temp\tmpF3F1.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Process created: C:\Users\user\Desktop\Ko4zQgTBHv.exe C:\Users\user\Desktop\Ko4zQgTBHv.exe			Jump to behavior

Source: Ko4zQgTBHv.exe, 00000004.00000002.594238544.00000000014F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Ko4zQgTBHv.exe, 00000004.00000002.594238544.00000000014F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Ko4zQgTBHv.exe, 00000004.00000002.594238544.00000000014F0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: Ko4zQgTBHv.exe, 00000004.00000002.594238544.00000000014F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Users\user\Desktop\Ko4zQgTBHv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Users\user\Desktop\Ko4zQgTBHv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Code function: 4_2_05D05A94 GetUserNameW,

4_2_05D05A94

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.Ko4zQgTBHv.exe.3daed20.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Ko4zQgTBHv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ko4zQgTBHv.exe.3daed20.3.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ko4zQgTBHv.exe PID: 6704, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ko4zQgTBHv.exe PID: 6484, type: MEMORY
Source: Yara match	File source: 0.2.Ko4zQgTBHv.exe.3daed20.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Ko4zQgTBHv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ko4zQgTBHv.exe.3daed20.3.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\Ko4zQgTBHv.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ko4zQgTBHv.exe PID: 6704, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.Ko4zQgTBHv.exe.3daed20.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Ko4zQgTBHv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ko4zQgTBHv.exe.3daed20.3.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ko4zQgTBHv.exe PID: 6704, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ko4zQgTBHv.exe PID: 6484, type: MEMORY
Source: Yara match	File source: 0.2.Ko4zQgTBHv.exe.3daed20.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Ko4zQgTBHv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ko4zQgTBHv.exe.3daed20.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection112	Obfuscated Files or Information3	Input Capture11	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Scheduled Task/Job1	Software Packing3	Credentials in Registry1	System Information Discovery114	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	DLL Side-Loading1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture11	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Security Software Discovery321	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion141	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Virtualization/Sandbox Evasion141	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Ko4zQgTBHv.exe	22%	Virustotal		Browse
Ko4zQgTBHv.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Wacatac
Ko4zQgTBHv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\vZvprBd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\vZvprBd.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Wacatac

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.Ko4zQgTBHv.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSA	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/index_ru.htmlk	0%	Avira URL Cloud	safe
https://sectigo.c	0%	Avira URL Cloud	safe
https://o3u5ap5OYRcXqxyqT.org8	0%	Avira URL Cloud	safe
http://bplSZH.com	0%	Avira URL Cloud	safe
https://o3u5ap5OYRcXqxyqT.org	0%	Avira URL Cloud	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/hits/hit_index.php?k=1	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/E	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/index_ru.html	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/report/reporter_index.php?name=	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://servermanager.miixit.org/downloads/	0%	Avira URL Cloud	safe
http://servermanager.miixit.org/hits/hit_index.php?k=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.privateemail.com	198.54.122.60	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://127.0.0.1:HTTP/1.1	Ko4zQgTBHv.exe, 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	Ko4zQgTBHv.exe, 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://sectigo.com/CPS0	Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.sectigo.com0	Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	Ko4zQgTBHv.exe, 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSA	Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.privateemail.com	Ko4zQgTBHv.exe, 00000004.00000002.596057980.0000000002C3C000.00000004.00000001.sdmp	false		high
http://servermanager.miixit.org/index_ru.htmlk	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	Ko4zQgTBHv.exe, 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp	false		high
https://sectigo.c	Ko4zQgTBHv.exe, 00000004.00000002.599388925.0000000006690000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://o3u5ap5OYRcXqxyqT.org8	Ko4zQgTBHv.exe, 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://bplSZH.com	Ko4zQgTBHv.exe, 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://o3u5ap5OYRcXqxyqT.org	Ko4zQgTBHv.exe, 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/hits/hit_index.php?k=1	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown
https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC	Ko4zQgTBHv.exe	false		high
http://servermanager.miixit.org/E	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/index_ru.html	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/report/reporter_index.php?name=	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Ko4zQgTBHv.exe, 00000000.00000002.342093039.0000000002D01000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	Ko4zQgTBHv.exe, 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp, Ko4zQgTBHv.exe, 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://servermanager.miixit.org/downloads/	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown
http://servermanager.miixit.org/hits/hit_index.php?k=	Ko4zQgTBHv.exe	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.54.122.60	mail.privateemail.com	United States		22612	NAMECHEAP-NETUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	412502
Start date:	12.05.2021
Start time:	18:31:17
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Ko4zQgTBHv.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/4@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 96% Number of executed functions: 49 Number of non-executed functions: 15
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Excluded IPs from analysis (whitelisted): 92.122.145.220, 13.88.21.125, 52.255.188.83, 131.253.33.200, 13.107.22.200, 20.49.157.6, 92.122.213.247, 92.122.213.194, 52.155.217.156, 20.54.26.129, 2.20.143.16, 2.20.142.209, 20.82.210.154, 184.30.24.56 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, a767.dscg3.akamai.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:32:11	API Interceptor	712x Sleep call for process: Ko4zQgTBHv.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
198.54.122.60	wed.doc	Get hash	malicious	Browse
	ORDER CONFIRMATION.doc	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Packed2.43091.10004.exe	Get hash	malicious	Browse
	6e5c05e1_by_Libranalysis.exe	Get hash	malicious	Browse
	RFQ Plasma cutting machine.doc	Get hash	malicious	Browse
	337840b9_by_Libranalysis.exe	Get hash	malicious	Browse
	vy38Kw9qRh.exe	Get hash	malicious	Browse
	ePj6KfzLBxh4vbe.exe	Get hash	malicious	Browse
	zkXpISzeo3.exe	Get hash	malicious	Browse
	yl9KgwwOXDZoGMw.exe	Get hash	malicious	Browse
	8DL3LHg4SB6Q7z2.exe	Get hash	malicious	Browse
	01217a79_by_Libranalysis.exe	Get hash	malicious	Browse
	5iRqi4LmLF.exe	Get hash	malicious	Browse
	6f37L7HNqo.exe	Get hash	malicious	Browse
	IqRG5ZzYOH.exe	Get hash	malicious	Browse
	PO 4302003683.doc	Get hash	malicious	Browse
	Tender Overview 10052021.doc	Get hash	malicious	Browse
	ORDER 10.05.doc	Get hash	malicious	Browse
	purchase request.doc	Get hash	malicious	Browse
	lBKwquZfBhdeO7D.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mail.privateemail.com	wed.doc	Get hash	malicious	Browse	198.54.122.60
	ORDER CONFIRMATION.doc	Get hash	malicious	Browse	198.54.122.60
	SecuriteInfo.com.Trojan.Packed2.43091.10004.exe	Get hash	malicious	Browse	198.54.122.60
	6e5c05e1_by_Libranalysis.exe	Get hash	malicious	Browse	198.54.122.60
	RFQ Plasma cutting machine.doc	Get hash	malicious	Browse	198.54.122.60
	337840b9_by_Libranalysis.exe	Get hash	malicious	Browse	198.54.122.60
	vy38Kw9qRh.exe	Get hash	malicious	Browse	198.54.122.60
	ePj6KfzLBxh4vbe.exe	Get hash	malicious	Browse	198.54.122.60
	zkXpISzeo3.exe	Get hash	malicious	Browse	198.54.122.60
	yl9KgwwOXDZoGMw.exe	Get hash	malicious	Browse	198.54.122.60
	8DL3LHg4SB6Q7z2.exe	Get hash	malicious	Browse	198.54.122.60
	01217a79_by_Libranalysis.exe	Get hash	malicious	Browse	198.54.122.60
	5iRqi4LmLF.exe	Get hash	malicious	Browse	198.54.122.60
	6f37L7HNqo.exe	Get hash	malicious	Browse	198.54.122.60
	IqRG5ZzYOH.exe	Get hash	malicious	Browse	198.54.122.60
	PO 4302003683.doc	Get hash	malicious	Browse	198.54.122.60
	Tender Overview 10052021.doc	Get hash	malicious	Browse	198.54.122.60
	ORDER 10.05.doc	Get hash	malicious	Browse	198.54.122.60
	purchase request.doc	Get hash	malicious	Browse	198.54.122.60
	New order.exe	Get hash	malicious	Browse	198.54.122.60

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NAMECHEAP-NETUS	Purchase Order.exe	Get hash	malicious	Browse	198.54.126.165
	wed.doc	Get hash	malicious	Browse	198.54.122.60
	ORDER CONFIRMATION.doc	Get hash	malicious	Browse	198.54.122.60
	SecuriteInfo.com.Trojan.Packed2.43091.10004.exe	Get hash	malicious	Browse	198.54.122.60
	6e5c05e1_by_Libranalysis.exe	Get hash	malicious	Browse	198.54.122.60
	RFQ Plasma cutting machine.doc	Get hash	malicious	Browse	198.54.122.60
	Order 122001-220 guanzo.exe	Get hash	malicious	Browse	198.54.117.216
	main_setup_x86x64.exe	Get hash	malicious	Browse	162.255.119.164
	00098765123POIIU.exe	Get hash	malicious	Browse	199.192.23.253
	e8eRhf3GM0.xlsm	Get hash	malicious	Browse	185.61.154.27
	2021_May_Quotation_pdf.exe	Get hash	malicious	Browse	198.54.115.133
	337840b9_by_Libranalysis.exe	Get hash	malicious	Browse	198.54.122.60
	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	Get hash	malicious	Browse	198.54.117.212
	Updated Order list -804333.exe	Get hash	malicious	Browse	198.54.115.56
	NAVTECO_R1_10_05_2021,pdf.exe	Get hash	malicious	Browse	198.54.117.212
	BELLOW FABRICATION Dwg.exe	Get hash	malicious	Browse	199.188.200.15
	file.exe	Get hash	malicious	Browse	198.54.115.133
	scan of document 5336227.xlsm	Get hash	malicious	Browse	162.0.233.152
	vy38Kw9qRh.exe	Get hash	malicious	Browse	198.54.122.60
	copy of order 9119.xlsm	Get hash	malicious	Browse	162.0.233.152

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Roaming\vZvprBd.exe	wed.doc	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ko4zQgTBHv.exe.log Download File
Process:	C:\Users\user\Desktop\Ko4zQgTBHv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmpF3F1.tmp Download File
Process:	C:\Users\user\Desktop\Ko4zQgTBHv.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.156693657693423
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/S7h2ulNMFp2O/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3vtn:cbha7JlNQV/rydbz9I3YODOLNdq3r
MD5:	9D4A23205956BC2E8DD228033AC5726E
SHA1:	7565F73DAB98820902B657E8C7DE52AAB948E3C7
SHA-256:	F12E060679B837A16C1F0D231F1B345125EE56C69858B4C9E44EDBBEF06EF4AD
SHA-512:	88F2BBFC08C1EC83DC5FF994995542D9C3752E2201C3557D20614CFF32DF100CFD3F90B358A877F8C2ED1F9EBD55ED83B4EA8A5A565726CA1D3221336C5BEFAD
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvail

C:\Users\user\AppData\Roaming\vZvprBd.exe Download File
Process:	C:\Users\user\Desktop\Ko4zQgTBHv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	971264
Entropy (8bit):	7.869815902345992
Encrypted:	false
SSDEEP:	12288:PYh5qL6Evo89A05qLcAwwhFsHF5xucMfz3fwXJ3CPBAEV4e1g5qLq:PY3I6jw9IcAyHFcfz3f8itCe1+Iq
MD5:	02BC365A934E558EB634E19DD2D33E64
SHA1:	A7FCB0381C4F68EBEA3DDA4508A789A23EB9F637
SHA-256:	BD97A138F3C0B9B078C119BCB59793CECA55120411C95635CC4D12C01406C2CD
SHA-512:	E261643D2BFEA93CE7A907D344F19AD995519F172DEE9E9F028DEDD8C9565CD92ACD53F571078B026C62FEF70F0561060CFA7A18800EEC2F833E4D84B057D02A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: wed.doc, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c.`..............P......8......6.... ........@.. ....................... ............@....................................O........4........................................................................... ............... ..H............text...<.... ...................... ..`.rsrc....4.......6..................@..@.reloc..............................@..B........................H.......xr..<............................................................0............(....( .........(.....o!.........................("......(#......($......(%......(&....N..(....o....('....&..((.....s)........s........s+........s,........s-............0...........~....o.....+...0...........~....o/....+...0...........~....o0....+...0...........~....o1....+...0...........~....o2....+...0..<........~.....(3.....,!r...p.....(4...o5...s6............~.....+...0......

C:\Users\user\AppData\Roaming\vZvprBd.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Ko4zQgTBHv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.869815902345992
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Ko4zQgTBHv.exe
File size:	971264
MD5:	02bc365a934e558eb634e19dd2d33e64
SHA1:	a7fcb0381c4f68ebea3dda4508a789a23eb9f637
SHA256:	bd97a138f3c0b9b078c119bcb59793ceca55120411c95635cc4d12c01406c2cd
SHA512:	e261643d2bfea93ce7a907d344f19ad995519f172dee9e9f028dedd8c9565cd92acd53f571078b026c62fef70f0561060cfa7a18800eec2f833e4d84b057d02a
SSDEEP:	12288:PYh5qL6Evo89A05qLcAwwhFsHF5xucMfz3fwXJ3CPBAEV4e1g5qLq:PY3I6jw9IcAyHFcfz3f8itCe1+Iq
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c.`..............P......8......6.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	f2d2e9fcc4ead362

Static PE Info

General
Entrypoint:	0x4eb636
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x609B63E3 [Wed May 12 05:13:07 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xeb5e4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xec000	0x34d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xeb4ac	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe963c	0xe9800	False	0.909726520677	data	7.89033690485	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xec000	0x34d4	0x3600	False	0.361689814815	data	5.25516289643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf0000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xec100	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_GROUP_ICON	0xee6b8	0x14	data
RT_VERSION	0xee6dc	0x37c	data
RT_MANIFEST	0xeea68	0xa65	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2013
Assembly Version	3.0.0.0
InternalName	ScopelessEnumAttribute.exe
FileVersion	3.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	ServerManager_Core
ProductVersion	3.0.0.0
FileDescription	ServerManager_Core
OriginalFilename	ScopelessEnumAttribute.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 18:33:57.590287924 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:57.782218933 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:57.782362938 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:57.973872900 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:57.974586010 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:58.164808035 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.165076017 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.169214010 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:58.359529018 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.402468920 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:58.430995941 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:58.622334957 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.623831987 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.623858929 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.623883009 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.623905897 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.624061108 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:58.624207973 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:58.675378084 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:58.865664005 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.866667986 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:58.918052912 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:59.144306898 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:59.334512949 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:59.336196899 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:59.341310024 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:59.531418085 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:59.534073114 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:59.535981894 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:59.728559971 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:59.731681108 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:59.732639074 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:33:59.922954082 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:59.925484896 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:33:59.926291943 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:34:00.116590023 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:34:00.157192945 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:34:00.158485889 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:34:00.348891020 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:34:00.349466085 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:34:00.352077007 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:34:00.352103949 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:34:00.353277922 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:34:00.353303909 CEST	49752	587	192.168.2.6	198.54.122.60
May 12, 2021 18:34:00.542407036 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:34:00.542478085 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:34:00.544215918 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:34:00.632358074 CEST	587	49752	198.54.122.60	192.168.2.6
May 12, 2021 18:34:00.683339119 CEST	49752	587	192.168.2.6	198.54.122.60

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 18:32:01.505918980 CEST	54513	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:01.567689896 CEST	53	54513	8.8.8.8	192.168.2.6
May 12, 2021 18:32:01.654706001 CEST	62044	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:01.708113909 CEST	53	62044	8.8.8.8	192.168.2.6
May 12, 2021 18:32:02.769505978 CEST	63791	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:02.831269979 CEST	53	63791	8.8.8.8	192.168.2.6
May 12, 2021 18:32:03.903897047 CEST	64267	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:03.955429077 CEST	53	64267	8.8.8.8	192.168.2.6
May 12, 2021 18:32:05.422872066 CEST	49448	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:05.471720934 CEST	53	49448	8.8.8.8	192.168.2.6
May 12, 2021 18:32:06.750407934 CEST	60342	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:06.799278021 CEST	53	60342	8.8.8.8	192.168.2.6
May 12, 2021 18:32:07.854561090 CEST	61346	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:07.903265953 CEST	53	61346	8.8.8.8	192.168.2.6
May 12, 2021 18:32:08.032258987 CEST	51774	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:08.102324009 CEST	53	51774	8.8.8.8	192.168.2.6
May 12, 2021 18:32:08.895251036 CEST	56023	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:08.946938038 CEST	53	56023	8.8.8.8	192.168.2.6
May 12, 2021 18:32:10.643033981 CEST	58384	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:10.693039894 CEST	53	58384	8.8.8.8	192.168.2.6
May 12, 2021 18:32:12.426206112 CEST	60261	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:12.476443052 CEST	53	60261	8.8.8.8	192.168.2.6
May 12, 2021 18:32:13.700006008 CEST	56061	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:13.751530886 CEST	53	56061	8.8.8.8	192.168.2.6
May 12, 2021 18:32:14.812074900 CEST	58336	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:14.860830069 CEST	53	58336	8.8.8.8	192.168.2.6
May 12, 2021 18:32:16.004043102 CEST	53781	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:16.052792072 CEST	53	53781	8.8.8.8	192.168.2.6
May 12, 2021 18:32:17.855899096 CEST	54064	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:17.907633066 CEST	53	54064	8.8.8.8	192.168.2.6
May 12, 2021 18:32:18.961852074 CEST	52811	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:19.010551929 CEST	53	52811	8.8.8.8	192.168.2.6
May 12, 2021 18:32:20.196566105 CEST	55299	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:20.245496988 CEST	53	55299	8.8.8.8	192.168.2.6
May 12, 2021 18:32:21.418642044 CEST	63745	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:21.471422911 CEST	53	63745	8.8.8.8	192.168.2.6
May 12, 2021 18:32:22.550496101 CEST	50055	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:22.602402925 CEST	53	50055	8.8.8.8	192.168.2.6
May 12, 2021 18:32:35.321342945 CEST	61374	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:35.395571947 CEST	53	61374	8.8.8.8	192.168.2.6
May 12, 2021 18:32:39.164099932 CEST	50339	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:39.225599051 CEST	53	50339	8.8.8.8	192.168.2.6
May 12, 2021 18:32:54.132843971 CEST	63307	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:54.192929029 CEST	53	63307	8.8.8.8	192.168.2.6
May 12, 2021 18:32:54.744596958 CEST	49694	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:54.795043945 CEST	53	49694	8.8.8.8	192.168.2.6
May 12, 2021 18:32:55.451318026 CEST	54982	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:55.500478029 CEST	53	54982	8.8.8.8	192.168.2.6
May 12, 2021 18:32:55.809406042 CEST	50010	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:55.882838964 CEST	53	50010	8.8.8.8	192.168.2.6
May 12, 2021 18:32:55.922677994 CEST	63718	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:55.984842062 CEST	53	63718	8.8.8.8	192.168.2.6
May 12, 2021 18:32:56.285636902 CEST	62116	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:56.347177029 CEST	53	62116	8.8.8.8	192.168.2.6
May 12, 2021 18:32:56.502953053 CEST	63816	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:56.551727057 CEST	53	63816	8.8.8.8	192.168.2.6
May 12, 2021 18:32:57.149645090 CEST	55014	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:57.201231003 CEST	53	55014	8.8.8.8	192.168.2.6
May 12, 2021 18:32:57.670654058 CEST	62208	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:57.729873896 CEST	53	62208	8.8.8.8	192.168.2.6
May 12, 2021 18:32:58.704262972 CEST	57574	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:58.763200998 CEST	53	57574	8.8.8.8	192.168.2.6
May 12, 2021 18:32:59.693232059 CEST	51818	53	192.168.2.6	8.8.8.8
May 12, 2021 18:32:59.750224113 CEST	53	51818	8.8.8.8	192.168.2.6
May 12, 2021 18:33:00.341689110 CEST	56628	53	192.168.2.6	8.8.8.8
May 12, 2021 18:33:00.390507936 CEST	53	56628	8.8.8.8	192.168.2.6
May 12, 2021 18:33:09.605097055 CEST	60778	53	192.168.2.6	8.8.8.8
May 12, 2021 18:33:09.677778959 CEST	53	60778	8.8.8.8	192.168.2.6
May 12, 2021 18:33:10.886634111 CEST	53799	53	192.168.2.6	8.8.8.8
May 12, 2021 18:33:10.946465015 CEST	53	53799	8.8.8.8	192.168.2.6
May 12, 2021 18:33:12.776998997 CEST	54683	53	192.168.2.6	8.8.8.8
May 12, 2021 18:33:12.836379051 CEST	53	54683	8.8.8.8	192.168.2.6
May 12, 2021 18:33:39.965634108 CEST	59329	53	192.168.2.6	8.8.8.8
May 12, 2021 18:33:40.040384054 CEST	53	59329	8.8.8.8	192.168.2.6
May 12, 2021 18:33:44.842503071 CEST	64021	53	192.168.2.6	8.8.8.8
May 12, 2021 18:33:44.916666985 CEST	53	64021	8.8.8.8	192.168.2.6
May 12, 2021 18:33:46.437069893 CEST	56129	53	192.168.2.6	8.8.8.8
May 12, 2021 18:33:46.505568027 CEST	53	56129	8.8.8.8	192.168.2.6
May 12, 2021 18:33:57.399168015 CEST	58177	53	192.168.2.6	8.8.8.8
May 12, 2021 18:33:57.461641073 CEST	53	58177	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 18:33:57.399168015 CEST	192.168.2.6	8.8.8.8	0x7f74	Standard query (0)	mail.privateemail.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 18:33:57.461641073 CEST	8.8.8.8	192.168.2.6	0x7f74	No error (0)	mail.privateemail.com		198.54.122.60	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 12, 2021 18:33:57.973872900 CEST	587	49752	198.54.122.60	192.168.2.6	220 PrivateEmail.com Mail Node
May 12, 2021 18:33:57.974586010 CEST	49752	587	192.168.2.6	198.54.122.60	EHLO 088753
May 12, 2021 18:33:58.165076017 CEST	587	49752	198.54.122.60	192.168.2.6	250-MTA-09.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 STARTTLS
May 12, 2021 18:33:58.169214010 CEST	49752	587	192.168.2.6	198.54.122.60	STARTTLS
May 12, 2021 18:33:58.359529018 CEST	587	49752	198.54.122.60	192.168.2.6	220 Ready to start TLS

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Ko4zQgTBHv.exe PID: 6484 Parent PID: 5876

General

Start time:	18:32:09
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\Ko4zQgTBHv.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Ko4zQgTBHv.exe'
Imagebase:	0x800000
File size:	971264 bytes
MD5 hash:	02BC365A934E558EB634E19DD2D33E64
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.342175940.0000000002D4E000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.343072283.0000000003D01000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6660 Parent PID: 6484

General

Start time:	18:32:13
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vZvprBd' /XML 'C:\Users\user\AppData\Local\Temp\tmpF3F1.tmp'
Imagebase:	0x340000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6668 Parent PID: 6660

General

Start time:	18:32:14
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: Ko4zQgTBHv.exe PID: 6704 Parent PID: 6484

General

Start time:	18:32:14
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\Ko4zQgTBHv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Ko4zQgTBHv.exe
Imagebase:	0x6c0000
File size:	971264 bytes
MD5 hash:	02BC365A934E558EB634E19DD2D33E64
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.591708318.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.595056596.0000000002B01000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.595643681.0000000002BB0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Ko4zQgTBHv.exe PID: 6484 Parent PID: 5876 Ko4zQgTBHv.exeCOMMON

Executed Functions

Function 0B588D08, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9410e60533cb0a714430fbc164edddad4086d516f77af4d051556a701dacbace
Instruction ID: e23db745a8f1344ce75b7ed542200470964acdea230c0212fc483c29cc7024b9
Opcode Fuzzy Hash: 9410e60533cb0a714430fbc164edddad4086d516f77af4d051556a701dacbace
Instruction Fuzzy Hash: 4CD16734E16208DFEB54DFA4D945BDDBBB2FB89700F209869E409BB384DB759D018B24

Uniqueness

Uniqueness Score: -1.00%

Function 0B588CFB, Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec8a2cbda854a9b91a53b3950b925b9aed0137e72206411f46ebaaf8d0cbc11
Instruction ID: bf0779849d81001a9599fb776cf464fc2ced022c9e2af738d1631cb71ba1ab2e
Opcode Fuzzy Hash: 4ec8a2cbda854a9b91a53b3950b925b9aed0137e72206411f46ebaaf8d0cbc11
Instruction Fuzzy Hash: 71D16734E16208DFEB54DFA4D945BDEBBB2FB89700F209469E409BB384DB759D018B24

Uniqueness

Uniqueness Score: -1.00%

Function 0B583B09, Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d7e8524686976e8427565e26c1e7a7de42b016e2ec00c82044303310576fe6
Instruction ID: 3368d4348c0f9240b26c1675d942ede325c4bbf354aa4d4ae168a7e4ab99585c
Opcode Fuzzy Hash: 55d7e8524686976e8427565e26c1e7a7de42b016e2ec00c82044303310576fe6
Instruction Fuzzy Hash: 87B128B4E052198FDB04DFE9C5815AEFBF2FF88710F1485A6E415BB368D73099428B68

Uniqueness

Uniqueness Score: -1.00%

Function 0B583B18, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ff02162cb2f717b2ef84a923c612d9961d644da71bde390b8ccd8c52e55bce
Instruction ID: 1c60b0a6095486331a7e62355c89d0dd20934a3301d08ae0c13023bccf707d74
Opcode Fuzzy Hash: e2ff02162cb2f717b2ef84a923c612d9961d644da71bde390b8ccd8c52e55bce
Instruction Fuzzy Hash: 7EB128B4E052098BDB04DFE9C5815DEFBF2BF88710F1485A5E415BB358D73099428B68

Uniqueness

Uniqueness Score: -1.00%

Function 0B58A218, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9325ad8c8a633399401bdfb21f3ef7d680fdc45c8e2e4627c92b6372fe11e4
Instruction ID: d244f15c4e246ac3531fce5e2286bdfffd38b8be29bec0cda9530882d1e59d45
Opcode Fuzzy Hash: 6a9325ad8c8a633399401bdfb21f3ef7d680fdc45c8e2e4627c92b6372fe11e4
Instruction Fuzzy Hash: 3B914571E05229CBEB24DF65C844BDDBBB6BB89300F14C9EAC51AB7254E7715A85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0B58A207, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d8198c97f6219dc4397ad195ff25c8862eb0dac1fee48c13b3bf32b743253c
Instruction ID: 00e15b4a2b13f06e66b9ec28b9916aea1797ae9d4ae1a3745817fa8bcf22f509
Opcode Fuzzy Hash: 57d8198c97f6219dc4397ad195ff25c8862eb0dac1fee48c13b3bf32b743253c
Instruction Fuzzy Hash: 77912471E00229CFEB64DF65C844BDDBBB6BB89300F14C5EAD509B6254E7709A85CF04

Uniqueness

Uniqueness Score: -1.00%

Function 0B589390, Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7a375c5b23ab0a44f43a46bc7144668646086f3b1b1c826b6e402650bc5c68
Instruction ID: b7fe33e689ae3094430fee3ddc01c24ba0c48b3eef91ae2bd563e10bb564e3d4
Opcode Fuzzy Hash: 3c7a375c5b23ab0a44f43a46bc7144668646086f3b1b1c826b6e402650bc5c68
Instruction Fuzzy Hash: 9081F374E012099FDB48DFA9D8855EEBFB2FF89300F10946AD816AB354DB749902CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0B5893A0, Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6cbc1f6b7a2ad9bd0e84e792d94501f3e0f4a27f8d6fa96c21b1b07b0eeeea
Instruction ID: 7bd41bef15ed3c907a8b45a59dcc7677e8213ae9886ea5dd6f1e7890b274156d
Opcode Fuzzy Hash: fb6cbc1f6b7a2ad9bd0e84e792d94501f3e0f4a27f8d6fa96c21b1b07b0eeeea
Instruction Fuzzy Hash: E881F274E002099FCB48DFA9D8455EEBFB2FF89300F20946AE816AB354DB349902CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0B58A4A7, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b1d63a50e45076b09dcf0e967b4ff4590f9bccd9e13b5b1caee6f5f38d8587
Instruction ID: dbe56cd3f4e7247436541f367bd0fdd4fee5335476f09504071fdff887e4792b
Opcode Fuzzy Hash: 23b1d63a50e45076b09dcf0e967b4ff4590f9bccd9e13b5b1caee6f5f38d8587
Instruction Fuzzy Hash: 80811571E0022ACFDB64DF64C984BDDBBB6BB89300F1489EAD509B7244E7749A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0B58A450, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e642e8baaba314fac30851603622f546a3658963a0db7417e8df8b27ae9e896a
Instruction ID: 843c8d887412518aedb981cf04554af523ce182bfd0e689197857e257013c9a0
Opcode Fuzzy Hash: e642e8baaba314fac30851603622f546a3658963a0db7417e8df8b27ae9e896a
Instruction Fuzzy Hash: 07811571E0122ACFEB24DF64C944BDDB7B6BB89300F1489EAD10AB7244E7759A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0B58A539, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2de648a5f29b0153511a95a422fa5a9c2b7327d5e6b889b813e53b38d1e1349
Instruction ID: a1ce7f030aea3688c36955220b41b18060a7413671e9b287d212ed0b81e94bb5
Opcode Fuzzy Hash: f2de648a5f29b0153511a95a422fa5a9c2b7327d5e6b889b813e53b38d1e1349
Instruction Fuzzy Hash: 63715A71D0022ACFDB64DF64C844BDDB7B6BB89300F148AEAD11AB7244E7719A85CF04

Uniqueness

Uniqueness Score: -1.00%

Function 0B588651, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ec34337a1463c0512c471623bc9689b1381203d3fd9fdf21465ffba9b011e8
Instruction ID: 933ed05d518ed448d7e39041fb2f6fa98faa9b3a545c8f8a7bb03a15f21044bc
Opcode Fuzzy Hash: e4ec34337a1463c0512c471623bc9689b1381203d3fd9fdf21465ffba9b011e8
Instruction Fuzzy Hash: 24417C70E102189BDB48DFA5D5445DEBBF2FFCA301F14A869E405B7354DB7499028B18

Uniqueness

Uniqueness Score: -1.00%

Function 0B588660, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe7d74c71441899ce382a3aa4405f3a7dad31913bc0b415bd918de8bd365aea
Instruction ID: 0b368540204223b2a070b4d540c5fd7dae29b61c57b5687914a3a1a71ef910ac
Opcode Fuzzy Hash: 8fe7d74c71441899ce382a3aa4405f3a7dad31913bc0b415bd918de8bd365aea
Instruction Fuzzy Hash: 6E415930E152189BDB48DFA9D9445DEFBF2FBCE301F14A869E40AB7254DB7598018B18

Uniqueness

Uniqueness Score: -1.00%

Function 0B58CAD8, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 477a830187cc18a321dbb4f0bae6a9f03d729ad62568926a5813e6b72bb3488e
Instruction ID: 39515246f0a78565055b2c1bfa984091f60b0f9ec0e3bd249082d5b1c9198ee5
Opcode Fuzzy Hash: 477a830187cc18a321dbb4f0bae6a9f03d729ad62568926a5813e6b72bb3488e
Instruction Fuzzy Hash: DB112A30D042588FDB14DFA5D818BEEBAF1FB4E312F5494A9D545B72A0CB744984CB78

Uniqueness

Uniqueness Score: -1.00%

Function 0B587104, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 246processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B587346

Strings

.%Gt, xrefs: 0B58714B
.%Gt, xrefs: 0B58717A

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: CreateProcess
String ID: .%Gt$.%Gt
API String ID: 963392458-2932448424
Opcode ID: 81d791be8c677563a27d29ec4b1fe8cdb6c8e155e7f2e4ae38793366d70ed4ba
Instruction ID: 07b58521544239e5fca08d141c35f153a085b65a3ef0a2486ccb40db91f4c77f
Opcode Fuzzy Hash: 81d791be8c677563a27d29ec4b1fe8cdb6c8e155e7f2e4ae38793366d70ed4ba
Instruction Fuzzy Hash: DD915C71D002198FEF10DFA8C8817EDBBB2BB48314F2585A9E819B7290DB749D85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0B587110, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0B587346

Strings

.%Gt, xrefs: 0B58714B
.%Gt, xrefs: 0B58717A

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: CreateProcess
String ID: .%Gt$.%Gt
API String ID: 963392458-2932448424
Opcode ID: bab0ef0fb331d7a2912a140c0a917be2ef3a34109e2127797b3328354c424d52
Instruction ID: 5e901c7b7c69b557dc373254d64a90c378dcdfc8fdf61d6d632aa9844f2a7387
Opcode Fuzzy Hash: bab0ef0fb331d7a2912a140c0a917be2ef3a34109e2127797b3328354c424d52
Instruction Fuzzy Hash: 0C914C71D002198FEF14DFA8C881BDDBBB2BB48314F2585A9E819B7250DB749D85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0B586CB1, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0B586D6E

Strings

.%Gt, xrefs: 0B586D0C

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: ContextThread
String ID: .%Gt
API String ID: 1591575202-3078615037
Opcode ID: bdcec79e1f79743c7d964e59737e472245a0764fa96c2506c1f92394627f3a76
Instruction ID: 7c9b23fe350cde0faa9e9c2feafaa30966834cd2e84e25f21d551592200e9a20
Opcode Fuzzy Hash: bdcec79e1f79743c7d964e59737e472245a0764fa96c2506c1f92394627f3a76
Instruction Fuzzy Hash: D4319C718003489FDB50DFA9C8947DEBBF0FF48214F15886AD849BB242CB38A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B586E80, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B586F18

Strings

.%Gt, xrefs: 0B586EA7

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID: .%Gt
API String ID: 3559483778-3078615037
Opcode ID: cc78a3d1c83d1dfb68a7d44cac48d19d5b339fe8cec27992345e61cea2d8b6a0
Instruction ID: a77e1bd00147d67e1c318ea0826c644d17600c9d150fee2c10776538186747f6
Opcode Fuzzy Hash: cc78a3d1c83d1dfb68a7d44cac48d19d5b339fe8cec27992345e61cea2d8b6a0
Instruction Fuzzy Hash: 6A2144B19002499FCF10DFA9C9807EEBBF5FF48314F10842AE918A7240C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B586E88, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0B586F18

Strings

.%Gt, xrefs: 0B586EA7

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID: .%Gt
API String ID: 3559483778-3078615037
Opcode ID: 22d722d11a2ac2aa448de6e26aa7accdb2671cb1424f344807e6c2e193d71e7c
Instruction ID: aba62db34f1a3a37dda990b4e7ccfc963f0044bbb8b1ad46152d7c24a1d01dda
Opcode Fuzzy Hash: 22d722d11a2ac2aa448de6e26aa7accdb2671cb1424f344807e6c2e193d71e7c
Instruction Fuzzy Hash: E22113719002599FDF10DFA9C984BEEBBF5FF48314F10842AE919A7240D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B586F70, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B586FF8

Strings

.%Gt, xrefs: 0B586F97

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID: .%Gt
API String ID: 1726664587-3078615037
Opcode ID: 228be3d05f82dbd3cdd7847d16851fbc1751c8b7d8c457e8ad13401ecc12b5aa
Instruction ID: 9ca351060d2b59e762d5698441dbf617aa42ff147cef5f2ba681efb8f99f3328
Opcode Fuzzy Hash: 228be3d05f82dbd3cdd7847d16851fbc1751c8b7d8c457e8ad13401ecc12b5aa
Instruction Fuzzy Hash: 262123B19002498FDF10CFA9D9847EEBBF5FF48314F10882AE519B7250D778A904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B586F78, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0B586FF8

Strings

.%Gt, xrefs: 0B586F97

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID: .%Gt
API String ID: 1726664587-3078615037
Opcode ID: 4167fee91799b41d960f6586b5a978129322978c85e51dfa2e158a6164e4779d
Instruction ID: 8f81e3e94e24312fa3e10299e9c281764a2659691da022092af59bef931945f9
Opcode Fuzzy Hash: 4167fee91799b41d960f6586b5a978129322978c85e51dfa2e158a6164e4779d
Instruction Fuzzy Hash: 3E2116719002599FDF10DFAAC8806EEBBF5FF48314F10842AE519A7240D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B586CF0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0B586D6E

Strings

.%Gt, xrefs: 0B586D0C

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: ContextThread
String ID: .%Gt
API String ID: 1591575202-3078615037
Opcode ID: 0040ed41fe6c8e47cdd1c5e2c010655d0548b398bc22bb5e910d505087e5abad
Instruction ID: a2044949c1b32fa10fec60e7d3340173526593f0a6a7d0dae10f8a19ec50193f
Opcode Fuzzy Hash: 0040ed41fe6c8e47cdd1c5e2c010655d0548b398bc22bb5e910d505087e5abad
Instruction Fuzzy Hash: 45211571D002498FDB50DFAAC4847EEBBF5EF48264F14842AD859B7240DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B586DC0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B586E36

Strings

.%Gt, xrefs: 0B586DDF

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: .%Gt
API String ID: 4275171209-3078615037
Opcode ID: 769bb0a5fca0bf479f2ec11ce9766af03414c0a4c0e4b6154717964d9ee65793
Instruction ID: ef4363ee1a80332bffa687c66d291e870c7c56b6aca04db1c924b4cc580d01a5
Opcode Fuzzy Hash: 769bb0a5fca0bf479f2ec11ce9766af03414c0a4c0e4b6154717964d9ee65793
Instruction Fuzzy Hash: 111144769002489BDF20DFAAD9447EFBBF5EF48324F14881AE519B7250C739A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B5827B0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0B58282B

Strings

.%Gt, xrefs: 0B5827D7

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: .%Gt
API String ID: 544645111-3078615037
Opcode ID: 610cdb54416672bfbd04e7d5441681bf77e4d138b53e2d75bf37672c3888f663
Instruction ID: b120a99e0c0f9901e6b739ac377450e5de58581a428ba67af554689090716add
Opcode Fuzzy Hash: 610cdb54416672bfbd04e7d5441681bf77e4d138b53e2d75bf37672c3888f663
Instruction Fuzzy Hash: 422122B59002098FCB10CF9AD984BDEBBF4FF48320F10842AE459A7240D378A644CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B5827B8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0B58282B

Strings

.%Gt, xrefs: 0B5827D7

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: .%Gt
API String ID: 544645111-3078615037
Opcode ID: e5f2df8d150c7a2adb90f02cc5a1dbb3919015ce0f8af5956034de4a77aff765
Instruction ID: 4ef9a7f5dc7e1721c39b998299a324a4a7e5ed78c30e668e2391d11ee331e481
Opcode Fuzzy Hash: e5f2df8d150c7a2adb90f02cc5a1dbb3919015ce0f8af5956034de4a77aff765
Instruction Fuzzy Hash: CC2106B19002499FDB10CF9AD484BDEBBF4FB48320F108429E458A7250D378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B586DC8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0B586E36

Strings

.%Gt, xrefs: 0B586DDF

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: .%Gt
API String ID: 4275171209-3078615037
Opcode ID: 976be1fee17b78c62361d54da9fe121253f8f834301c3b5d4c0a4138b6ad3c96
Instruction ID: fc7dd6c0adc58c2f07b503de894afa968e006804fd257ea81dccfbd3a1e0f1e4
Opcode Fuzzy Hash: 976be1fee17b78c62361d54da9fe121253f8f834301c3b5d4c0a4138b6ad3c96
Instruction Fuzzy Hash: 1B1126719002489BDF10DFAAD8447DFBBF5AF48324F148819E515A7250C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0B586613, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0B58667A

Strings

.%Gt, xrefs: 0B58662F

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: ResumeThread
String ID: .%Gt
API String ID: 947044025-3078615037
Opcode ID: 1d261c7a17f521bb4c514d77279e07ddb905857dc25099ca54719c10aad6df77
Instruction ID: 4a4163eb6a37441ab1ac780985d0909caca13349bc329855a9b451f91b3374ad
Opcode Fuzzy Hash: 1d261c7a17f521bb4c514d77279e07ddb905857dc25099ca54719c10aad6df77
Instruction Fuzzy Hash: 631128B1D002488BDB10DFAAD4447EEBBF5AF88228F15845ED419B7240CB74A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B586618, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0B58667A

Strings

.%Gt, xrefs: 0B58662F

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: ResumeThread
String ID: .%Gt
API String ID: 947044025-3078615037
Opcode ID: 60930d7685153a4d47cd087da7d01946e0c4cd4b7c1818d6c03b0e4e6027c9d0
Instruction ID: cbdf5729dd502efba1e4ee86660d2ab9524a2988b0269858dc566786adc8982f
Opcode Fuzzy Hash: 60930d7685153a4d47cd087da7d01946e0c4cd4b7c1818d6c03b0e4e6027c9d0
Instruction Fuzzy Hash: 121128B1D002488BDB10DFAAD4447DEBBF5AF88224F148419D419B7240CB74A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B58C1E8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0B58C245

Strings

.%Gt, xrefs: 0B58C202

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID: MessagePost
String ID: .%Gt
API String ID: 410705778-3078615037
Opcode ID: d5a6fe0e35c0ec0084d6b5e78cbf8051bdf0c6a0211778a44e2f0432f7a24003
Instruction ID: 5ba410391a85100086cf6f64e1ce76a82a5e8c54808f05b2667ea6c5f22dde2d
Opcode Fuzzy Hash: d5a6fe0e35c0ec0084d6b5e78cbf8051bdf0c6a0211778a44e2f0432f7a24003
Instruction Fuzzy Hash: C11112B58003489FDB10DF9AD884BDEBBF8FB48324F10845AE555B7640C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0B589E48, Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

+W, xrefs: 0B58A13C
z#W, xrefs: 0B589F8A

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID: z#W$+W
API String ID: 0-1723955444
Opcode ID: a25b60c2f28c207812b3a2a2b04a4d565bc3f6248984f4b3fbb457943450ab5a
Instruction ID: fe6d460caaadb926722279f69b099d8f6f4bda0654ba6007cebc037c58fb1919
Opcode Fuzzy Hash: a25b60c2f28c207812b3a2a2b04a4d565bc3f6248984f4b3fbb457943450ab5a
Instruction Fuzzy Hash: FF91E174E052099FDB09DFE9D9815EEFBF2BB89300F20A4AAE415BB214D7309A01CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0B589E39, Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

+W, xrefs: 0B58A13C
z#W, xrefs: 0B589F8A

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID: z#W$+W
API String ID: 0-1723955444
Opcode ID: 2afe722d61b7cae12e6b7faa49880790c7fd56b8cc9fc7b13c08eef4dafdbc99
Instruction ID: 0de9ef53049224214e309835aa4e4d77544d69fbc3dc4843f9a1cdc5fdeef237
Opcode Fuzzy Hash: 2afe722d61b7cae12e6b7faa49880790c7fd56b8cc9fc7b13c08eef4dafdbc99
Instruction Fuzzy Hash: 2891D274E052499FDB09DFE9D9815EEFBF2BB89300F20A4AAE415BB254D7309A01CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0B584010, Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

nev, xrefs: 0B584101

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID: nev
API String ID: 0-3371871415
Opcode ID: e974625fef75afb2d0e91d56047418f7dc1d279ebca57a361fb4a386a1d8803b
Instruction ID: 996e8743225819a6ab841a0b8b72f853c9a1010b1dc9e67963d8959444da149e
Opcode Fuzzy Hash: e974625fef75afb2d0e91d56047418f7dc1d279ebca57a361fb4a386a1d8803b
Instruction Fuzzy Hash: 0F616770E0520ACBDB05DFE9C4416AFBBF2BB88310F14C4A6D814BB354E7349A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B584020, Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

nev, xrefs: 0B584101

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID: nev
API String ID: 0-3371871415
Opcode ID: c1aa282fe9123e6a87771e42e5b2ff6790f98e56a1a5abfe895302ffdffa0b89
Instruction ID: 1a751e1cda9e00b893c966b712e9d0a87b1746bc7b46a9ca7dbd1ed494bb1510
Opcode Fuzzy Hash: c1aa282fe9123e6a87771e42e5b2ff6790f98e56a1a5abfe895302ffdffa0b89
Instruction Fuzzy Hash: D0614570E0520ACBDB04DFA9C485AAFFBF2BB88310F14D866D814BB354D7349A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0B584998, Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

X^ql, xrefs: 0B584E09

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID: X^ql
API String ID: 0-1006607919
Opcode ID: ab7ce62d528b44acc3727194161dc1b3cb7dda009ea39e5d182c3e95e94b7ff7
Instruction ID: 29344e9c628310fc072a71a074b610efbbdf2608f723c62b8a4dfc6eb9f70d23
Opcode Fuzzy Hash: ab7ce62d528b44acc3727194161dc1b3cb7dda009ea39e5d182c3e95e94b7ff7
Instruction Fuzzy Hash: 1F614974E011299FDB14DFA9C980A9EFBF7BB89204F14C5A9D808BB345D7309A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0B584993, Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

X^ql, xrefs: 0B584E09

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID: X^ql
API String ID: 0-1006607919
Opcode ID: 3cb1ec29c136b3c1caa35a6d86796d2cee43b35303c4a7e0a1ec643e43a49aed
Instruction ID: 34e024bb96dd535720f2b48c120a27341045b617c475c3f128297a0ae190c7db
Opcode Fuzzy Hash: 3cb1ec29c136b3c1caa35a6d86796d2cee43b35303c4a7e0a1ec643e43a49aed
Instruction Fuzzy Hash: 74613A74E011199FDB14DFA9C980A9EFBF7BB89204F14C5A9D808BB355D7309985CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0B580006, Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

.%Gt, xrefs: 0B58005C

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID: .%Gt
API String ID: 0-3078615037
Opcode ID: ff0c97017bd196560b73a9be2cf92c83633862046e04da5daa5ae02fd2418d53
Instruction ID: 13628c8922578d35bbf0d329d04464e2a14082447935d428eb750ab00d09d5c9
Opcode Fuzzy Hash: ff0c97017bd196560b73a9be2cf92c83633862046e04da5daa5ae02fd2418d53
Instruction Fuzzy Hash: C951ACB1D056588FDB59CF6B8D5468AFBF3AFC9200F18C0EAC44CAB265EB341A458F11

Uniqueness

Uniqueness Score: -1.00%

Function 0B580040, Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

.%Gt, xrefs: 0B58234B

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID: .%Gt
API String ID: 0-3078615037
Opcode ID: 871565869cec75e547bcf5963bfb3d55c9e080c56fb655d6d9a1292082184742
Instruction ID: 639d2e842877a8b2bd733bdbcb21a6c07a0c87bd89bd2ac86b98efbf0fa3a21f
Opcode Fuzzy Hash: 871565869cec75e547bcf5963bfb3d55c9e080c56fb655d6d9a1292082184742
Instruction Fuzzy Hash: 20514AB1E016188BDB68DF6B8D4569EFBF7BFC8300F14C1BA950CA6254DB301A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 00807DA2, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.340014659.0000000000802000.00000002.00020000.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.340008897.0000000000800000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d234e09036e31faa7c15afc53c8ce32842f786e3c44d0486ba8d94246aa65fac
Instruction ID: 0978b9dbf832ea9b7126a7a98adfa81f958690f07ca4a2a3de72fc7ac17737c1
Opcode Fuzzy Hash: d234e09036e31faa7c15afc53c8ce32842f786e3c44d0486ba8d94246aa65fac
Instruction Fuzzy Hash: 7461995684F3C25FC3438B348C65692BFB59E1312471E49EBC8C5CE4A3E1485A5EDB63

Uniqueness

Uniqueness Score: -1.00%

Function 0B585BD0, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45d911e49f9429198eb41aff806b75d613fa02e98a604524496d292d35289b6
Instruction ID: b393c82ca9ad1a98ee85d5aec00f517e66a99c63bbe1a5362f8cef5b09f4c006
Opcode Fuzzy Hash: c45d911e49f9429198eb41aff806b75d613fa02e98a604524496d292d35289b6
Instruction Fuzzy Hash: 6E712B74E052199FDB14DFA9D980AAEFBF2BF88204F24C5AAD408B7315E7309A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0B585BCB, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c672cba29db3021cf0948d88415857e23ae90eb497fb4b7972f7b28c15f9f7a
Instruction ID: 94dd67e54bdfcfd5bf676f0554f4eb43eb51067e1dfaf2b834196b1093e0c3ce
Opcode Fuzzy Hash: 6c672cba29db3021cf0948d88415857e23ae90eb497fb4b7972f7b28c15f9f7a
Instruction Fuzzy Hash: 6D613B74E052199FDB14DFA9D980AAEFBF3BF88204F24C5AAD408A7315E7309A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0B5842F0, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5485f033172e3d543a8df69d93c5f35f32b47f263f9f46bc3d526fa5ececf81c
Instruction ID: 10e0833d52d2b650502de3c5474462457baf07c8d13b7ddf673a23cb0e39a4ff
Opcode Fuzzy Hash: 5485f033172e3d543a8df69d93c5f35f32b47f263f9f46bc3d526fa5ececf81c
Instruction Fuzzy Hash: 0A516F74E001299FDB14DF9AD9806AEFBF7BB89604F24C5AAD818B7345DB305A41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0B5842E1, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12b2d12eeb605e77823dab5e6eca589e6d6211e7573a97fedb6fbea3570cd64
Instruction ID: 53f02344cb518260f6a57a6dbeef4c492f76bef684455485828177e6e5379240
Opcode Fuzzy Hash: e12b2d12eeb605e77823dab5e6eca589e6d6211e7573a97fedb6fbea3570cd64
Instruction Fuzzy Hash: FD516F74E0511A9FDB14DFAAC9806AEFBF7BB89204F24C1AAD808B7345D7305A45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0B5866C8, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4234d5fb139fe191d96523823258f76b2d29b76f4d1db00c043bd77552f5575b
Instruction ID: e9194441bd4840e9c679ba2c643eb6d02585e96ffc01b04ca2927b7ca7f614fd
Opcode Fuzzy Hash: 4234d5fb139fe191d96523823258f76b2d29b76f4d1db00c043bd77552f5575b
Instruction Fuzzy Hash: 34510570E112188FDB54CF69D884B9EBBB6BF89210F14C0A9D509AB364DB309E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0B5866B8, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.346734270.000000000B580000.00000040.00000001.sdmp, Offset: 0B580000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2abd5798667375a1b510558d089e6c9ee4d4d56c4313513c36cb13d5d0405c7c
Instruction ID: 5f39b58bd7abc434b67004dad66fd3d16666eb401d52832fac09fe8f47ca3ba1
Opcode Fuzzy Hash: 2abd5798667375a1b510558d089e6c9ee4d4d56c4313513c36cb13d5d0405c7c
Instruction Fuzzy Hash: 45512670E102189FDB54CF69D885B9EBBF2BF89200F14C0AAD909AB365DB309E41CF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Ko4zQgTBHv.exe PID: 6704 Parent PID: 6484 Ko4zQgTBHv.exeCOMMON

Executed Functions

Function 06195608, Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.599148125.0000000006190000.00000040.00000001.sdmp, Offset: 06190000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624f8f83ab0bed1db49154583be55dfdcab9fa3a003b79232831831057535602
Instruction ID: d4f6a5be8208a4270a1a46c4024564e01baa0600e714fa8514e6c97be84c5044
Opcode Fuzzy Hash: 624f8f83ab0bed1db49154583be55dfdcab9fa3a003b79232831831057535602
Instruction Fuzzy Hash: 09F14A30E00209CFDB55DFA9C994BADBBF2BF84314F158568E409AB265DB70A945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05D05A94, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05D0B62B

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a9dec50da9bda9657e15cff9a6cd518371a018d66270c25d178b36cb3a00d1e4
Instruction ID: 4b783c2a2ede25f97e0e821fb8df797b99e57107f1e4dda40a9f0b5f11cd6196
Opcode Fuzzy Hash: a9dec50da9bda9657e15cff9a6cd518371a018d66270c25d178b36cb3a00d1e4
Instruction Fuzzy Hash: 3B510370D042188FEB14CFA9C899BDEBBB1BF48314F15816AE856BB390DB749844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02916940, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 029169A0
GetCurrentThread.KERNEL32 ref: 029169DD
GetCurrentProcess.KERNEL32 ref: 02916A1A
GetCurrentThreadId.KERNEL32 ref: 02916A73

Strings

`, xrefs: 02916A9F

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: `
API String ID: 2063062207-4168407445
Opcode ID: d40791ab401cae25f1594921ddca2aacb8867f9f3ebb2d7491ca96d4b09595ed
Instruction ID: 9562737aa16d25b524bf4aeca6ea86989d58c70388be8ae03e35a24583fdd2e4
Opcode Fuzzy Hash: d40791ab401cae25f1594921ddca2aacb8867f9f3ebb2d7491ca96d4b09595ed
Instruction Fuzzy Hash: 315146B0E007488FDB54CFAAD648B9EBBF5EF88318F248599E409A7350D7345884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05D0B4E7, Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05D0B62B

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 3ecfe748de4b1538575f25c3778ff7f7ad2e679fac0df259fc69141136bfd1ef
Instruction ID: 2b1571bd5bfb090074ef51c98695e4e8f95341d3f286b16d547bdca77262796e
Opcode Fuzzy Hash: 3ecfe748de4b1538575f25c3778ff7f7ad2e679fac0df259fc69141136bfd1ef
Instruction Fuzzy Hash: 58513470E042188FEB14CFA9C895BEDBBB2BF48314F15816AD815BB790DB749844CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05D0921C, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05D0B62B

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: b423ed1eb685584649017b72bd954f447319dfd35a6b83b16b9a901520a507b4
Instruction ID: 3f994e2cf0e19f64c14d30c4325a2730dbf8f1bb553527702018efa06157a26d
Opcode Fuzzy Hash: b423ed1eb685584649017b72bd954f447319dfd35a6b83b16b9a901520a507b4
Instruction Fuzzy Hash: E5510270D042188FEB14CFA9C899BEDBBB1BF48314F15816AE856BB390DB749844CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02915084, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 029151A2

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 03bc21718aa0ac3afce0f631101ccee355d082f9aa6e2be8414e545675c356fd
Instruction ID: ce319976d6a6c021b63e734dae184c61fcb1f71b071c6265419e5154a0cc428b
Opcode Fuzzy Hash: 03bc21718aa0ac3afce0f631101ccee355d082f9aa6e2be8414e545675c356fd
Instruction Fuzzy Hash: 5051E0B1D003489FDF15CFAAC880ADEBBB5FF88314F65812AE819AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02915090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 029151A2

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f2370e33e8669c32873b54b209b2e326e5c226c986a9a8f73afb6e2660a6d245
Instruction ID: 29b1cafb903e29a4b8fd41d592a9e05960e209d893c595e98c9e1bb2fc90b40f
Opcode Fuzzy Hash: f2370e33e8669c32873b54b209b2e326e5c226c986a9a8f73afb6e2660a6d245
Instruction Fuzzy Hash: 2141CFB1D003489FDF15CF9AC984ADEBBB5FF88314F65812AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0291779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02917F09

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: e2d9b66e419ef5d1aef5813a0632ee10fb98a2a90feef13db27fb9a8780e728e
Instruction ID: 7d099ba101c54abd96c1953679d9b46f0059ebe380da362fa3bd5f822ddeab79
Opcode Fuzzy Hash: e2d9b66e419ef5d1aef5813a0632ee10fb98a2a90feef13db27fb9a8780e728e
Instruction Fuzzy Hash: 3B412BB5A003498FCB14CF99C488AABFBF5FF88314F158599E519AB321D734A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05D0C808, Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 05D0CEA0

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 23f12802d15ee24d5933dafab5fa9bbefd4a8af4d669d44b5eda0bf3dcb48b21
Instruction ID: 2c6958797a18e4b355c8b30e911a55fd1857df1ddd1127a2521d7847887ffdc2
Opcode Fuzzy Hash: 23f12802d15ee24d5933dafab5fa9bbefd4a8af4d669d44b5eda0bf3dcb48b21
Instruction Fuzzy Hash: 833102B0D112089FDB10DF99C984BDEFBF5AF48304F24815AE405BB3A0D7B4A849CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D0CE0F, Relevance: 1.6, APIs: 1, Instructions: 72comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 05D0CEA0

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 256ff5f3cb78708424c1222183ce2d9c89e262b593d113918d25618705ff1432
Instruction ID: aea6c4d77fb0d8966c53c8d02853256f928d15a67aecb4cfa0a755be05fd093d
Opcode Fuzzy Hash: 256ff5f3cb78708424c1222183ce2d9c89e262b593d113918d25618705ff1432
Instruction Fuzzy Hash: 783102B0D01208DFDB10CF99C984BDEBBF1AF48308F24805AE405BB7A0D7749849CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02916B62, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02916BEF

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0f1068fd906c5a47e1daf40a8759072c3526d10b9f7dcb2d4631889491eedf0e
Instruction ID: 2d4740d7e6e6fc63ac4a647589162c0edba4f807c57c8bd49c49901b1784fa48
Opcode Fuzzy Hash: 0f1068fd906c5a47e1daf40a8759072c3526d10b9f7dcb2d4631889491eedf0e
Instruction Fuzzy Hash: 6C2112B5D002589FDB10CFA9D984AEEBFF8EF48324F15805AE954A7310D338A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02916B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02916BEF

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8d770eacfd109738c6cca7b3a3542683053ea75b4b13db16575a493e2e1e49de
Instruction ID: 8fd42e8e2563a07e7f54cab6585111930e9a6c03f2e3e0eb2c57bfc9282d48bc
Opcode Fuzzy Hash: 8d770eacfd109738c6cca7b3a3542683053ea75b4b13db16575a493e2e1e49de
Instruction Fuzzy Hash: 0B21F3B5D002489FDB10CFAAD984ADEBBF8FF48324F15845AE914A3310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06190834, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,?,06191A79,00000800), ref: 06191B0A

Memory Dump Source

Source File: 00000004.00000002.599148125.0000000006190000.00000040.00000001.sdmp, Offset: 06190000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 62e3ab5fcaa0fa7e2d06c116af4ff7f924e8c0b73e08a301778649ffbedb6982
Instruction ID: 035fdf2d40a12978023da41235e32595186dd412e4eef982bd03cfdc46ad41ef
Opcode Fuzzy Hash: 62e3ab5fcaa0fa7e2d06c116af4ff7f924e8c0b73e08a301778649ffbedb6982
Instruction Fuzzy Hash: DB1100B6D002499FCB10CF9AC444ADEBBF5EB88324F15842AE919A7610C774A949CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0291C1A8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0291C222

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 0af247453fab7099cb09245dbb04508253eb58b1c2a119e3569db33ab3b6314c
Instruction ID: e0ef529084b4c88d278370b91c470e68f04be3ac59a5ec136da47e69535121ac
Opcode Fuzzy Hash: 0af247453fab7099cb09245dbb04508253eb58b1c2a119e3569db33ab3b6314c
Instruction Fuzzy Hash: 4611ACB1A443088FDB10DFAAD90879EBBF4FB48714F20882AD804B3610C738A448CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 029140AA, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02914116

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d86640b19bc2cfd2e485a92e5b189d3f40e563e0ceeed643104797b8773f3b12
Instruction ID: 07bff35861a32e4aa6673f6372e1342ffe7f3f56f07e82ada01884222a44467c
Opcode Fuzzy Hash: d86640b19bc2cfd2e485a92e5b189d3f40e563e0ceeed643104797b8773f3b12
Instruction Fuzzy Hash: CB1132B6D002598FCB10CF9AC444ADEFBF4EF89324F15806AD459B7610D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02913300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02914116

Memory Dump Source

Source File: 00000004.00000002.594347897.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 933c24c271e8171618ba5762e6fda58f1c8505e278dc1d4a77795b4892bc9c24
Instruction ID: 21270348019f872feaeec824a64a7e9e54c2aa1c366d59077672e3f91ac6733f
Opcode Fuzzy Hash: 933c24c271e8171618ba5762e6fda58f1c8505e278dc1d4a77795b4892bc9c24
Instruction Fuzzy Hash: 8C1120B5D002498BCB10CF9AC444BDEBBF4EB88324F11842AD829B7200C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D0924C, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,05D0C117), ref: 05D0C1A7

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c399a9886edcf9f90363992fa0cfc156bf5490a073e398d5ce0617864e40c489
Instruction ID: 888cfb45045b21562b3ddae62b20bc747ff1308871afa9fdd9abb50e3c16307c
Opcode Fuzzy Hash: c399a9886edcf9f90363992fa0cfc156bf5490a073e398d5ce0617864e40c489
Instruction Fuzzy Hash: 3C1122B19042498FCB10DF9AD844BDEFBF8EB88324F24845AD519A7350C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D0C143, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,05D0C117), ref: 05D0C1A7

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8eba5cbd6021123b77aea1f3bc248dd6682a5634a78bd5a173f2557949c61ab8
Instruction ID: 65ab7c552318470ef8dbbb005300cfbb31edb0e068fec325cd7422527211047f
Opcode Fuzzy Hash: 8eba5cbd6021123b77aea1f3bc248dd6682a5634a78bd5a173f2557949c61ab8
Instruction Fuzzy Hash: 2E11F2B19002598FDB10DF9AD884BDEFBF8EF88324F25845AD519A7350C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D0C6F4, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05D0CD25

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d6891c495a4063784d0f996d6c5e09e1531d7464ad0d02d7fd6aa7c817ae1c0d
Instruction ID: 292ad0efc6f3fa86fa70b1e45022540b4de21521f8a19a35acadba97a06bc467
Opcode Fuzzy Hash: d6891c495a4063784d0f996d6c5e09e1531d7464ad0d02d7fd6aa7c817ae1c0d
Instruction Fuzzy Hash: 9C1130B09002488FCB20CF9AD448BDEFBF4EB48224F10855AE519A7710C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D0CCCB, Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05D0CD25

Memory Dump Source

Source File: 00000004.00000002.598866484.0000000005D00000.00000040.00000001.sdmp, Offset: 05D00000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 80556929d0403a53739aae6e0145b9f54f3ae43b3a9d0032c8068a211010d3e3
Instruction ID: 40ad4eecf9796c97bee03b319a98667d2ab9b8e274babbb7cd7b470431c0c485
Opcode Fuzzy Hash: 80556929d0403a53739aae6e0145b9f54f3ae43b3a9d0032c8068a211010d3e3
Instruction Fuzzy Hash: CD1123B19002488FCB10DF99D485BCEFFF8EB48324F15855AD519A7710C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Ko4zQgTBHv.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre