Play interactive tour

Edit tour

Analysis Report oRSxZhDFLi

Overview

General Information

Sample Name:	oRSxZhDFLi (renamed file extension from none to exe)
Analysis ID:	432806
MD5:	edf51521ad563bef8fa2f5ed218ac98c
SHA1:	ddbff9f775d0665126f2e64f84599474515c2844
SHA256:	1da3e92a89caaec997c1712bdd40454d44002fd484468e403a4367eb47438766
Tags:	AgentTeslaexetrojan
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

oRSxZhDFLi.exe (PID: 7040 cmdline: 'C:\Users\user\Desktop\oRSxZhDFLi.exe' MD5: EDF51521AD563BEF8FA2F5ED218AC98C)

oRSxZhDFLi.exe (PID: 660 cmdline: C:\Users\user\Desktop\oRSxZhDFLi.exe MD5: EDF51521AD563BEF8FA2F5ED218AC98C)

oRSxZhDFLi.exe (PID: 2804 cmdline: C:\Users\user\Desktop\oRSxZhDFLi.exe MD5: EDF51521AD563BEF8FA2F5ED218AC98C)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "info@sports024.comDANIEL3116us2.smtp.mailhostbox.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: oRSxZhDFLi.exe PID: 7040	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: oRSxZhDFLi.exe PID: 7040	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: oRSxZhDFLi.exe PID: 2804	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: oRSxZhDFLi.exe PID: 2804	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.oRSxZhDFLi.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.oRSxZhDFLi.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.oRSxZhDFLi.exe.3e98430.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.oRSxZhDFLi.exe.3e98430.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.oRSxZhDFLi.exe.3e98430.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.oRSxZhDFLi.exe.3e98430.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.oRSxZhDFLi.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.oRSxZhDFLi.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.oRSxZhDFLi.exe.3dd9930.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.oRSxZhDFLi.exe.3dd9930.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "info@sports024.comDANIEL3116us2.smtp.mailhostbox.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: oRSxZhDFLi.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Show sources

Source: oRSxZhDFLi.exe

Joe Sandbox ML: detected

Source: 4.0.oRSxZhDFLi.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.oRSxZhDFLi.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Source: oRSxZhDFLi.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: oRSxZhDFLi.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\bqFnsWkFEe\src\obj\Debug\FileAssociationEntry.pdbx; source: oRSxZhDFLi.exe
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\bqFnsWkFEe\src\obj\Debug\FileAssociationEntry.pdb source: oRSxZhDFLi.exe

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_02C80F20
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_02C80BF8
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_02C80FD4
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_02C80F10

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49770 -> 208.91.199.225:587

Source: Joe Sandbox View

IP Address: 208.91.199.225 208.91.199.225

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	String found in binary or memory: http://ExIqrm.com
Source: oRSxZhDFLi.exe, 00000000.00000002.656056686.0000000002DD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: oRSxZhDFLi.exe, 00000004.00000002.911846028.0000000002ED3000.00000004.00000001.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	String found in binary or memory: https://wqGvK2327FKwC19SZB.net
Source: oRSxZhDFLi.exe, 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp, oRSxZhDFLi.exe, 00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 4.0.oRSxZhDFLi.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b7DEE17F2u002d46B4u002d4F62u002dAA6Du002d1636D001833Au007d/B44BAD8Au002dF372u002d4CDEu002dA145u002dC41B5A4B363F.cs	Large array initialization: .cctor: array initializer size 11936
Source: 4.2.oRSxZhDFLi.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b7DEE17F2u002d46B4u002d4F62u002dAA6Du002d1636D001833Au007d/B44BAD8Au002dF372u002d4CDEu002dA145u002dC41B5A4B363F.cs	Large array initialization: .cctor: array initializer size 11936

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 0_2_0088B7D5	0_2_0088B7D5
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 0_2_0106C2B0	0_2_0106C2B0
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 0_2_01069990	0_2_01069990
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 0_2_02C8152D	0_2_02C8152D
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 0_2_0088C915	0_2_0088C915
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 3_2_003DB7D5	3_2_003DB7D5
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 3_2_003DC915	3_2_003DC915
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_007EB7D5	4_2_007EB7D5
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009E8088	4_2_009E8088
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009E2100	4_2_009E2100
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009EBA18	4_2_009EBA18
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009EBBCC	4_2_009EBBCC
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009E3710	4_2_009E3710
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009E6750	4_2_009E6750
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009E4D30	4_2_009E4D30
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009E86B0	4_2_009E86B0
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009E53B8	4_2_009E53B8
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_009E7370	4_2_009E7370
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_00D12D50	4_2_00D12D50
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_00D1E958	4_2_00D1E958
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_00D12618	4_2_00D12618
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_00D11FF0	4_2_00D11FF0
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_00D19DB8	4_2_00D19DB8
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_0117B618	4_2_0117B618
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_011765E0	4_2_011765E0
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_029746A0	4_2_029746A0
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_02974690	4_2_02974690
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_0297DA00	4_2_0297DA00
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_055A7540	4_2_055A7540
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_055A6C70	4_2_055A6C70
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_007EC915	4_2_007EC915
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Code function: 4_2_055A2548	4_2_055A2548

Source: oRSxZhDFLi.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: oRSxZhDFLi.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: oRSxZhDFLi.exe	Binary or memory string: OriginalFilename vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000000.00000002.660692383.0000000005EB0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000000.00000002.653618049.0000000000882000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFileAssociationEntry.exeH vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKygo.dll* vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDzzZNTCCkshjIwupINRxlEJFvlTv.exe4 vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe	Binary or memory string: OriginalFilename vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000003.00000000.650660389.00000000003D2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFileAssociationEntry.exeH vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe	Binary or memory string: OriginalFilename vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000004.00000002.909217066.0000000000CF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000004.00000002.908840907.00000000007E2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFileAssociationEntry.exeH vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameDzzZNTCCkshjIwupINRxlEJFvlTv.exe4 vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000004.00000002.910696092.00000000010C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe, 00000004.00000002.909383387.0000000000D30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs oRSxZhDFLi.exe
Source: oRSxZhDFLi.exe	Binary or memory string: OriginalFilenameFileAssociationEntry.exeH vs oRSxZhDFLi.exe

Source: oRSxZhDFLi.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: oRSxZhDFLi.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 4.0.oRSxZhDFLi.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.oRSxZhDFLi.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.oRSxZhDFLi.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.oRSxZhDFLi.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@0/1

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oRSxZhDFLi.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Mutant created: \Sessions\1\BaseNamedObjects\fRUiQmVZnziKhodxOX

Source: oRSxZhDFLi.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: oRSxZhDFLi.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\oRSxZhDFLi.exe 'C:\Users\user\Desktop\oRSxZhDFLi.exe'
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process created: C:\Users\user\Desktop\oRSxZhDFLi.exe C:\Users\user\Desktop\oRSxZhDFLi.exe
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process created: C:\Users\user\Desktop\oRSxZhDFLi.exe C:\Users\user\Desktop\oRSxZhDFLi.exe
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process created: C:\Users\user\Desktop\oRSxZhDFLi.exe C:\Users\user\Desktop\oRSxZhDFLi.exe	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process created: C:\Users\user\Desktop\oRSxZhDFLi.exe C:\Users\user\Desktop\oRSxZhDFLi.exe	Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: oRSxZhDFLi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: oRSxZhDFLi.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: oRSxZhDFLi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\bqFnsWkFEe\src\obj\Debug\FileAssociationEntry.pdbx; source: oRSxZhDFLi.exe
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\bqFnsWkFEe\src\obj\Debug\FileAssociationEntry.pdb source: oRSxZhDFLi.exe

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Code function: 4_2_00D17A37 push edi; retn 0000h

4_2_00D17A39

Source: initial sample

Static PE information: section name: .text entropy: 7.74566115268

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oRSxZhDFLi.exe PID: 7040, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Window / User API: threadDelayed 959			Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Window / User API: threadDelayed 8851			Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe TID: 7044	Thread sleep time: -99710s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe TID: 7068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe TID: 2016	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe TID: 4672	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe TID: 6428	Thread sleep count: 959 > 30	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe TID: 6428	Thread sleep count: 8851 > 30	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe TID: 4672	Thread sleep count: 45 > 30	Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Thread delayed: delay time: 99710	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Code function: 4_2_009E5C00 LdrInitializeThunk,

4_2_009E5C00

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process created: C:\Users\user\Desktop\oRSxZhDFLi.exe C:\Users\user\Desktop\oRSxZhDFLi.exe			Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Process created: C:\Users\user\Desktop\oRSxZhDFLi.exe C:\Users\user\Desktop\oRSxZhDFLi.exe			Jump to behavior

Source: oRSxZhDFLi.exe, 00000004.00000002.911059428.0000000001520000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: oRSxZhDFLi.exe, 00000004.00000002.911059428.0000000001520000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: oRSxZhDFLi.exe, 00000004.00000002.911059428.0000000001520000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: oRSxZhDFLi.exe, 00000004.00000002.911059428.0000000001520000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Users\user\Desktop\oRSxZhDFLi.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Users\user\Desktop\oRSxZhDFLi.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.oRSxZhDFLi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3e98430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3e98430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.oRSxZhDFLi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3dd9930.1.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oRSxZhDFLi.exe PID: 7040, type: MEMORY
Source: Yara match	File source: Process Memory Space: oRSxZhDFLi.exe PID: 2804, type: MEMORY
Source: Yara match	File source: 4.2.oRSxZhDFLi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3e98430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3e98430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.oRSxZhDFLi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3dd9930.1.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\oRSxZhDFLi.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oRSxZhDFLi.exe PID: 2804, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.oRSxZhDFLi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3e98430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3e98430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.oRSxZhDFLi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3dd9930.1.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oRSxZhDFLi.exe PID: 7040, type: MEMORY
Source: Yara match	File source: Process Memory Space: oRSxZhDFLi.exe PID: 2804, type: MEMORY
Source: Yara match	File source: 4.2.oRSxZhDFLi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3e98430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3e98430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.oRSxZhDFLi.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.oRSxZhDFLi.exe.3dd9930.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
oRSxZhDFLi.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
oRSxZhDFLi.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.0.oRSxZhDFLi.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8		Download File
4.2.oRSxZhDFLi.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://ExIqrm.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://wqGvK2327FKwC19SZB.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ExIqrm.com	oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	oRSxZhDFLi.exe, 00000004.00000002.911846028.0000000002ED3000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	oRSxZhDFLi.exe, 00000000.00000002.656056686.0000000002DD1000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	oRSxZhDFLi.exe, 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp, oRSxZhDFLi.exe, 00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	oRSxZhDFLi.exe, 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp	false		high
https://wqGvK2327FKwC19SZB.net	oRSxZhDFLi.exe, 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.199.225	unknown	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	432806
Start date:	10.06.2021
Start time:	19:09:44
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	oRSxZhDFLi (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@0/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.139.144, 184.30.21.144, 104.42.151.234, 20.82.210.154, 20.75.105.140, 20.54.26.129 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, skypedataprdcolcus16.cloudapp.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, eus2-consumerrp-displaycatalog-aks2aks-useast.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/432806/sample/oRSxZhDFLi.exe

Simulations

Behavior and APIs

Time	Type	Description
19:10:32	API Interceptor	760x Sleep call for process: oRSxZhDFLi.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
208.91.199.225	Urgent Contract Order GH78566484,pdf.exe	Get hash	malicious	Browse
	MOQ FOB ORDER.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.831.28325.exe	Get hash	malicious	Browse
	4It7P3KCyYHUWHU.exe	Get hash	malicious	Browse
	COMPANY DOCUMENTS.exe	Get hash	malicious	Browse
	Urgent Contract Order GH7856648,pdf.exe	Get hash	malicious	Browse
	New Order.exe	Get hash	malicious	Browse
	003BC09180600189.exe	Get hash	malicious	Browse
	$96,914.38 MT103 Copypdf.exe	Get hash	malicious	Browse
	e#U03c2.xlsx	Get hash	malicious	Browse
	PURCHASE ORDER-34002174,pdf.exe	Get hash	malicious	Browse
	Urgent RFQ_AP65425652_032421,pdf.exe	Get hash	malicious	Browse
	item_list.xlsx	Get hash	malicious	Browse
	MOQ FOB ORDER.exe	Get hash	malicious	Browse
	OS2Is3xL3BScraQ8Oe.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.796.21363.exe	Get hash	malicious	Browse
	NJ8bxF46pd.exe	Get hash	malicious	Browse
	item_list.xlsx	Get hash	malicious	Browse
	vm6J9rrLkhCfxJx.exe	Get hash	malicious	Browse
	EidlNArnbdWLtfL.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	SAUDI ARAMCO Tender Documents - BOQ and ITB.exe	Get hash	malicious	Browse	208.91.199.223
	0PyeqVfoHGFVl2r.exe	Get hash	malicious	Browse	208.91.199.223
	#U260e#Ufe0f Zeppelin.com AudioMessage_259-55.HTM	Get hash	malicious	Browse	207.174.212.247
	SecuriteInfo.com.MachineLearning.Anomalous.97.15449.exe	Get hash	malicious	Browse	208.91.198.143
	lFccIK78FD.exe	Get hash	malicious	Browse	208.91.198.143
	Order10 06 2021.doc	Get hash	malicious	Browse	162.215.241.145
	PO187439.exe	Get hash	malicious	Browse	119.18.54.126
	Urgent Contract Order GH78566484,pdf.exe	Get hash	malicious	Browse	208.91.199.223
	MOQ FOB ORDER.exe	Get hash	malicious	Browse	208.91.199.225
	JK6Ul6IKioPWJ6Y.exe	Get hash	malicious	Browse	208.91.198.143
	ekrrUChjXvng9Vr.exe	Get hash	malicious	Browse	208.91.199.223
	SecuriteInfo.com.Trojan.PackedNET.832.15445.exe	Get hash	malicious	Browse	208.91.198.143
	order 4806125050.xlsx	Get hash	malicious	Browse	208.91.199.223
	Bank Swift.doc	Get hash	malicious	Browse	162.215.241.145
	SecuriteInfo.com.Trojan.PackedNET.831.28325.exe	Get hash	malicious	Browse	208.91.199.225
	Trial order 20210609.exe	Get hash	malicious	Browse	208.91.199.224
	BP4w3lADAPfOKmI.exe	Get hash	malicious	Browse	208.91.199.223
	4It7P3KCyYHUWHU.exe	Get hash	malicious	Browse	208.91.199.225
	PO -TXGU5022187.xlsx	Get hash	malicious	Browse	208.91.199.223
	Bestil 5039066002128.exe	Get hash	malicious	Browse	208.91.199.224

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oRSxZhDFLi.exe.log Download File
Process:	C:\Users\user\Desktop\oRSxZhDFLi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.645919746115
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	oRSxZhDFLi.exe
File size:	737280
MD5:	edf51521ad563bef8fa2f5ed218ac98c
SHA1:	ddbff9f775d0665126f2e64f84599474515c2844
SHA256:	1da3e92a89caaec997c1712bdd40454d44002fd484468e403a4367eb47438766
SHA512:	69081bc45f6adb4028818e3ce1744ee5683e328d5ac590546bae336cf6882cca984eec2c66e78900d1fdcedb563f9250ffe496c0ee537265ad12cfee82d49efe
SSDEEP:	12288:gNKuDBlMV40IdjEJu+F5fHqCssK2091wpYe0NCChooX9/75:gfDBUajEjnf2sK20Pe0Nxt7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P......".......;... ...@....@.. ....................................@................................

File Icon


Icon Hash:	7908246363490058

Static PE Info

General
Entrypoint:	0x4a3ba2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C0CF83 [Wed Jun 9 14:26:11 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa3b50	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x11ec8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa3a18	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa1ba8	0xa1c00	False	0.844705431318	data	7.74566115268	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x11ec8	0x12000	False	0.344767252604	data	5.56440090868	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xa42e0	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0xa4748	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0xa57f0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4294901502, next used block 4294901502
RT_ICON	0xa7d98	0x5488	data
RT_ICON	0xad220	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 254, next used block 2130706432
RT_ICON	0xb1448	0x25a8	data
RT_ICON	0xb39f0	0x10a8	data
RT_ICON	0xb4a98	0x988	data
RT_ICON	0xb5420	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xb5888	0x30	data
RT_GROUP_ICON	0xb58b8	0x84	data
RT_VERSION	0xb593c	0x3a0	data
RT_MANIFEST	0xb5cdc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2003 - 2021
Assembly Version	7.0.5.0
InternalName	FileAssociationEntry.exe
FileVersion	7.0.5.0
CompanyName	Jet Brain Inc.
LegalTrademarks
Comments
ProductName	JetBrain Assemblies
ProductVersion	7.0.5.0
FileDescription	JetBrain Assemblies
OriginalFilename	FileAssociationEntry.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/10/21-19:12:20.740280	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49770	587	192.168.2.4	208.91.199.225

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 19:10:25.401439905 CEST	58028	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:25.451541901 CEST	53	58028	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:26.346734047 CEST	53097	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:26.398296118 CEST	53	53097	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:27.142380953 CEST	49257	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:27.205255985 CEST	53	49257	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:27.278772116 CEST	62389	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:27.337675095 CEST	53	62389	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:28.480484009 CEST	49910	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:28.542522907 CEST	53	49910	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:29.452892065 CEST	55854	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:29.505655050 CEST	53	55854	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:30.661750078 CEST	64549	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:30.712099075 CEST	53	64549	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:31.724973917 CEST	63153	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:31.775274038 CEST	53	63153	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:32.851958036 CEST	52991	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:32.904110909 CEST	53	52991	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:34.101843119 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:34.160237074 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:35.239185095 CEST	51726	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:35.289227962 CEST	53	51726	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:36.151037931 CEST	56794	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:36.212647915 CEST	53	56794	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:37.358100891 CEST	56534	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:37.409306049 CEST	53	56534	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:38.530730009 CEST	56627	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:38.580696106 CEST	53	56627	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:39.670407057 CEST	56621	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:39.720827103 CEST	53	56621	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:40.890826941 CEST	63116	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:40.941236019 CEST	53	63116	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:42.010301113 CEST	64078	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:42.060415030 CEST	53	64078	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:42.945130110 CEST	64801	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:43.005511999 CEST	53	64801	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:43.922940969 CEST	61721	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:43.979111910 CEST	53	61721	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:44.873466969 CEST	51255	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:44.926531076 CEST	53	51255	8.8.8.8	192.168.2.4
Jun 10, 2021 19:10:55.156816959 CEST	61522	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:10:55.220213890 CEST	53	61522	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:14.668118000 CEST	52337	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:14.803668976 CEST	53	52337	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:15.504663944 CEST	55046	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:15.576807022 CEST	53	55046	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:15.794269085 CEST	49612	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:15.855659962 CEST	53	49612	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:16.875878096 CEST	49285	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:16.938790083 CEST	53	49285	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:17.693217039 CEST	50601	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:17.756757975 CEST	53	50601	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:18.681129932 CEST	60875	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:18.842941046 CEST	53	60875	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:19.830936909 CEST	56448	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:19.892752886 CEST	53	56448	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:20.808141947 CEST	59172	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:20.869880915 CEST	53	59172	8.8.8.8	192.168.2.4
Jun 10, 2021 19:11:22.307574987 CEST	62420	53	192.168.2.4	8.8.8.8
Jun 10, 2021 19:11:22.369364977 CEST	53	62420	8.8.8.8	192.168.2.4

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: oRSxZhDFLi.exe PID: 7040 Parent PID: 6060

General

Start time:	19:10:30
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\oRSxZhDFLi.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\oRSxZhDFLi.exe'
Imagebase:	0x880000
File size:	737280 bytes
MD5 hash:	EDF51521AD563BEF8FA2F5ED218AC98C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.656741610.0000000003DD9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.656155190.0000000002E12000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: oRSxZhDFLi.exe PID: 660 Parent PID: 7040

General

Start time:	19:10:33
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\oRSxZhDFLi.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\oRSxZhDFLi.exe
Imagebase:	0x3d0000
File size:	737280 bytes
MD5 hash:	EDF51521AD563BEF8FA2F5ED218AC98C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: oRSxZhDFLi.exe PID: 2804 Parent PID: 7040

General

Start time:	19:10:34
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\oRSxZhDFLi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\oRSxZhDFLi.exe
Imagebase:	0x7e0000
File size:	737280 bytes
MD5 hash:	EDF51521AD563BEF8FA2F5ED218AC98C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.652461576.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.908767191.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.911434971.0000000002B71000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: oRSxZhDFLi.exe PID: 7040 Parent PID: 6060 oRSxZhDFLi.exeCOMMON

Executed Functions

Function 02C80BF8, Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

$%!l, xrefs: 02C80D28

Memory Dump Source

Source File: 00000000.00000002.655952791.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID:
String ID: $%!l
API String ID: 0-4161362926
Opcode ID: 3ae267e4b1293e8912987ef8427be6e14ba022a7d1efcf5d57fc8830708faab4
Instruction ID: 9d1a231eeeed3eae1fb32ea57360d8d3a010d3b966548551e4307fb8a0ff72ad
Opcode Fuzzy Hash: 3ae267e4b1293e8912987ef8427be6e14ba022a7d1efcf5d57fc8830708faab4
Instruction Fuzzy Hash: 2BC19E30B012049FDB14EF68D554BAEB7F6AF89308F2580A9E545EB3A1CB35ED09CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02C80F10, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655952791.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0711145cb9eadbc1efc1e00702f92d34bab7a9e901f3e6953ad3033953bfbd3b
Instruction ID: a553d564af098c00950d3d1f8a7de594f283ba762375150a136eb0fc0b83ffb4
Opcode Fuzzy Hash: 0711145cb9eadbc1efc1e00702f92d34bab7a9e901f3e6953ad3033953bfbd3b
Instruction Fuzzy Hash: FB114871D042188FDB15DFA5D4197EDBBF0AB4E31AF04D46AD446B7290C7398A88CF68

Uniqueness

Uniqueness Score: -1.00%

Function 02C80F20, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655952791.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca9a2cd569c9a18afc54dc3db6fd13698393c03d20d5455c4b165024bdd16c4
Instruction ID: cfe996cd786c4409bb59523d1146c5dc79929d72dfc16df50850ffce0505404e
Opcode Fuzzy Hash: aca9a2cd569c9a18afc54dc3db6fd13698393c03d20d5455c4b165024bdd16c4
Instruction Fuzzy Hash: 41117C30D042588FDB14DFA6C418BEEBBF1AF4E319F14D469D405B3290C7794A48CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02C80FD4, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655952791.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64597030335385074ef2f96f0506e439bc0124e49eac8604d0302c1eb02f3f74
Instruction ID: c79a41893805ba00555d5c7559eaca3ead4e79bd5bd6929d562f3f0cb214c6dd
Opcode Fuzzy Hash: 64597030335385074ef2f96f0506e439bc0124e49eac8604d0302c1eb02f3f74
Instruction Fuzzy Hash: C2E02B6084D3D58FD3011BA08C256BABFB09B07249F04C48BC042F71D2C3A9410AC751

Uniqueness

Uniqueness Score: -1.00%

Function 01066B80, Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01066BF0
GetCurrentThread.KERNEL32 ref: 01066C2D
GetCurrentProcess.KERNEL32 ref: 01066C6A
GetCurrentThreadId.KERNEL32 ref: 01066CC3

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1edef3e0780c10eb80913dee48efa4ee3333e7074be462e423c702cfc465fd18
Instruction ID: 042b64e8e0412b61663f19ab56af66acde8a2920a961e1fe50ddaeef1ffc2da9
Opcode Fuzzy Hash: 1edef3e0780c10eb80913dee48efa4ee3333e7074be462e423c702cfc465fd18
Instruction Fuzzy Hash: 8C5154B0D006498FDB14CFA9D6887EEBBF4FF49314F2084AAE458A7250D7755844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01066B90, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01066BF0
GetCurrentThread.KERNEL32 ref: 01066C2D
GetCurrentProcess.KERNEL32 ref: 01066C6A
GetCurrentThreadId.KERNEL32 ref: 01066CC3

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9b68a2c270bbc8b6cf6efd486496e7d70d5419c662b58abcc03c44fefa2581b3
Instruction ID: 241847ada406274a7b9ed78f8f87c76b5bc9a8054cd4e2e6a4bb70f4585344de
Opcode Fuzzy Hash: 9b68a2c270bbc8b6cf6efd486496e7d70d5419c662b58abcc03c44fefa2581b3
Instruction Fuzzy Hash: C15163B0D006498FDB14CFA9C688BEEBBF4FF49314F2084A9E458A3250D7756844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0106BBB8, Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0106BE0E

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 674b7a4e88deee96646c0ba2b33f4683f3e8382734aff0ac484c6b48adff6901
Instruction ID: 88365116767259cd6bb29014fdc833c61f61e5b87cc0fcedd405dae96b3531ac
Opcode Fuzzy Hash: 674b7a4e88deee96646c0ba2b33f4683f3e8382734aff0ac484c6b48adff6901
Instruction Fuzzy Hash: 2E8135B0A00B098FD764DF29C45475ABBF5BF88314F00896DD58ADBA41DB74E905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0106DC6D, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0106DD8A

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3f1309b4f0f1e1deade76b468161632a548c8554d04ed4b7181c458bd12943b2
Instruction ID: 645f349f8c53fac358dfc13df4c3e4a5317366df0af7ab5223cb742d338cedf5
Opcode Fuzzy Hash: 3f1309b4f0f1e1deade76b468161632a548c8554d04ed4b7181c458bd12943b2
Instruction Fuzzy Hash: 1B51BDB1D00309DFDB14DF99C884ADEBBB5FF48310F24822AE959AB250D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0106DC78, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0106DD8A

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7b8a33d9d563ade20306e4a4a1f75abe197e9a695f1eaddeeea805d2a55e5404
Instruction ID: caf9032c2faad19bdb3e301fa101a23d1d6f5d71ef9088185679ad9b58f886cd
Opcode Fuzzy Hash: 7b8a33d9d563ade20306e4a4a1f75abe197e9a695f1eaddeeea805d2a55e5404
Instruction Fuzzy Hash: D241CEB1D00309AFDB14DF99C884ADEBBF5FF48310F24812AE919AB250D7759845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01066D41, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01066E3F

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a90a2c1716a783dcb0149a7796dadca35abe95e400d37e8228b39dea87b5e66b
Instruction ID: adb7ca25841a1043ebaefc35ecaaf1a8b6d469d4e18c921c5ee212eaa3a3280b
Opcode Fuzzy Hash: a90a2c1716a783dcb0149a7796dadca35abe95e400d37e8228b39dea87b5e66b
Instruction Fuzzy Hash: 57416876900249AFCF01CF99D944ADEBFF9FB48310F15805AEA54A7360C3759954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01066DB0, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01066E3F

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: de2ebf9f3dd5f983519f2b261982900dec1e1dc4a7c6256bd1f557c9d60613b9
Instruction ID: 5fff93c3b65f1bcb0a6f2ec66ed18851973a3e8cd996e5ff9ecf13f927419bcb
Opcode Fuzzy Hash: de2ebf9f3dd5f983519f2b261982900dec1e1dc4a7c6256bd1f557c9d60613b9
Instruction Fuzzy Hash: 8A2100B59002089FDB10CFA9D988AEEBBF8FB48324F14801AE914B3310D375A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01066DB8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01066E3F

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ba8491fc36c23df01ca599785126beb21aec1ad336f773e5f3acfa124cfc60c2
Instruction ID: 0322ad0b4546ec8007464ff4dc3edf672200ce8037fb5afe0a75801d54126995
Opcode Fuzzy Hash: ba8491fc36c23df01ca599785126beb21aec1ad336f773e5f3acfa124cfc60c2
Instruction Fuzzy Hash: C521C2B59002489FDB10CFA9D884AEEBBF8FB48324F14841AE955B3350D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0106B0D8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0106BE89,00000800,00000000,00000000), ref: 0106C09A

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 05c86782d162969bdd67100c9a9a1536ca4ad8241f994116d8e1f20002bab606
Instruction ID: e085fd91fb93a80b04a39e2c3565ca3ee8e0ef64a63581e261c86064721feac5
Opcode Fuzzy Hash: 05c86782d162969bdd67100c9a9a1536ca4ad8241f994116d8e1f20002bab606
Instruction Fuzzy Hash: 311136B29002488FEB10CF9AC444BDEFBF8EB49314F00842AE555B7600C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0106C028, Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0106BE89,00000800,00000000,00000000), ref: 0106C09A

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c4bafc67a0c6cb0edc13b3a8a5d3cd2677284bd740f5c57d6cad44f60a871a37
Instruction ID: f70c010f65bf905cd3e8660e6888a1da75bbfd15bcbcfd767ddb2f868abbed7f
Opcode Fuzzy Hash: c4bafc67a0c6cb0edc13b3a8a5d3cd2677284bd740f5c57d6cad44f60a871a37
Instruction Fuzzy Hash: 311103B6D002098FEB10CF99C548BDEFBF4EB49314F14852AE955B7600C375A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C81D10, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 02C81D70

Memory Dump Source

Source File: 00000000.00000002.655952791.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 623501df3869cbb340d4d5a69d8b2a9c23b39924940a402d2c3abe6c7a312fdf
Instruction ID: faca73ba6afae6ea61d8eee345a8832f6bbc1194ca7c197fd4b9d01e08942923
Opcode Fuzzy Hash: 623501df3869cbb340d4d5a69d8b2a9c23b39924940a402d2c3abe6c7a312fdf
Instruction Fuzzy Hash: 8B1125B68006498FCB10DF99D448BDEBBF4FF49324F14842AE969A7740D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0106BDA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0106BE0E

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 775d39bb493f62cccf457630454efb698f660e47fc5445e1d4c6a8d2233bd733
Instruction ID: b8c96af919427e91f8e2417deabbf698fca47382e5ad246c132cb97744f72062
Opcode Fuzzy Hash: 775d39bb493f62cccf457630454efb698f660e47fc5445e1d4c6a8d2233bd733
Instruction Fuzzy Hash: 1A1102B1D002498FDB10CF9AC444BDEFBF8EB88324F10841AD969B7600C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C81D18, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 02C81D70

Memory Dump Source

Source File: 00000000.00000002.655952791.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f240e46311056217a58c2e124d266647e8ed28359b7aae7548ec8adf3ccc1f62
Instruction ID: 707e63a8457e4d0ab67a850e7cacb53b1003f63241cf1f12ef555a98daed070e
Opcode Fuzzy Hash: f240e46311056217a58c2e124d266647e8ed28359b7aae7548ec8adf3ccc1f62
Instruction Fuzzy Hash: 821133B18003498FCB10DF99C488BDEBBF4EB49324F14842AD968A7740D378A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0106DEB9, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0106DF1D

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 4d82719e2e62499a14309192dcd4db6dc0c2dcd56aa3d4c45099f98f309fa638
Instruction ID: ad870825621ad5b24527dc475640129c265fb1254c52467dcc51d4124eb8bde5
Opcode Fuzzy Hash: 4d82719e2e62499a14309192dcd4db6dc0c2dcd56aa3d4c45099f98f309fa638
Instruction Fuzzy Hash: 7F11D3B69002098FDB10CF99D589BDEBBF8FB48324F15851AE959B7740C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0106DEC0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0106DF1D

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 173d43d09ded73232677ba9557c28509073fc9263d3752d3f3e3d1a82233ca46
Instruction ID: b975700998ca651d3c285f27c378967527b2637e5c006f860417d2219382c9a5
Opcode Fuzzy Hash: 173d43d09ded73232677ba9557c28509073fc9263d3752d3f3e3d1a82233ca46
Instruction Fuzzy Hash: CE11D0B59002499FDB10CF99D488BDEBBF8EB49324F10841AE965B7740C3B4A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FED4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655567566.0000000000FED000.00000040.00000001.sdmp, Offset: 00FED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d09aaaeaf29e098495d3eb1089992be5a95876df9443a4d6839871f3e6f0bb4
Instruction ID: d33b19ec20a8b196607edbcd44abddb3900d2130bf70ff81436fc0dd0f658ee5
Opcode Fuzzy Hash: 1d09aaaeaf29e098495d3eb1089992be5a95876df9443a4d6839871f3e6f0bb4
Instruction Fuzzy Hash: 18213AB2904380DFCB04CF10D9C0B26BFA5FB98328F288569E9054B656C336D846EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655591018.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d19d98fd897d619e7108022c28dd0826f68ccce3aed7a2d7df6ccba535e3ce
Instruction ID: b3de82c51a9d3c3072d0e77f2c3a46440da8cd96dfa8a5e267491dee648e9170
Opcode Fuzzy Hash: 15d19d98fd897d619e7108022c28dd0826f68ccce3aed7a2d7df6ccba535e3ce
Instruction Fuzzy Hash: 182107B1904248DFDB14DF10D8C4B26BBA6FF84324F24C56DEA094B26ACB76D847DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655591018.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8eebe6d76b0e64eefd1c0bddc07f6947fa720c6a5f885c4612101590f8f4c00
Instruction ID: 4a7bea7f7dde0069d7bd7cb507d099f8b9ed87b668adcd7cd77069529ea4434e
Opcode Fuzzy Hash: a8eebe6d76b0e64eefd1c0bddc07f6947fa720c6a5f885c4612101590f8f4c00
Instruction Fuzzy Hash: 622180755093C48FCB12CF20D994715BF71EF46324F28C5EAD9498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FED4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655567566.0000000000FED000.00000040.00000001.sdmp, Offset: 00FED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf9d05837f20679d6678064280a21b40d007861ebc24b3ccb10da70a24719c3
Instruction ID: e033ac52a4c5ea2c0470f9c27f46fe075f8d718af61029f8f5dc3e058b4c6a18
Opcode Fuzzy Hash: abf9d05837f20679d6678064280a21b40d007861ebc24b3ccb10da70a24719c3
Instruction Fuzzy Hash: 34119376904380DFCB15CF14D9C4B16BF71FB98324F2886A9D8054B656C33AD856DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FED799, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655567566.0000000000FED000.00000040.00000001.sdmp, Offset: 00FED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a60d8e12d914178217b74003f882a733be6c72a62354002cb11eab845e0209
Instruction ID: ff4d191047f4199f59deba03cb604ae6852e1f89409ccf9134f6df5cdd038d10
Opcode Fuzzy Hash: 67a60d8e12d914178217b74003f882a733be6c72a62354002cb11eab845e0209
Instruction Fuzzy Hash: CC012B724083C09AE7204B17CCC4B66FBD8EF45374F18C45AED045BA86C3789C40E6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00FED798, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655567566.0000000000FED000.00000040.00000001.sdmp, Offset: 00FED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcfb4db2d7aef5a81e90da8dff8fb24a50f006d9bb0b89710b034a3171ddfca
Instruction ID: d602b7379214cc10c4acd4e81a1a6d2d5adcc3d39068fad9b8c40df5bac63b40
Opcode Fuzzy Hash: 7dcfb4db2d7aef5a81e90da8dff8fb24a50f006d9bb0b89710b034a3171ddfca
Instruction Fuzzy Hash: C3F096718043849EE7208B16DCC4B66FFE8EF95774F18C45AED085B686C3799C44DAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0088B7D5, Relevance: 2.2, Instructions: 2170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.653618049.0000000000882000.00000002.00020000.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.653576991.0000000000880000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024ab50406ecedc874b6b8cf2f59109357ced4d468fcdc71a8b4efd18103f2c3
Instruction ID: f3f86f77f62a23ee015672ca45ff6b5b7adfefcbd2aa64317bef0864eae0ef60
Opcode Fuzzy Hash: 024ab50406ecedc874b6b8cf2f59109357ced4d468fcdc71a8b4efd18103f2c3
Instruction Fuzzy Hash: 9C03676104E7C25FC7138B349C755E1BFB1AE9321431E89CFD8C18F4A3E2295A5ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 02C8152D, Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655952791.0000000002C80000.00000040.00000001.sdmp, Offset: 02C80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d699053358df0d40998e484d728a3d44bced9df13a31e3ec73e9ab481b1a611
Instruction ID: a9cd047f27816856ebf805adb2a0d2de92580808a0340d6a4cc146c94b1966a0
Opcode Fuzzy Hash: 0d699053358df0d40998e484d728a3d44bced9df13a31e3ec73e9ab481b1a611
Instruction Fuzzy Hash: 2DC1C2717006058FE719EB76C460BAA77FAAFC9708F18846DD18ACB290CF75E906CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0106C2B0, Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1725da7a89c4f77810a07149bcce2690a3df950729b794dc6aa3b90814ea9329
Instruction ID: 76ba3ae401fb969979c0e97dbe3ae6f101050f8930b4da41aadf46a6c5e36dd6
Opcode Fuzzy Hash: 1725da7a89c4f77810a07149bcce2690a3df950729b794dc6aa3b90814ea9329
Instruction Fuzzy Hash: 07527AB1981B068FD732CF14E8C81997BB4FB46398FD04A18C2A16B6D0D7F4656ACF46

Uniqueness

Uniqueness Score: -1.00%

Function 01069990, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.655701862.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e15f9409ef8253f05f718775df3863a476893f1e0ae3ff318d3a76a3dcc15cb
Instruction ID: 7205b5f293b75d4696dbd994e9a6133d6cd093fbc420f3375f6ea9319e094090
Opcode Fuzzy Hash: 1e15f9409ef8253f05f718775df3863a476893f1e0ae3ff318d3a76a3dcc15cb
Instruction Fuzzy Hash: 4EA17D72E0021A8FCF05DFA9C8445DEBBF6FF89304B15856AE905BB221EB71E915CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: oRSxZhDFLi.exe PID: 2804 Parent PID: 7040 oRSxZhDFLi.exeCOMMON

Executed Functions

Function 00D1E958, Relevance: 2.3, APIs: 1, Instructions: 760libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D1F0E0

Memory Dump Source

Source File: 00000004.00000002.909276219.0000000000D10000.00000040.00000001.sdmp, Offset: 00D10000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60fa275a845f13dd562e09a9dbd8a13d833fbeb935fa94474422eb7a2e0c198b
Instruction ID: 0706a646051bdd6f8eda34d1056ba75bf2e3d89b615ab5e8d255032da78b8c22
Opcode Fuzzy Hash: 60fa275a845f13dd562e09a9dbd8a13d833fbeb935fa94474422eb7a2e0c198b
Instruction Fuzzy Hash: F362F935E047199FCB24EF78C8546DEB7F2AF89304F1085AAD549AB350EF309A85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0117B618, Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.910971154.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0861750a47f14598e99b2b635d8e2c808e6a459fd0bc1758858f2bffdc061e30
Instruction ID: d274c9066e38a9e3e5b60d4a461dacf44815370022ce7ae5c2502dc85554e43b
Opcode Fuzzy Hash: 0861750a47f14598e99b2b635d8e2c808e6a459fd0bc1758858f2bffdc061e30
Instruction Fuzzy Hash: 0CF14E30A04309CFDB18DFA9C884BADBBF1FF88314F158159E905AB3A5DB70A945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 009E5C00, Relevance: 1.7, APIs: 1, Instructions: 176libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009E5CAF

Memory Dump Source

Source File: 00000004.00000002.909089956.00000000009E0000.00000040.00000001.sdmp, Offset: 009E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ec6cadd3d11dde37ba7ab519bad1b39ee0d7f1a904078c6a5f8d2c5f22d2f719
Instruction ID: 8fb16452e78e7f2d075b6ad84980136d5d20c8e78839f02fb6221913b6411e10
Opcode Fuzzy Hash: ec6cadd3d11dde37ba7ab519bad1b39ee0d7f1a904078c6a5f8d2c5f22d2f719
Instruction Fuzzy Hash: F251B630A043449FCB04ABB4D858A9EB7F6EF84304F15856AD506DB391EF70DD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0297691F, Relevance: 6.1, APIs: 4, Instructions: 133threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 029769A0
GetCurrentThread.KERNEL32 ref: 029769DD
GetCurrentProcess.KERNEL32 ref: 02976A1A
GetCurrentThreadId.KERNEL32 ref: 02976A73

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 27e9836e91a77364dbfdbf33a0b075b40f3416b6c1e69661ed7253a8f6d836ed
Instruction ID: 38f0d9bdd69363504757b5de354b462bf0824689a2ce31afca3e90df784056ef
Opcode Fuzzy Hash: 27e9836e91a77364dbfdbf33a0b075b40f3416b6c1e69661ed7253a8f6d836ed
Instruction Fuzzy Hash: C85156B0A057498FDB14CFA9C688BDEBBF4FF89314F24849AE449A7250CB745885CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02976940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 029769A0
GetCurrentThread.KERNEL32 ref: 029769DD
GetCurrentProcess.KERNEL32 ref: 02976A1A
GetCurrentThreadId.KERNEL32 ref: 02976A73

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b1509b4fdcc6ca56bf0ddc9dc584f40b2c0b452d5efd0f5101643ec59f22b857
Instruction ID: b0b2acfe583410e3737bbe0236467c4e476aac3c2791752eb8a9a5785d7321bf
Opcode Fuzzy Hash: b1509b4fdcc6ca56bf0ddc9dc584f40b2c0b452d5efd0f5101643ec59f22b857
Instruction Fuzzy Hash: 705133B0A007498FDB14CFA9D648B9EBBF5FF89314F20849AE409B7350DB749884CB65

Uniqueness

Uniqueness Score: -1.00%

Function 009E7C60, Relevance: 1.8, APIs: 1, Instructions: 296libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009E7DE1

Memory Dump Source

Source File: 00000004.00000002.909089956.00000000009E0000.00000040.00000001.sdmp, Offset: 009E0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c69e13ede5d893dc2cf35e3ac2467d8fe56c74134631e09699f4197f9e64cd54
Instruction ID: fe93dabbc693254314bf48779f2cc9736264f82067d6ddb72f8fb6c682f0b9ba
Opcode Fuzzy Hash: c69e13ede5d893dc2cf35e3ac2467d8fe56c74134631e09699f4197f9e64cd54
Instruction Fuzzy Hash: A8B1D230A093849FDB069BB5D8587AE7BF6AF85304F14886AD445EB392DF34DC09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 055AF158, Relevance: 1.7, Strings: 1, Instructions: 409COMMON

Download Yara Rule

Strings

\ l, xrefs: 055AF1EC

Memory Dump Source

Source File: 00000004.00000002.913937535.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID: \ l
API String ID: 0-958202751
Opcode ID: 799604d7c14d76c590318329b074db95e963b7b7f40cd96130591a70b76c7c13
Instruction ID: bbd01497694b65d5b548ed40c33a8f446784c66ae0cb16b97b3aa6b9cac4abef
Opcode Fuzzy Hash: 799604d7c14d76c590318329b074db95e963b7b7f40cd96130591a70b76c7c13
Instruction Fuzzy Hash: 62E16235F402149FDB149B68D894BAEB7F2FF89310F148466E50AEB391DE74DC428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02975084, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 029751A2

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c521d931b359b7ba3be2b0bd4e08d974e79cf531e65fb997830c7b36eeb8c685
Instruction ID: d1b514a351123bf89309b32ad301a6788c8cb73c83834c547ece609df0376f86
Opcode Fuzzy Hash: c521d931b359b7ba3be2b0bd4e08d974e79cf531e65fb997830c7b36eeb8c685
Instruction Fuzzy Hash: 5351DEB1D003099FDB14CF99C884ADEFBB5FF88314F65812AE819AB210D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02975090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 029751A2

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 330ff8303b9e32a97c87b3f3eb97e7e1fdfaf0e33f138866d28fdfc255aad7c3
Instruction ID: d688d705b1397d591cef4096a2456c4e6098cb2293c63f1e1135f2688b43a706
Opcode Fuzzy Hash: 330ff8303b9e32a97c87b3f3eb97e7e1fdfaf0e33f138866d28fdfc255aad7c3
Instruction Fuzzy Hash: 3D41CEB1D003099FDB14CF99C884ADEFBB5FF88314F65812AE819AB210D775A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E468, Relevance: 1.6, APIs: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 00D1E571

Memory Dump Source

Source File: 00000004.00000002.909276219.0000000000D10000.00000040.00000001.sdmp, Offset: 00D10000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bfd9401697a6090cb71386144099593d4ee7e0e7845935ba8fec7690244d9100
Instruction ID: 2e0b5e03d104ffee46e8f10546b20e9149168e8dbf2508fe40f2f7311109be3d
Opcode Fuzzy Hash: bfd9401697a6090cb71386144099593d4ee7e0e7845935ba8fec7690244d9100
Instruction Fuzzy Hash: DA413AB1D04258DFDB10CF99D484ADEBBF6BF48314F19842AE819AB351DB709845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1DDB0, Relevance: 1.6, APIs: 1, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 00D1DEB4

Memory Dump Source

Source File: 00000004.00000002.909276219.0000000000D10000.00000040.00000001.sdmp, Offset: 00D10000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8fd1f47dbe4e11f20edee229429cece7005c97bdf780bde9aa16de0b49a5593a
Instruction ID: 91bdb0ae05a0d3b332f2a9f7dabb9fb5512bd8f6b00053247f9f69a59f0e6b32
Opcode Fuzzy Hash: 8fd1f47dbe4e11f20edee229429cece7005c97bdf780bde9aa16de0b49a5593a
Instruction Fuzzy Hash: 6D414A70D042489FDB14CFA9D544A9EFBF2BF49304F29C16AE409AB341CB759885CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0297779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02977F09

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9bcee637293eff6156592e17403cba1e98af55d6c7d936ddfb8fc5db9503d30f
Instruction ID: a3712c2bfcc09ed9bb89d921c4b74a9bcab3d5235806afeb1ac670e279e50a5a
Opcode Fuzzy Hash: 9bcee637293eff6156592e17403cba1e98af55d6c7d936ddfb8fc5db9503d30f
Instruction Fuzzy Hash: 5E411AB5A003498FDB14CF99C588AAAFBF5FF88314F148859E519AB321D774A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1AA4C, Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 00D1E571

Memory Dump Source

Source File: 00000004.00000002.909276219.0000000000D10000.00000040.00000001.sdmp, Offset: 00D10000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 026d5b272ac27f9d3b16418fda75ce3031591d23053e40a1d5a53cc87064316f
Instruction ID: de1608255dc5efd157b429c91b350ee45bb05ebcc66e1b7922e80f35a726fb0e
Opcode Fuzzy Hash: 026d5b272ac27f9d3b16418fda75ce3031591d23053e40a1d5a53cc87064316f
Instruction Fuzzy Hash: 9131D2B1D04258AFDB10CF99D484ADEFBF6BF48314F54802AE819AB350DB749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1AA40, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 00D1DEB4

Memory Dump Source

Source File: 00000004.00000002.909276219.0000000000D10000.00000040.00000001.sdmp, Offset: 00D10000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 617489220c5da5a17f4bd6f31cb4f97bc7a2d3072add428379c7f703a81dd674
Instruction ID: 1e4353df2076c34cd456e12b056b3e1f90c0e48b92e4a2db464b552b8f221e60
Opcode Fuzzy Hash: 617489220c5da5a17f4bd6f31cb4f97bc7a2d3072add428379c7f703a81dd674
Instruction Fuzzy Hash: 9131F4B1D04249DFDB10CF99D584A8EFBF5BF48314F28816AE409AB341CB759985CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0297C189, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0297C212

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 6a5f69a6df1fbbde6eecb6ecbf5cde5efd3d71dd6f380efe3f98f1d3299f0b13
Instruction ID: f0d129ed1153b6538847bca602d7c51ec6701d14e9e4e65adba0b93045b7f5dc
Opcode Fuzzy Hash: 6a5f69a6df1fbbde6eecb6ecbf5cde5efd3d71dd6f380efe3f98f1d3299f0b13
Instruction Fuzzy Hash: D331E2708053858FDB10DFA8E5483DEBFF5EB46728F14886AD448A7242CB759515CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02976B63, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02976BEF

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bc8b213d99a8ab455628049375f9af7ef3f9dde50644cf805a5894970ae0081c
Instruction ID: 7f933a104f12f2f7fb2d63364241431a4de8ce95b4fad21a34ed8451fe14865b
Opcode Fuzzy Hash: bc8b213d99a8ab455628049375f9af7ef3f9dde50644cf805a5894970ae0081c
Instruction Fuzzy Hash: 5D21E0B59002499FDB10CFA9D984AEEBBF8FB48324F14846AE914B3310D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02976B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02976BEF

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: af13aadae5af738e277febb31bc8c901387d50c289083a135fbd661eba94cb4b
Instruction ID: 127bf023717002df0be0f7c275925e32fcbd52c9c8fdb0bb67783ae6c3acb588
Opcode Fuzzy Hash: af13aadae5af738e277febb31bc8c901387d50c289083a135fbd661eba94cb4b
Instruction Fuzzy Hash: F421B0B59002499FDB10CFA9D984ADEFBF8FB48324F14842AE915B3310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01176744, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,01177999,00000800), ref: 01177A2A

Memory Dump Source

Source File: 00000004.00000002.910971154.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3fe35a15cd3780ca8510ae5604a6d0b842655add6efc643cd7bc1dbdefc5901f
Instruction ID: d74e1ba89867d296971abf6d9aa1af4d83f6d8eb25ad420fbc8e2ee4d2c4004f
Opcode Fuzzy Hash: 3fe35a15cd3780ca8510ae5604a6d0b842655add6efc643cd7bc1dbdefc5901f
Instruction Fuzzy Hash: A31103B29002498FDB14CF9AC448B9EFBF4EB88320F14842AE915B7740C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0297C198, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0297C212

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 762e2744397c15a1d255085df718c4bb54c3286008232681466a1f8481addcb7
Instruction ID: a14d5e6e3d3de43008f8b25c33e71ea795f265bfa37ffcb4896077ee278e8a25
Opcode Fuzzy Hash: 762e2744397c15a1d255085df718c4bb54c3286008232681466a1f8481addcb7
Instruction Fuzzy Hash: C31189709003098FCB10DFA9D94879EBBF4EB49728F20882AD404A3641CB79A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011779B9, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,01177999,00000800), ref: 01177A2A

Memory Dump Source

Source File: 00000004.00000002.910971154.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e45b2deb18a85251a3898eb6b24a5068a41a7bff9fc9071e70b405493427a506
Instruction ID: 6342c9e048660315463223277e5f58237cd9f7a41466486f84a7d92aebe7b695
Opcode Fuzzy Hash: e45b2deb18a85251a3898eb6b24a5068a41a7bff9fc9071e70b405493427a506
Instruction Fuzzy Hash: D41112B28002098FDB14CFAAD848BDEFBF4EB88324F14842AE519B7300C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02973300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02974116

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a0e56185276a7468aa8fbf0c4b824359ba6830aecf2a0130e2e4597cbfbdeb5f
Instruction ID: ddf9bf9022902247fd327bff9784eb4661b2401496527f8ccb3fc096f1c8626d
Opcode Fuzzy Hash: a0e56185276a7468aa8fbf0c4b824359ba6830aecf2a0130e2e4597cbfbdeb5f
Instruction Fuzzy Hash: E211F3B1D002498BCB10DF9AC444BDEFBF4EB49224F10846AD829B7601D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 029740AB, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02974116

Memory Dump Source

Source File: 00000004.00000002.911247716.0000000002970000.00000040.00000001.sdmp, Offset: 02970000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 58c4a111e28eff047ee8f4b2344285c1cfb20fd2e494f93c1ce255ad1f633d72
Instruction ID: a42fd28087555f80fe7ee2037a36d5ce21b7cf4bec325e97676880ee2525ddd7
Opcode Fuzzy Hash: 58c4a111e28eff047ee8f4b2344285c1cfb20fd2e494f93c1ce255ad1f633d72
Instruction Fuzzy Hash: 1011F3B5D002498FCB10DF9AC448BDEFBF4EB89224F11846AD429B7600D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117A540, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0117B455

Memory Dump Source

Source File: 00000004.00000002.910971154.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f08d40e06f975f79940c8ce3314ed8eec3a4747ede54286f171f6e0189bcee35
Instruction ID: b7e5abfbd6744422e1d4b962aebb96dfd40c8e4030c3ac05dfb183b819de4277
Opcode Fuzzy Hash: f08d40e06f975f79940c8ce3314ed8eec3a4747ede54286f171f6e0189bcee35
Instruction Fuzzy Hash: ED1103B19046498FCB10CF99D448B9EFBF4EB48324F248459E51AB7700C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0117B3F8, Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0117B455

Memory Dump Source

Source File: 00000004.00000002.910971154.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b3d49eaf7d169546f2a2b4606eeeff5d8ba422783a5fa2b55799da502ae9ef83
Instruction ID: 036ee820914ed2502e76b610a90e892a489e522cfc1b54988ac7eb47b9fe2497
Opcode Fuzzy Hash: b3d49eaf7d169546f2a2b4606eeeff5d8ba422783a5fa2b55799da502ae9ef83
Instruction Fuzzy Hash: E91100B59042498FCB20CF99D489BCEFBF4EB48324F24845AE51AB7700C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 055AFB90, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.913937535.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e291d1af87448735ac91679b1814e4d4ecbbd2b1cdb995ea2210bdab7e021b
Instruction ID: 6970b82223d9208c64c135995e791783a3c288e9f2b39b99be28612722150938
Opcode Fuzzy Hash: 34e291d1af87448735ac91679b1814e4d4ecbbd2b1cdb995ea2210bdab7e021b
Instruction Fuzzy Hash: 0F510175A093889FDB11CB69C854BDEBBF1BF4A304F1580A6D448EB352D7349806CB61

Uniqueness

Uniqueness Score: -1.00%

Function 055AFD28, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.913937535.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e164020bcab534afcbdc20b7c359527def68cc8796fce98a403abbb2fbdec1a9
Instruction ID: cc1801999d5462565558ad162c6dd6c5d9a8f37dfc9f2d5146edb7194941bd06
Opcode Fuzzy Hash: e164020bcab534afcbdc20b7c359527def68cc8796fce98a403abbb2fbdec1a9
Instruction Fuzzy Hash: FD213536B082945FDB11976998543EEFFBABF8A310F1480A7E509D7282CB384845C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.909514547.0000000000D7D000.00000040.00000001.sdmp, Offset: 00D7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c24eeb821db62a245e4b6a32efce16309ab7398bd98557423ab8058c399734
Instruction ID: 7e95de9a5c8e30ad238c60fec6736120d8001a3b1eba4a27f343c78174956096
Opcode Fuzzy Hash: d7c24eeb821db62a245e4b6a32efce16309ab7398bd98557423ab8058c399734
Instruction Fuzzy Hash: 0021F4B1504240DFDB14DF10D9C0B26BB76FF88328F24C569E9094B20AD336E846CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.909514547.0000000000D7D000.00000040.00000001.sdmp, Offset: 00D7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7a6f520b937ab2cfa4afeccb3b049cc29dbb79c569640dd3301e486676b8a1
Instruction ID: 732f33a46dc9110bb2162a8a9f7331a7f58cd6e0ca88d5b99b2c48da7e9ab12d
Opcode Fuzzy Hash: ed7a6f520b937ab2cfa4afeccb3b049cc29dbb79c569640dd3301e486676b8a1
Instruction Fuzzy Hash: 7321F1B1504244DFCB05DF10D9C0B26BBB6FF99328F24C569E9094B246D336D856DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 055AFEB0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.913937535.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c963102ece3a0f0019075f56913860e0720ea294c63be79852bee1216be37448
Instruction ID: e7fbfd4300c8100e95916812e874f3ff565d76b17c394f741520ef967789adc7
Opcode Fuzzy Hash: c963102ece3a0f0019075f56913860e0720ea294c63be79852bee1216be37448
Instruction Fuzzy Hash: 5E218E35B142049FCB41EB78D885AAEB7F2FF89304B048466E109EB756EB34DD058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.909514547.0000000000D7D000.00000040.00000001.sdmp, Offset: 00D7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf9d05837f20679d6678064280a21b40d007861ebc24b3ccb10da70a24719c3
Instruction ID: 97e93b54fba1b796076e85a056601b6a056acc003cdf140b8f552a9934f0c6e5
Opcode Fuzzy Hash: abf9d05837f20679d6678064280a21b40d007861ebc24b3ccb10da70a24719c3
Instruction Fuzzy Hash: 0611B1B6504280DFCB11CF10D5C4B1ABF72FF85324F28C6A9D8090B61AC336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.909514547.0000000000D7D000.00000040.00000001.sdmp, Offset: 00D7D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf9d05837f20679d6678064280a21b40d007861ebc24b3ccb10da70a24719c3
Instruction ID: 3427c59662722170e32c156f22ac666aedc2cdc017f4e50d172b3b5990567882
Opcode Fuzzy Hash: abf9d05837f20679d6678064280a21b40d007861ebc24b3ccb10da70a24719c3
Instruction Fuzzy Hash: 1A11B176504284CFCB12CF10D5C4B1ABF72FF95324F28C6A9D8094B616C336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 055AFDE8, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.913937535.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6ea6b4d311ab70d89f1aa2dd575b7a50ff13325d0082df65539846fff05bed
Instruction ID: 9a43f98a4962093d2e81cbdb352ddfc042e4597b023355d5e03f1c0d8b0a676e
Opcode Fuzzy Hash: bc6ea6b4d311ab70d89f1aa2dd575b7a50ff13325d0082df65539846fff05bed
Instruction Fuzzy Hash: 0E21BFB59002189FCB50CF9AD984BCEFBF4FB48324F10852AE958A7301C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 055AFDF0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.913937535.00000000055A0000.00000040.00000001.sdmp, Offset: 055A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9883cc145168e1853137c46cf9dc35f85f341951ee52b677afb7752d18ceafe0
Instruction ID: 346d90bf492300fef4c6387a7af84e34f8148d611a1c27a21e3840671536b565
Opcode Fuzzy Hash: 9883cc145168e1853137c46cf9dc35f85f341951ee52b677afb7752d18ceafe0
Instruction Fuzzy Hash: 2521CEB59002189FCB50CF9AD884ACEFBF4FB48320F10852AE958A7300C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report oRSxZhDFLi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back