Analysis Report k6DAiaCGR7

Overview

General Information

Sample Name:	k6DAiaCGR7 (renamed file extension from none to exe)
Analysis ID:	432730
MD5:	821f46434e52277efb0826338c5db60c
SHA1:	9ada012d5399d2b0b18db722a1aa3ed1b5759d56
SHA256:	6b32b3f608d3e52a73bbb4aeac21eeb401b17edafc1b902344d897f059d55a52
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Moves itself to temp directory

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Non Interactive PowerShell

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Signatures

AV Detection:

Found malware configuration

Source: 0000000D.00000002.597685684.0000000002FE1000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "raquel.andrade@mercafar.cfdaddyhandsome@1234mail.mercafar.cfstalinperezrn@gmail.com"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\QypERSEhl.exe

ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: k6DAiaCGR7.exe

ReversingLabs: Detection: 47%

Antivirus or Machine Learning detection for unpacked file

Source: 13.2.k6DAiaCGR7.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 13.0.k6DAiaCGR7.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Source: k6DAiaCGR7.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: k6DAiaCGR7.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: k6DAiaCGR7.exe, 0000000D.00000002.597685684.0000000002FE1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: k6DAiaCGR7.exe, 0000000D.00000002.597685684.0000000002FE1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: k6DAiaCGR7.exe, 0000000D.00000002.597685684.0000000002FE1000.00000004.00000001.sdmp	String found in binary or memory: http://QjfkEW.com
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: powershell.exe, 0000000B.00000003.536990492.0000000007554000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: k6DAiaCGR7.exe, 00000001.00000002.377885998.0000000003481000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000B.00000003.536990492.0000000007554000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: k6DAiaCGR7.exe, 00000001.00000003.335239894.00000000064D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: k6DAiaCGR7.exe, 00000001.00000002.398063199.00000000064C0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: k6DAiaCGR7.exe, 00000001.00000002.398063199.00000000064C0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comiona
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: k6DAiaCGR7.exe, 00000001.00000003.330986033.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comc
Source: k6DAiaCGR7.exe, 00000001.00000003.330941031.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comnl
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: k6DAiaCGR7.exe, 00000001.00000003.332912634.00000000064CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: k6DAiaCGR7.exe, 00000001.00000003.339617771.00000000064D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp, k6DAiaCGR7.exe, 00000001.00000002.377163110.0000000001977000.00000004.00000040.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: k6DAiaCGR7.exe, 00000001.00000003.330986033.00000000064DB000.00000004.00000001.sdmp, k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: k6DAiaCGR7.exe, 00000001.00000003.330770717.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comN
Source: k6DAiaCGR7.exe, 00000001.00000003.330986033.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.combli
Source: k6DAiaCGR7.exe, 00000001.00000003.330986033.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comby
Source: k6DAiaCGR7.exe, 00000001.00000003.330986033.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comn-u
Source: k6DAiaCGR7.exe, 00000001.00000003.330439644.00000000064E3000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comthe
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: k6DAiaCGR7.exe, 00000001.00000003.332390476.00000000064FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: k6DAiaCGR7.exe, 00000001.00000003.332390476.00000000064FD000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krM
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: k6DAiaCGR7.exe, 00000001.00000003.331312900.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.net
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: k6DAiaCGR7.exe, 00000001.00000003.331312900.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netF7
Source: k6DAiaCGR7.exe, 00000001.00000003.331312900.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netK
Source: k6DAiaCGR7.exe, 00000001.00000003.331312900.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netiefi:
Source: k6DAiaCGR7.exe, 00000001.00000003.331312900.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netlique
Source: k6DAiaCGR7.exe, 00000001.00000003.331443256.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netrz
Source: k6DAiaCGR7.exe, 00000001.00000003.331312900.00000000064DB000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netu
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: k6DAiaCGR7.exe, 00000001.00000002.415173391.00000000076D2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: k6DAiaCGR7.exe, 0000000D.00000002.598204319.0000000003092000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: k6DAiaCGR7.exe, 0000000D.00000002.597685684.0000000002FE1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: powershell.exe, 0000000B.00000003.536990492.0000000007554000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000003.504547658.000000000571F000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000003.525518022.0000000004E8E000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000007.00000003.495318295.0000000005488000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro$
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: k6DAiaCGR7.exe, 00000001.00000002.381685171.0000000004489000.00000004.00000001.sdmp, k6DAiaCGR7.exe, 0000000D.00000000.368609176.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: k6DAiaCGR7.exe, 0000000D.00000002.597685684.0000000002FE1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a window with clipboard capturing capabilities

Source: C:\Users\user\Desktop\k6DAiaCGR7.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary:

.NET source code contains very large array initializations

Source: 13.2.k6DAiaCGR7.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b1D0103B3u002d0C77u002d4B80u002d9374u002d0BB03718CB8Cu007d/D0EE9592u002d973Fu002d427Du002d8D06u002d65F71AC8A98B.cs

Large array initialization: .cctor: array initializer size 11987

Detected potential crypto function

Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 1_2_0322C2D0	1_2_0322C2D0
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 1_2_032299B0	1_2_032299B0
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 1_2_05A9E13D	1_2_05A9E13D
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 1_2_05A9ADF8	1_2_05A9ADF8
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 1_2_05A9B2B8	1_2_05A9B2B8
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 1_2_05A9D240	1_2_05A9D240
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 1_2_05A9DAE8	1_2_05A9DAE8
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 13_2_014B47A0	13_2_014B47A0
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 13_2_014B3E4A	13_2_014B3E4A
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 13_2_014B4752	13_2_014B4752
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 13_2_014B4772	13_2_014B4772
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 13_2_014B4730	13_2_014B4730
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Code function: 13_2_016356B8	13_2_016356B8

PE file contains strange resources

Source: k6DAiaCGR7.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: QypERSEhl.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: k6DAiaCGR7.exe, 00000001.00000002.418972224.0000000007C40000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe, 00000001.00000002.381685171.0000000004489000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKygo.dll* vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe, 00000001.00000002.381685171.0000000004489000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamedazGowhXROnypRJNonrLAgFdQAvXbwZJwugK.exe4 vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe, 00000001.00000002.372503388.0000000001008000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameVariantWrapper.exe. vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe, 00000001.00000002.423955391.000000000EF80000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe, 00000001.00000002.423955391.000000000EF80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe, 00000001.00000002.422274534.000000000EE90000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe, 0000000D.00000000.369648629.0000000000D38000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameVariantWrapper.exe. vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe, 0000000D.00000002.593487085.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamedazGowhXROnypRJNonrLAgFdQAvXbwZJwugK.exe4 vs k6DAiaCGR7.exe
Source: k6DAiaCGR7.exe	Binary or memory string: OriginalFilenameVariantWrapper.exe. vs k6DAiaCGR7.exe

Uses 32bit PE files

Source: k6DAiaCGR7.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: k6DAiaCGR7.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: QypERSEhl.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 13.2.k6DAiaCGR7.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 13.2.k6DAiaCGR7.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/18@0/0

Source: C:\Users\user\Desktop\k6DAiaCGR7.exe

File created: C:\Users\user\AppData\Roaming\QypERSEhl.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6836:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6784:120:WilError_01
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Mutant created: \Sessions\1\BaseNamedObjects\tCwmzmLsyoOjRf

Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: k6DAiaCGR7.exe	String found in binary or memory: <!--StartFragment -->
Source: k6DAiaCGR7.exe	String found in binary or memory: -start_number {0} -i "{1}{2}"
Source: k6DAiaCGR7.exe	String found in binary or memory: <!--StartFragment -->
Source: k6DAiaCGR7.exe	String found in binary or memory: -start_number {0} -i "{1}{2}"
Source: k6DAiaCGR7.exe	String found in binary or memory: <<<<<<<3+<!--StartFragment -->
Source: k6DAiaCGR7.exe	String found in binary or memory: %0{0}d;-start_number {0} -i "{1}{2}"

Source: unknown	Process created: C:\Users\user\Desktop\k6DAiaCGR7.exe 'C:\Users\user\Desktop\k6DAiaCGR7.exe'
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\k6DAiaCGR7.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\QypERSEhl.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\QypERSEhl' /XML 'C:\Users\user\AppData\Local\Temp\tmpEEC9.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\QypERSEhl.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Users\user\Desktop\k6DAiaCGR7.exe C:\Users\user\Desktop\k6DAiaCGR7.exe
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\k6DAiaCGR7.exe'	Jump to behavior
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\QypERSEhl.exe'	Jump to behavior
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\QypERSEhl' /XML 'C:\Users\user\AppData\Local\Temp\tmpEEC9.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\QypERSEhl.exe'	Jump to behavior
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process created: C:\Users\user\Desktop\k6DAiaCGR7.exe C:\Users\user\Desktop\k6DAiaCGR7.exe	Jump to behavior

Source: initial sample	Static PE information: section name: .text entropy: 7.58451127397
Source: initial sample	Static PE information: section name: .text entropy: 7.58451127397

Source: Yara match	File source: 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: k6DAiaCGR7.exe PID: 6348, type: MEMORY

Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4549	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2231	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2412	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4501	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4203
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2762
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Window / User API: threadDelayed 872
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Window / User API: threadDelayed 8931

Source: C:\Users\user\Desktop\k6DAiaCGR7.exe TID: 6352	Thread sleep time: -104872s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe TID: 6428	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6924	Thread sleep count: 2412 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6924	Thread sleep count: 4501 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2292	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5056	Thread sleep time: -21213755684765971s >= -30000s
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe TID: 6548	Thread sleep time: -21213755684765971s >= -30000s
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe TID: 6560	Thread sleep count: 872 > 30
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe TID: 6560	Thread sleep count: 8931 > 30
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe TID: 6548	Thread sleep count: 42 > 30

Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Thread delayed: delay time: 104872	Jump to behavior
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000005.00000003.560317031.00000000053DE000.00000004.00000001.sdmp, powershell.exe, 00000007.00000003.561997413.0000000005249000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000003.584181421.0000000004CD0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: k6DAiaCGR7.exe, 00000001.00000002.378226984.00000000034C3000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: powershell.exe, 00000005.00000003.560317031.00000000053DE000.00000004.00000001.sdmp, powershell.exe, 00000007.00000003.561997413.0000000005249000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000003.584181421.0000000004CD0000.00000004.00000001.sdmp	Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V

Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\k6DAiaCGR7.exe	Process token adjusted: Debug

Source: k6DAiaCGR7.exe, 0000000D.00000002.597377075.0000000001A60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: k6DAiaCGR7.exe, 0000000D.00000002.597377075.0000000001A60000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: k6DAiaCGR7.exe, 0000000D.00000002.597377075.0000000001A60000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: k6DAiaCGR7.exe, 0000000D.00000002.597377075.0000000001A60000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: Yara match	File source: 00000001.00000002.381685171.0000000004489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.368609176.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.593487085.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.k6DAiaCGR7.exe.4489930.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.k6DAiaCGR7.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.k6DAiaCGR7.exe.4545748.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.k6DAiaCGR7.exe.4545748.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.k6DAiaCGR7.exe.400000.0.unpack, type: UNPACKEDPE

Source: Yara match	File source: 0000000D.00000002.597685684.0000000002FE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: k6DAiaCGR7.exe PID: 7072, type: MEMORY

ID:	432730
Product:	CloudBasic
Start time:	17:51:38
Start date:	10.06.2021
Sample:	k6DAiaCGR7
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	821f46434e52277efb0826338c5db60c
SHA1:	9ada012d5399d2b0b18db722a1aa3ed1b5759d56
SHA256:	6b32b3f608d3e52a73bbb4aeac21eeb401b17edafc1b902344d897f059d55a52
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\k6DAiaCGR7.exe.log	ASCII text, with CRLF line terminators	1DC1A2DCC9EFAA84EABF4F6D6066565B	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	8D5E194411E038C060288366D6766D3D	DC1A8229ED0B909042065EA69253E86E86D71C88	44EEE632DEDFB83A545D8C382887DF3EE7EF551F73DD55FEDCDD8C93D390E31F
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	1084A78EB34D6E9844AA66AFC7D4B794	F578B457EDB2294623B67117994E09461A015296	B58D232EC220EF4E219AC7412ADB151C32219C0D9D9803ADDBA02FC64CD13A46
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ab1f0fij.1mx.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iamy1fvf.se3.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbikxylw.ybh.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pil3vxv0.fqi.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_spdfylzy.10z.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ywthqgwv.4ra.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\tmpEEC9.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	E55EA2ED32763BE49E92DEFB1E87038B	A767CEBBB84FCE628D67A7912CCC8CF4815C3F50	F003876576A310255B92533D35C1C6BF09C9BDA25B48E69CE1B071D03F543271
C:\Users\user\AppData\Roaming\QypERSEhl.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	821F46434E52277EFB0826338C5DB60C	9ADA012D5399D2B0B18DB722A1AA3ED1B5759D56	6B32B3F608D3E52A73BBB4AEAC21EEB401B17EDAFC1B902344D897F059D55A52
C:\Users\user\AppData\Roaming\QypERSEhl.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Documents\20210610\PowerShell_transcript.878411.FwsK9FxV.20210610175251.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	105A9F212C0A7FA8A9DFCD8C6C594AD3	4B0C7C30C28F85189633EB13E361987F2E0DFE2A	76266B25774AE7D1437A96CB65CBE3E859917E13FFD88A4A19615CA9E6FC0B7D
C:\Users\user\Documents\20210610\PowerShell_transcript.878411.dtHbzUvE.20210610175247.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	85A5338606A8BB26AFEAF7B236A82F6A	607F29AFB9DAE483AAE1ECD2F5ADCF072B52B9E5	EFCE4643E9E497B6C2C19EEC7B3DD2D4F3753B33563EAAFE16D9A7D0EBE6BF20
C:\Users\user\Documents\20210610\PowerShell_transcript.878411.m_JoOwci.20210610175242.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	D2D3F88110F31E66AB48A06617831425	4557F5610113879FE3F6AB6F4527C7AC99F2CBB3	C58D7F14DC09FF75C92C76404127F424285A188081DE503B5D2C471522D654E1

Analysis Report k6DAiaCGR7

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map