Analysis Report d6U17S2KY1.exe

Overview

General Information

Sample Name: d6U17S2KY1.exe
Analysis ID: 412514
MD5: 2b3120230ab3c5251d51f76dce482bee
SHA1: 9fd7edd02968606d377ccbb766761a1008643a2a
SHA256: b85451c76ad7cc559d4726f6607c4c995a9754db40f3f25a79c86efab0da3624
Tags: AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "info@karsanmax.comerk#bmc2007mail.karsanmax.comnchimaobi2017@gmail.com"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\aqFBnsYUEqXcSa.exe ReversingLabs: Detection: 34%
Multi AV Scanner detection for submitted file
Source: d6U17S2KY1.exe ReversingLabs: Detection: 34%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\aqFBnsYUEqXcSa.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: d6U17S2KY1.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 6.2.d6U17S2KY1.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: d6U17S2KY1.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: d6U17S2KY1.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h 0_2_00BA1778
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h 0_2_00BA1669

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49738 -> 67.20.76.71:587
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 67.20.76.71:587
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.5:49738 -> 67.20.76.71:587
Source: unknown DNS traffic detected: queries for: mail.karsanmax.com
Source: d6U17S2KY1.exe, 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: d6U17S2KY1.exe, 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: d6U17S2KY1.exe, 00000006.00000002.501667729.0000000003109000.00000004.00000001.sdmp String found in binary or memory: http://mail.karsanmax.com
Source: d6U17S2KY1.exe, 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp String found in binary or memory: http://omALlu.com
Source: d6U17S2KY1.exe, 00000000.00000002.249344198.00000000023D1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: http://servermanager.miixit.org/1
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: http://servermanager.miixit.org/downloads/
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: http://servermanager.miixit.org/hits/hit_index.php?k=
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: http://servermanager.miixit.org/index_ru.html
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: http://servermanager.miixit.org/index_ru.htmlc
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: http://servermanager.miixit.org/report/reporter_index.php?name=
Source: d6U17S2KY1.exe, 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp String found in binary or memory: https://OALTDCqAt3tOO06lu.org
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC
Source: d6U17S2KY1.exe, 00000000.00000003.236530493.0000000002D1F000.00000004.00000001.sdmp String found in binary or memory: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=CJU3DBQXBUQPC5http://servermana
Source: d6U17S2KY1.exe, 00000000.00000002.251253442.0000000003425000.00000004.00000001.sdmp, d6U17S2KY1.exe, 00000006.00000002.489554131.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: d6U17S2KY1.exe, 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\d6U17S2KY1.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
.NET source code contains very large array initializations
Source: 6.2.d6U17S2KY1.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b2C990A75u002d2B43u002d46F7u002dB448u002d20A5F6939976u007d/u0034E6DFDCAu002dD7EAu002d4C91u002d9CD8u002dA25ED357A321.cs Large array initialization: .cctor: array initializer size 11955
PE file contains section with special chars
Source: d6U17S2KY1.exe Static PE information: section name: 252L'
Source: aqFBnsYUEqXcSa.exe.0.dr Static PE information: section name: 252L'
PE file has nameless sections
Source: d6U17S2KY1.exe Static PE information: section name:
Source: aqFBnsYUEqXcSa.exe.0.dr Static PE information: section name:
Detected potential crypto function
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BAC0B8 0_2_00BAC0B8
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA04E1 0_2_00BA04E1
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA3831 0_2_00BA3831
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA2DE8 0_2_00BA2DE8
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA2550 0_2_00BA2550
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA4720 0_2_00BA4720
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BAB0B8 0_2_00BAB0B8
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA64B9 0_2_00BA64B9
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA24B0 0_2_00BA24B0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA6CF0 0_2_00BA6CF0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA2820 0_2_00BA2820
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA6850 0_2_00BA6850
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA6840 0_2_00BA6840
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA1998 0_2_00BA1998
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA7998 0_2_00BA7998
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA45F2 0_2_00BA45F2
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA6AB0 0_2_00BA6AB0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA32B1 0_2_00BA32B1
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA5680 0_2_00BA5680
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA6ED0 0_2_00BA6ED0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA6AC0 0_2_00BA6AC0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BAAA30 0_2_00BAAA30
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA4629 0_2_00BA4629
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA5670 0_2_00BA5670
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BAA3F0 0_2_00BAA3F0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB5C90 0_2_04BB5C90
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB65A0 0_2_04BB65A0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB07B8 0_2_04BB07B8
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB8711 0_2_04BB8711
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB3880 0_2_04BB3880
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB6078 0_2_04BB6078
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB0040 0_2_04BB0040
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBB188 0_2_04BBB188
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB99D1 0_2_04BB99D1
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB5962 0_2_04BB5962
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBD950 0_2_04BBD950
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB9258 0_2_04BB9258
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBB244 0_2_04BBB244
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBA331 0_2_04BBA331
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB5C82 0_2_04BB5C82
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBD4F0 0_2_04BBD4F0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBD4E0 0_2_04BBD4E0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBCC58 0_2_04BBCC58
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBCC49 0_2_04BBCC49
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBB53B 0_2_04BBB53B
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB6572 0_2_04BB6572
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB5E9A 0_2_04BB5E9A
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBD768 0_2_04BBD768
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBD758 0_2_04BBD758
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBB0B8 0_2_04BBB0B8
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBB2AB 0_2_04BBB2AB
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBD2F1 0_2_04BBD2F1
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB9222 0_2_04BB9222
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBB27A 0_2_04BBB27A
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BB5390 0_2_04BB5390
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBB381 0_2_04BBB381
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBD300 0_2_04BBD300
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_0575D1E0 0_2_0575D1E0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_0575A078 0_2_0575A078
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05758CE0 0_2_05758CE0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05759270 0_2_05759270
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05758600 0_2_05758600
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_0575451F 0_2_0575451F
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_057585F0 0_2_057585F0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05759C6A 0_2_05759C6A
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05754058 0_2_05754058
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05750040 0_2_05750040
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05750007 0_2_05750007
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05758CD1 0_2_05758CD1
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05753760 0_2_05753760
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05753759 0_2_05753759
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05759261 0_2_05759261
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05754E40 0_2_05754E40
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_012447A0 6_2_012447A0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_01244730 6_2_01244730
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_01244790 6_2_01244790
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_0124D850 6_2_0124D850
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_01386850 6_2_01386850
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_01385AF0 6_2_01385AF0
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_0138E668 6_2_0138E668
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_013C6570 6_2_013C6570
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_013CDF90 6_2_013CDF90
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_013C2E2C 6_2_013C2E2C
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_013C9A08 6_2_013C9A08
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_013CD740 6_2_013CD740
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_013CDE40 6_2_013CDE40
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\aqFBnsYUEqXcSa.exe B85451C76AD7CC559D4726F6607C4C995A9754DB40F3F25A79C86EFAB0DA3624
Sample file is different than original file name gathered from version info
Source: d6U17S2KY1.exe Binary or memory string: OriginalFilename vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000002.261618244.0000000006DC0000.00000002.00000001.sdmp Binary or memory string: originalfilename vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000002.261618244.0000000006DC0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000000.223573099.0000000000132000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameVarEnum.exeF vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000002.257106673.0000000004A80000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000002.249344198.00000000023D1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll( vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000002.250414259.00000000028E0000.00000004.00000001.sdmp Binary or memory string: l,\\StringFileInfo\\000004B0\\OriginalFilename vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000002.251253442.0000000003425000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameXGPWdGutkdNwhwzxXFILaBvjYzQEPLjNtGbCFpX.exe4 vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000002.251253442.0000000003425000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll@ vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000000.00000002.261488112.0000000005B60000.00000002.00000001.sdmp Binary or memory string: System.OriginalFileName vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe Binary or memory string: OriginalFilename vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000004.00000002.245356347.00000000003C2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameVarEnum.exeF vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe Binary or memory string: OriginalFilename vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000005.00000000.246120725.0000000000482000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameVarEnum.exeF vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe Binary or memory string: OriginalFilename vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000006.00000002.505734863.00000000063A0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000006.00000002.489554131.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameXGPWdGutkdNwhwzxXFILaBvjYzQEPLjNtGbCFpX.exe4 vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000006.00000002.498963810.0000000001390000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamewshom.ocx.mui vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000006.00000002.492268965.0000000000BC2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameVarEnum.exeF vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000006.00000002.498908130.0000000001370000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamewshom.ocx vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000006.00000002.498443749.000000000125A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe, 00000006.00000002.492531820.0000000000F68000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs d6U17S2KY1.exe
Source: d6U17S2KY1.exe Binary or memory string: OriginalFilenameVarEnum.exeF vs d6U17S2KY1.exe
Uses 32bit PE files
Source: d6U17S2KY1.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: d6U17S2KY1.exe Static PE information: Section: 252L' ZLIB complexity 1.00031506148
Source: aqFBnsYUEqXcSa.exe.0.dr Static PE information: Section: 252L' ZLIB complexity 1.00031506148
Source: 6.2.d6U17S2KY1.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.d6U17S2KY1.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@10/4@1/1
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File created: C:\Users\user\AppData\Roaming\aqFBnsYUEqXcSa.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5512:120:WilError_01
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File created: C:\Users\user\AppData\Local\Temp\tmp401C.tmp Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\d6U17S2KY1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
Source: d6U17S2KY1.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File read: C:\Users\user\Desktop\d6U17S2KY1.exe:Zone.Identifier Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\d6U17S2KY1.exe 'C:\Users\user\Desktop\d6U17S2KY1.exe'
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aqFBnsYUEqXcSa' /XML 'C:\Users\user\AppData\Local\Temp\tmp401C.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aqFBnsYUEqXcSa' /XML 'C:\Users\user\AppData\Local\Temp\tmp401C.tmp' Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: d6U17S2KY1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: d6U17S2KY1.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Unpacked PE file: 0.2.d6U17S2KY1.exe.70000.0.unpack 252L':EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;
PE file contains sections with non-standard names
Source: d6U17S2KY1.exe Static PE information: section name: 252L'
Source: d6U17S2KY1.exe Static PE information: section name:
Source: aqFBnsYUEqXcSa.exe.0.dr Static PE information: section name: 252L'
Source: aqFBnsYUEqXcSa.exe.0.dr Static PE information: section name:
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_0011E124 pushad ; ret 0_2_0011E125
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00120B4E push esp; iretd 0_2_00120B65
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA839A pushad ; ret 0_2_00BA839B
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_04BBACAE push 8DFFFFFFh; retf 0_2_04BBACB3
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05757D71 pushfd ; ret 0_2_05757D73
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_05752E43 push cs; retf 0_2_05752E52
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C5C34 push ds; retf 4_2_003C5C44
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C5436 push cs; retf 4_2_003C56C2
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C5C22 push ds; retf 4_2_003C5C26
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C5700 push cs; retf 4_2_003C5740
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C5C46 push ds; retf 4_2_003C5C4A
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C56B2 push cs; retf 4_2_003C56C2
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C4392 push esp; iretd 4_2_003C43BB
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C56E8 push cs; retf 4_2_003C56FE
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C5AEA push ss; retf 4_2_003C5AEE
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 4_2_003C30C5 push ds; retf 4_2_003C3128
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_00485C46 push ds; retf 5_2_00485C4A
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_00485700 push cs; retf 5_2_00485740
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_00485C22 push ds; retf 5_2_00485C26
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_00485C34 push ds; retf 5_2_00485C44
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_00485436 push cs; retf 5_2_004856C2
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_004830C5 push ds; retf 5_2_00483128
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_004856E8 push cs; retf 5_2_004856FE
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_00485AEA push ss; retf 5_2_00485AEE
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_00484392 push esp; iretd 5_2_004843BB
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 5_2_004856B2 push cs; retf 5_2_004856C2
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_00BC56B2 push cs; retf 6_2_00BC56C2
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_00BC4392 push esp; iretd 6_2_00BC43BB
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_00BC56E8 push cs; retf 6_2_00BC56FE
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_00BC5AEA push ss; retf 6_2_00BC5AEE
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_00BC30C5 push ds; retf 6_2_00BC3128
Source: initial sample Static PE information: section name: 252L' entropy: 7.99976000855
Source: initial sample Static PE information: section name: 252L' entropy: 7.99976000855

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File created: C:\Users\user\AppData\Roaming\aqFBnsYUEqXcSa.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aqFBnsYUEqXcSa' /XML 'C:\Users\user\AppData\Local\Temp\tmp401C.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d6U17S2KY1.exe PID: 3752, type: MEMORY
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Window / User API: threadDelayed 6679 Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Window / User API: threadDelayed 3172 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\d6U17S2KY1.exe TID: 340 Thread sleep time: -104068s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe TID: 1560 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe TID: 1488 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe TID: 3904 Thread sleep time: -20291418481080494s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe TID: 3556 Thread sleep count: 6679 > 30 Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe TID: 3556 Thread sleep count: 3172 > 30 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\d6U17S2KY1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Thread delayed: delay time: 104068 Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: d6U17S2KY1.exe, 00000000.00000002.248996388.000000000074C000.00000004.00000020.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: vmware
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: d6U17S2KY1.exe, 00000000.00000002.249385166.0000000002410000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: d6U17S2KY1.exe, 00000006.00000002.498803045.0000000001310000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 0_2_00BA1778 CheckRemoteDebuggerPresent, 0_2_00BA1778
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Code function: 6_2_01380A70 KiUserExceptionDispatcher,LdrInitializeThunk,KiUserExceptionDispatcher,KiUserExceptionDispatcher, 6_2_01380A70
Enables debug privileges
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Memory written: C:\Users\user\Desktop\d6U17S2KY1.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\aqFBnsYUEqXcSa' /XML 'C:\Users\user\AppData\Local\Temp\tmp401C.tmp' Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Process created: C:\Users\user\Desktop\d6U17S2KY1.exe C:\Users\user\Desktop\d6U17S2KY1.exe Jump to behavior
Source: d6U17S2KY1.exe, 00000006.00000002.499280254.0000000001A40000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: d6U17S2KY1.exe, 00000006.00000002.499280254.0000000001A40000.00000002.00000001.sdmp Binary or memory string: Progman
Source: d6U17S2KY1.exe, 00000006.00000002.499280254.0000000001A40000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: d6U17S2KY1.exe, 00000006.00000002.499280254.0000000001A40000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: d6U17S2KY1.exe, 00000006.00000002.499280254.0000000001A40000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Users\user\Desktop\d6U17S2KY1.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Users\user\Desktop\d6U17S2KY1.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000006.00000002.489554131.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.251253442.0000000003425000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.d6U17S2KY1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.d6U17S2KY1.exe.353ecb8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.d6U17S2KY1.exe.353ecb8.2.raw.unpack, type: UNPACKEDPE
Yara detected AgentTesla
Source: Yara match File source: 00000006.00000002.489554131.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.251253442.0000000003425000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d6U17S2KY1.exe PID: 4440, type: MEMORY
Source: Yara match File source: Process Memory Space: d6U17S2KY1.exe PID: 3752, type: MEMORY
Source: Yara match File source: 6.2.d6U17S2KY1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.d6U17S2KY1.exe.353ecb8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.d6U17S2KY1.exe.353ecb8.2.raw.unpack, type: UNPACKEDPE
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\d6U17S2KY1.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d6U17S2KY1.exe PID: 4440, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 00000006.00000002.489554131.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.251253442.0000000003425000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.d6U17S2KY1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.d6U17S2KY1.exe.353ecb8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.d6U17S2KY1.exe.353ecb8.2.raw.unpack, type: UNPACKEDPE
Yara detected AgentTesla
Source: Yara match File source: 00000006.00000002.489554131.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.251253442.0000000003425000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.499359389.0000000002E51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d6U17S2KY1.exe PID: 4440, type: MEMORY
Source: Yara match File source: Process Memory Space: d6U17S2KY1.exe PID: 3752, type: MEMORY
Source: Yara match File source: 6.2.d6U17S2KY1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.d6U17S2KY1.exe.353ecb8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.d6U17S2KY1.exe.353ecb8.2.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 412514 Sample: d6U17S2KY1.exe Startdate: 12/05/2021 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->33 35 Found malware configuration 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 10 other signatures 2->39 7 d6U17S2KY1.exe 7 2->7         started        process3 file4 23 C:\Users\user\AppData\...\aqFBnsYUEqXcSa.exe, PE32 7->23 dropped 25 C:\...\aqFBnsYUEqXcSa.exe:Zone.Identifier, ASCII 7->25 dropped 27 C:\Users\user\AppData\Local\...\tmp401C.tmp, XML 7->27 dropped 29 C:\Users\user\AppData\...\d6U17S2KY1.exe.log, ASCII 7->29 dropped 41 Detected unpacking (changes PE section rights) 7->41 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->43 45 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->45 47 3 other signatures 7->47 11 d6U17S2KY1.exe 2 7->11         started        15 schtasks.exe 1 7->15         started        17 d6U17S2KY1.exe 7->17         started        19 d6U17S2KY1.exe 7->19         started        signatures5 process6 dnsIp7 31 mail.karsanmax.com 67.20.76.71, 49738, 587 UNIFIEDLAYER-AS-1US United States 11->31 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->49 51 Tries to steal Mail credentials (via file access) 11->51 53 Tries to harvest and steal ftp login credentials 11->53 55 2 other signatures 11->55 21 conhost.exe 15->21         started        signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
67.20.76.71
 mail.karsanmax.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
mail.karsanmax.com 67.20.76.71 true