Play interactive tour

Edit tour

Windows Analysis Report Inv 0110617985 PO Wartsila quantiparts B.V..exe

Overview

General Information

Sample Name:	Inv 0110617985 PO Wartsila quantiparts B.V..exe
Analysis ID:	458946
MD5:	5c9c7f90ae087c40601f5d6bd85cadb7
SHA1:	15a76b5c5d5ee677f33b76a8371054821c6f6522
SHA256:	2e4901e09f9e7e72b65f301113d5bb075576e02fee03eb8414a986a1cca63cbb
Tags:	exenull
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates processes with suspicious names

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Inv 0110617985 PO Wartsila quantiparts B.V..exe (PID: 1236 cmdline: 'C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe' MD5: 5C9C7F90AE087C40601F5D6BD85CADB7)

Inv 0110617985 PO Wartsila quantiparts B.V..exe (PID: 4472 cmdline: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe MD5: 5C9C7F90AE087C40601F5D6BD85CADB7)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "samy@cairoshippinginternational.com", "Password": "NermoSamy@2006+", "Host": "mail.cairoshippinginternational.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 4472	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 4472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "samy@cairoshippinginternational.com", "Password": "NermoSamy@2006+", "Host": "mail.cairoshippinginternational.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe	Virustotal: Detection: 71%	Perma Link
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe	Metadefender: Detection: 40%	Perma Link
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe	ReversingLabs: Detection: 85%

Machine Learning detection for sample

Show sources

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Joe Sandbox ML: detected

Source: 6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49756 -> 99.198.101.234:587

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	String found in binary or memory: http://kgXKqA.com
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	String found in binary or memory: https://2ldxNK2U0Dyorw0.org
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_013755A0	6_2_013755A0
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_0137B864	6_2_0137B864
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_01373378	6_2_01373378
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_01370EA8	6_2_01370EA8
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_0137B468	6_2_0137B468
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_0137C7F8	6_2_0137C7F8
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_01372E38	6_2_01372E38
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_015709C8	6_2_015709C8
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_017BD160	6_2_017BD160
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_017B8B18	6_2_017B8B18
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_017B1F88	6_2_017B1F88
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_017B538C	6_2_017B538C
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_017B8649	6_2_017B8649
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_031D47A0	6_2_031D47A0
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_031D5471	6_2_031D5471
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_031D3CCC	6_2_031D3CCC
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_031D4710	6_2_031D4710
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_031D46B0	6_2_031D46B0
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_031D46D0	6_2_031D46D0
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Code function: 6_2_031DD661	6_2_031DD661

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000001.00000000.216013415.0000000000E14000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameITypeLibImporterNotifySi.exe4 vs Inv 0110617985 PO Wartsila quantiparts B.V..exe
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameXVLIKsxArMXXshQXbZxL.exe4 vs Inv 0110617985 PO Wartsila quantiparts B.V..exe
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.491090167.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Inv 0110617985 PO Wartsila quantiparts B.V..exe
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.484976552.000000000158A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Inv 0110617985 PO Wartsila quantiparts B.V..exe
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.483740101.0000000000F34000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameITypeLibImporterNotifySi.exe4 vs Inv 0110617985 PO Wartsila quantiparts B.V..exe
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485371021.0000000001790000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs Inv 0110617985 PO Wartsila quantiparts B.V..exe
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe	Binary or memory string: OriginalFilenameITypeLibImporterNotifySi.exe4 vs Inv 0110617985 PO Wartsila quantiparts B.V..exe

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/0

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inv 0110617985 PO Wartsila quantiparts B.V..exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Mutant created: \Sessions\1\BaseNamedObjects\flBuYYWkaCCoZhEJXJlsLfIks

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe	Virustotal: Detection: 71%
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe	Metadefender: Detection: 40%
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe	ReversingLabs: Detection: 85%

Source: unknown	Process created: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe 'C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe'
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process created: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process created: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static file information: File size 1315328 > 1048576

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x110600

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: initial sample

Static PE information: section name: .text entropy: 7.71885600168

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	File created: \inv 0110617985 po wartsila quantiparts b.v..exe
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	File created: \inv 0110617985 po wartsila quantiparts b.v..exe			Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Window / User API: threadDelayed 2225			Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Window / User API: threadDelayed 7542			Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe TID: 5896	Thread sleep time: -38747s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe TID: 5488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe TID: 5444	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe TID: 5444	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe TID: 5872	Thread sleep count: 2225 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe TID: 5872	Thread sleep count: 7542 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe TID: 5444	Thread sleep count: 39 > 30	Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Thread delayed: delay time: 38747	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.491090167.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.491090167.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.491090167.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.491090167.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Code function: 6_2_01374A78 LdrInitializeThunk,

6_2_01374A78

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Process created: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Jump to behavior

Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485749282.0000000001C40000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485749282.0000000001C40000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485749282.0000000001C40000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485749282.0000000001C40000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 4472, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 4472, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 4472, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery111	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Clipboard Data1	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing3	Cached Domain Credentials	System Information Discovery114	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Inv 0110617985 PO Wartsila quantiparts B.V..exe	71%	Virustotal		Browse
Inv 0110617985 PO Wartsila quantiparts B.V..exe	49%	Metadefender		Browse
Inv 0110617985 PO Wartsila quantiparts B.V..exe	86%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Inv 0110617985 PO Wartsila quantiparts B.V..exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.2.Inv 0110617985 PO Wartsila quantiparts B.V..exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://2ldxNK2U0Dyorw0.org	0%	Avira URL Cloud	safe
http://kgXKqA.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://2ldxNK2U0Dyorw0.org	Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://kgXKqA.com	Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	Inv 0110617985 PO Wartsila quantiparts B.V..exe, 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458946
Start date:	03.08.2021
Start time:	22:20:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Inv 0110617985 PO Wartsila quantiparts B.V..exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 41 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:22:29	API Interceptor	585x Sleep call for process: Inv 0110617985 PO Wartsila quantiparts B.V..exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inv 0110617985 PO Wartsila quantiparts B.V..exe.log Download File
Process:	C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.565991695094325
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Inv 0110617985 PO Wartsila quantiparts B.V..exe
File size:	1315328
MD5:	5c9c7f90ae087c40601f5d6bd85cadb7
SHA1:	15a76b5c5d5ee677f33b76a8371054821c6f6522
SHA256:	2e4901e09f9e7e72b65f301113d5bb075576e02fee03eb8414a986a1cca63cbb
SHA512:	79b82f4867e04356cd8717dee05b993814832d01ebf4f02ec6ec6227e9517a8cdfb960d7a1001f933c37b545fc2e03cb60210ecfc04aed5e19f60e2c3c35395d
SSDEEP:	24576:1sXS/d3NKzksHks2y8jf4HVy9YvHHaWTojUyIbD8N6ZNuZ:bKaw1QWTZbIN6ZNu
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I.a..............P..............%... ...@....@.. ....................................@................................

File Icon


Icon Hash:	d8b4e6c6d8d8f2dc

Static PE Info

General
Entrypoint:	0x5125ba
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61024914 [Thu Jul 29 06:22:12 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x112568	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x114000	0x307a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x146000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1105c0	0x110600	False	0.868828698658	data	7.71885600168	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x114000	0x307a8	0x30800	False	0.404905968106	data	5.84479226844	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x146000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x114200	0x8757	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x11c968	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0x12d1a0	0x94a8	data
RT_ICON	0x136658	0x5488	data
RT_ICON	0x13baf0	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 33023, next used block 4278255616
RT_ICON	0x13fd28	0x25a8	data
RT_ICON	0x1422e0	0x10a8	data
RT_ICON	0x143398	0x988	data
RT_ICON	0x143d30	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1441a8	0x84	data
RT_VERSION	0x14423c	0x36c	data
RT_MANIFEST	0x1445b8	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Profitpros (C)
Assembly Version	2.0.5.0
InternalName	ITypeLibImporterNotifySi.exe
FileVersion	2.0.5.0
CompanyName	Profitpros
LegalTrademarks
Comments
ProductName	form1dan2
ProductVersion	2.0.5.0
FileDescription	form1dan2
OriginalFilename	ITypeLibImporterNotifySi.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 1236 Parent PID: 5544

General

Start time:	22:22:09
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe'
Imagebase:	0xd00000
File size:	1315328 bytes
MD5 hash:	5C9C7F90AE087C40601F5D6BD85CADB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 4472 Parent PID: 1236

General

Start time:	22:22:29
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Inv 0110617985 PO Wartsila quantiparts B.V..exe
Imagebase:	0xe20000
File size:	1315328 bytes
MD5 hash:	5C9C7F90AE087C40601F5D6BD85CADB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000006.00000002.483047618.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.485981746.0000000003211000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 4472 Parent PID: 1236 Inv 0110617985 PO Wartsila quantiparts B.V..exeCOMMON

Executed Functions

Function 015709C8, Relevance: 5.3, Strings: 4, Instructions: 333COMMON

Download Yara Rule

Strings

u, xrefs: 01570E80
()l, xrefs: 01570F42
\l, xrefs: 01570AC9
\l, xrefs: 01570AD3

Memory Dump Source

Source File: 00000006.00000002.484928142.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID:
String ID: ()l$\l$\l$u
API String ID: 0-1185262005
Opcode ID: 3b01ef7074fb61541226a51800610d4363762415dc385252e073ffb51aa7901e
Instruction ID: 5dc31be97e435fe81db20f59306722befffc891032d50a68557af2a05e4a483c
Opcode Fuzzy Hash: 3b01ef7074fb61541226a51800610d4363762415dc385252e073ffb51aa7901e
Instruction Fuzzy Hash: 0AC1A734B08315CFDF285F69D4162BEBAF6BF85710F198929E486AA6C4CF34C841CB61

Uniqueness

Uniqueness Score: -1.00%

Function 013755A0, Relevance: 3.7, Instructions: 3690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f6ca3d96c7b47b1d2c7b2895d71c8e4b4344939ac7892647c30561d722f655
Instruction ID: 5123927b1626766027c2844147e3a1a36ec9d2649268a6e55a8eaa1753f9af84
Opcode Fuzzy Hash: 73f6ca3d96c7b47b1d2c7b2895d71c8e4b4344939ac7892647c30561d722f655
Instruction Fuzzy Hash: 91735D30D1071A8FCB21DF68C884699F7B1FF95314F15C6AAD558AB221EB34AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 017B8B18, Relevance: 3.2, Strings: 2, Instructions: 650COMMON

Download Yara Rule

Strings

\l, xrefs: 017B8EA4
jjj, xrefs: 017B8D96

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID:
String ID: \l$jjj
API String ID: 0-511811178
Opcode ID: 7327f56bb088751a4939473f7deaceace48cd1d12f091614e126d8b31675f8ec
Instruction ID: e42d59f22d343de26ce2af2244d020e8047149f5a523b6b7448a5ae643b439d8
Opcode Fuzzy Hash: 7327f56bb088751a4939473f7deaceace48cd1d12f091614e126d8b31675f8ec
Instruction Fuzzy Hash: 5022E271F002099FEB249B6CC4D5BEEBAA7AB85314F148069E315EF385CB75DC818792

Uniqueness

Uniqueness Score: -1.00%

Function 01370EA8, Relevance: 3.1, APIs: 1, Instructions: 1646COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01efc72bdd1569297c01e5a88c0ddb1a4f2581a080abbe4980681f126914dfd
Instruction ID: d648a9deda0220a47d91204dece7bf54a519d73ccf808e581c2eeee9cd743df0
Opcode Fuzzy Hash: e01efc72bdd1569297c01e5a88c0ddb1a4f2581a080abbe4980681f126914dfd
Instruction Fuzzy Hash: 38D2F231B043448FCB25EBB8D85866EBBF2AF8A314F1584A9D405DB396EF389C45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 017B1F88, Relevance: 2.8, APIs: 1, Instructions: 1289libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 017B2DE0

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e52c651a5f8d8134c7cc9bc9cdd6890685b0a8633970b39e22a0c6946950fb78
Instruction ID: 588ed4da80962688aba06feb147209b8db851376acc697caedaeae65f4922702
Opcode Fuzzy Hash: e52c651a5f8d8134c7cc9bc9cdd6890685b0a8633970b39e22a0c6946950fb78
Instruction Fuzzy Hash: 73B25B31E002198FDB24EF78C89479DB7F6AF89304F1485A9D50AAB355EF30AD85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01374A78, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01374AB9

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ade3033e3c215bb54442ae7533fed35bea8e2efecabec0d2e01264dc69b5bb84
Instruction ID: 46a2e8d11e624418150c3c1ceed1877fdbf027ce41cbbc5ce9de252321becfb4
Opcode Fuzzy Hash: ade3033e3c215bb54442ae7533fed35bea8e2efecabec0d2e01264dc69b5bb84
Instruction Fuzzy Hash: D4613174A00209DFDF24DFB4D4597AEBBF6AF48309F108428E502A7794DF78A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01373378, Relevance: .9, Instructions: 862COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999b1e6df86c41e835806e354bf5436b36b80be3343f7534a462d215f639d082
Instruction ID: 124850433cf6127715b1a20689f8946d766887ce5a0c384147cbae4690a32882
Opcode Fuzzy Hash: 999b1e6df86c41e835806e354bf5436b36b80be3343f7534a462d215f639d082
Instruction Fuzzy Hash: E3626B34B002188FDB24EBB8C4547ADBBF6BF89218F1084A9D50ADB795DF389D45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017B538C, Relevance: .7, Instructions: 689COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449cbea79eeb8127dde60004e4ea130e20cfdd92bf3a1800eacce1a2394b3caf
Instruction ID: 119925a6a552be4996af0d5c513c23aceb52183f0b628fc967ec706a8f8ad210
Opcode Fuzzy Hash: 449cbea79eeb8127dde60004e4ea130e20cfdd92bf3a1800eacce1a2394b3caf
Instruction Fuzzy Hash: D242B030E042488FEB24DBB8C4947ADBBB6AF85304F24C16ED519AF296CB75DC45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0137B468, Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a0f35de0df8dabc6cac37e268af0367df3d10ffe5f19a3b5005fa0db6fff6f
Instruction ID: e4908191bfbc1cb930acf62415de44ff53c96d105acc583f8ce9899298c8bb77
Opcode Fuzzy Hash: 11a0f35de0df8dabc6cac37e268af0367df3d10ffe5f19a3b5005fa0db6fff6f
Instruction Fuzzy Hash: 9C32E530B002158FDB24DBB8C850BAEBBF6AF88314F258569D506EB385DF39DD018B91

Uniqueness

Uniqueness Score: -1.00%

Function 017B8649, Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fcaad8e526d1aebdb520472187965fc256d65938fb0af2b48b6dd878aa15d09
Instruction ID: a1963cb36c6a2977c22d8d06db68115226325199bf0eeded24b79b775d2763a4
Opcode Fuzzy Hash: 6fcaad8e526d1aebdb520472187965fc256d65938fb0af2b48b6dd878aa15d09
Instruction Fuzzy Hash: 3CE1F331B043458FDB21CBB8C8C47AAFBBAEF86314F14896AD145CB266D734E945C792

Uniqueness

Uniqueness Score: -1.00%

Function 017BD160, Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170512e39c1fc5886fdaa3ac2f3ab3bec03e3baeb2e66fdcd0b2c65d42c64e81
Instruction ID: 395bd9100a0440a7efcc3b8882bffa411a2e2a17bb5c82a807c5cb3b43d8e906
Opcode Fuzzy Hash: 170512e39c1fc5886fdaa3ac2f3ab3bec03e3baeb2e66fdcd0b2c65d42c64e81
Instruction Fuzzy Hash: 62F16070B002199FCB24DFB8C88479DBBB2AF89318F258569D519EB395DB35EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0137B864, Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a5b65a48f2e18cf68245a42e563138d33cb8c975b71bff4bdf807185813a67
Instruction ID: ac3f26eba0c462983c3e6c31d0ed42f7fb94aefdafd06ffc794ce006d1640cf1
Opcode Fuzzy Hash: 15a5b65a48f2e18cf68245a42e563138d33cb8c975b71bff4bdf807185813a67
Instruction Fuzzy Hash: 83E1B030B002459FDB24DBA9C854BAEBBFAAF89204F15C069E505EB299DF39DC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 031D47A0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5791de77ed65e5cb900c9323b6cfcb1eb154f30f5a855180d49ffb89055d70
Instruction ID: b05072e5642abf20523d32642ea2b7b6fc27b13b4ad272e206df30f4d9aeee7d
Opcode Fuzzy Hash: ee5791de77ed65e5cb900c9323b6cfcb1eb154f30f5a855180d49ffb89055d70
Instruction Fuzzy Hash: 0C12C3B14297468BD710CF65E84B5893FA1F79533AB50C208F2E11BAE1DFB9118AEF44

Uniqueness

Uniqueness Score: -1.00%

Function 031D4710, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baaaab240ce60516f4e537cb938fc76ff519638e4f8fbcf5a2fbe60e906906bf
Instruction ID: 1308802e9df071daa5a7be2c42ec0704f2d951b21aa5724326cdeb10aa163a55
Opcode Fuzzy Hash: baaaab240ce60516f4e537cb938fc76ff519638e4f8fbcf5a2fbe60e906906bf
Instruction Fuzzy Hash: 79D16CB18293458BD710CF25E84B5893FB1FB96336F158208E1E15BAE1DFB9108AEF44

Uniqueness

Uniqueness Score: -1.00%

Function 031D46D0, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd142a394c46be7c50e9db07c7df85d05d704ef329a286cfb8d0a3558ec649b
Instruction ID: 65a06a5addce0fb449cb92ca0d376d2246160149a7eb76f2ed4783236adc0b85
Opcode Fuzzy Hash: acd142a394c46be7c50e9db07c7df85d05d704ef329a286cfb8d0a3558ec649b
Instruction Fuzzy Hash: C7C119B18297458BD710CF25E84B5897FB1FB95336F10C218E1A16BAD1DFB9108AEF44

Uniqueness

Uniqueness Score: -1.00%

Function 031D3CCC, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8414a11a9759910de7fb0024b295c0010fb532db880751c1a894feb358bffc3
Instruction ID: 886d43ae4c6ccefb2fb52955b8a75defabd57655b311613336f292208edc7c80
Opcode Fuzzy Hash: a8414a11a9759910de7fb0024b295c0010fb532db880751c1a894feb358bffc3
Instruction Fuzzy Hash: 2E91A135E00319CFCB04DFA4D8449DDBBBAFF8A314F648619E416AB760DB30A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 031D46B0, Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a3caec428480756f9f35c64b3646726715be605ed32133f5b591fae379256e
Instruction ID: 525e29583435e63add7e18eff265a1e06ecd1c7ae56e0e101fa83434a363bed5
Opcode Fuzzy Hash: 25a3caec428480756f9f35c64b3646726715be605ed32133f5b591fae379256e
Instruction Fuzzy Hash: 84C11AB18297458BD710CF25E84B5897FB1FB9533AB10C218F1A12BAD1DFB9108AEF44

Uniqueness

Uniqueness Score: -1.00%

Function 031D5471, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961475afed81e06fe949ef73991b40bfc5c152463c89fcfdae65ee35381dbc4d
Instruction ID: 09bdc0538fcffc017771212279b030e296242aa785680b6f208febd95246a12c
Opcode Fuzzy Hash: 961475afed81e06fe949ef73991b40bfc5c152463c89fcfdae65ee35381dbc4d
Instruction Fuzzy Hash: 7481B135E103198FCB04DFA4D8449DDBBBAFF8B314F248659E416AF6A0EB30A945DB50

Uniqueness

Uniqueness Score: -1.00%

Function 031D6B1F, Relevance: 6.1, APIs: 4, Instructions: 139threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 031D6BB0
GetCurrentThread.KERNEL32 ref: 031D6BED
GetCurrentProcess.KERNEL32 ref: 031D6C2A
GetCurrentThreadId.KERNEL32 ref: 031D6C83

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 54ddb99120d4089ff4628a3be8be53a23722fdb6704c2767563aa31ba4dd1a77
Instruction ID: 69be87a4714d261ffbb00b7a67949bd0c0a1256cea1405bc5d6b2ec5c17b265d
Opcode Fuzzy Hash: 54ddb99120d4089ff4628a3be8be53a23722fdb6704c2767563aa31ba4dd1a77
Instruction Fuzzy Hash: 055166B09047488FDB14CFA9C648BDEBFF1EF49314F24849AE409A7361DB756944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 031D6B50, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 031D6BB0
GetCurrentThread.KERNEL32 ref: 031D6BED
GetCurrentProcess.KERNEL32 ref: 031D6C2A
GetCurrentThreadId.KERNEL32 ref: 031D6C83

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 56d244c730675f8ba683cc0338a2978359a09322e5bbfbb80a8431cb55f3b69e
Instruction ID: 6bda96eb4c13d0ca9a0580d2ce809faf2b93cc89de998fcf183dc680298dad2c
Opcode Fuzzy Hash: 56d244c730675f8ba683cc0338a2978359a09322e5bbfbb80a8431cb55f3b69e
Instruction Fuzzy Hash: D25143B0A007488FDB14CFA9D648B9EBBF1EF49314F248459E419B7360DB75A984CF61

Uniqueness

Uniqueness Score: -1.00%

Function 031D510F, Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8280f92b803e615bb5035539c779db9773408b329e24e9b90d426fcf73afe001
Instruction ID: 281cd53782c6d9d69922994f535a2bacd14d420c2a048d1a2cadfb88280b21c0
Opcode Fuzzy Hash: 8280f92b803e615bb5035539c779db9773408b329e24e9b90d426fcf73afe001
Instruction Fuzzy Hash: 2D610271C04249AFCF15CFA9C984ADEBFB6BF4A314F29815AE818AB221D7719845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01372280, Relevance: 1.6, APIs: 1, Instructions: 138libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013722E0

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b7bcf70b384df7d5ac1f2150ebb86d013a148947884d724c5d8c86c41b1b71e0
Instruction ID: e20e069e51e4f4094d55f844dee60be81056fb525cdfbdd8344acd6099366710
Opcode Fuzzy Hash: b7bcf70b384df7d5ac1f2150ebb86d013a148947884d724c5d8c86c41b1b71e0
Instruction Fuzzy Hash: 8A419171A002059FCB14EFB4D844AEEB7B5FF88204F548969E502AB395EF34E9058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 015705D8, Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.484928142.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1b02b40d2a5ef09575ecb1baf54540b49cf828e7e53186a6ef7e4a74e1d28e
Instruction ID: 4e21afd927e95cfac653775cc0877a1ada311c8daa3a501f74da372bc9b74951
Opcode Fuzzy Hash: ca1b02b40d2a5ef09575ecb1baf54540b49cf828e7e53186a6ef7e4a74e1d28e
Instruction Fuzzy Hash: A4410171E043498FCB04CFB9D8446EEFBF9EF89210F1585AAD504A7241DB789845CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 017B41C0, Relevance: 1.6, APIs: 1, Instructions: 119registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 017B42D4

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ff658d5ed1d630b325d059e88064cf87e408847bc04c794ba11fb8962a3a377
Instruction ID: 42f361edfd2adbb9cae385b42510be1d8eefee0e1912e3290c16644ef5daa8e5
Opcode Fuzzy Hash: 8ff658d5ed1d630b325d059e88064cf87e408847bc04c794ba11fb8962a3a377
Instruction Fuzzy Hash: 60413670A053898FDB14CFA9C584BCEFFF1AF49304F2981AAD40AAB252D7749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 031D5184, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 031D52A2

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6c7485eede5ab30ea60b7c6a398c377d1d9640325608610becdadddc8b4c405a
Instruction ID: 231845bf83b9dbb2695e2d24a1293afdd80d872a6234f3dab48f0669713ae387
Opcode Fuzzy Hash: 6c7485eede5ab30ea60b7c6a398c377d1d9640325608610becdadddc8b4c405a
Instruction Fuzzy Hash: 9251D2B1D10308DFDB14CF99D984ADEBBB6BF49314F24822AE819AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 031D5190, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 031D52A2

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e11c6e597d9277bfc40a1ec24aadd6f57a047d9104a44705ad448e8026597773
Instruction ID: a0453fa7c4d4816c0ed85414b91b9def630a4d78d353d6c21ed6d551e1b5d890
Opcode Fuzzy Hash: e11c6e597d9277bfc40a1ec24aadd6f57a047d9104a44705ad448e8026597773
Instruction Fuzzy Hash: EB41C1B1D00309DFDB14CF99C984ADEFBB6BF49314F64812AE819AB210DB749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 031D6964, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 031D7D01

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 172fed743488c004a67d977526a15dc0c5b33ca83cda749c2b8a1d435289644b
Instruction ID: 870e73bd8308a1e214ce191380e2b69a0163740161e4cdbd1af8ef0d80709100
Opcode Fuzzy Hash: 172fed743488c004a67d977526a15dc0c5b33ca83cda749c2b8a1d435289644b
Instruction Fuzzy Hash: 86413AB5A007058FCB14CF59C588AAABBF5FF8D324F258499E419AB361D734A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 017B447C, Relevance: 1.6, APIs: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 017B4541

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 889a6214877d7ce83e73d65c75917a842ddea2bd334c44bb51864d290d164945
Instruction ID: 00e55913c0c5e086a03e372fd53ecfc1a6fe98bf795c087472840b9b0cf539cc
Opcode Fuzzy Hash: 889a6214877d7ce83e73d65c75917a842ddea2bd334c44bb51864d290d164945
Instruction Fuzzy Hash: ED41E0B1D002589FCB14CF99D984ADEFBF5AF48310F24846AE81ABB210D7749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 017B4488, Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 017B4541

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 77d27c0afd892bfe863ed16e7b040a7b940ab4ee079e828b0d6aec2a60291fa2
Instruction ID: 4c98773bce11ffb534acff164e8254291437835c1a63f48b4445d5a578169bdd
Opcode Fuzzy Hash: 77d27c0afd892bfe863ed16e7b040a7b940ab4ee079e828b0d6aec2a60291fa2
Instruction Fuzzy Hash: 6531C0B1D006589BCB14CF99D984ACEFBF5AF48310F65806AE81ABB310DB749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 017B4220, Relevance: 1.6, APIs: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 017B42D4

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0edec705213de06d19b47069048092328806dc78fd90ab6a98f03e79c4623c90
Instruction ID: 40eef3efa2a3b7ad6365965ffef918081e5e3cb8b36bacc71dbefd87326f4f7e
Opcode Fuzzy Hash: 0edec705213de06d19b47069048092328806dc78fd90ab6a98f03e79c4623c90
Instruction Fuzzy Hash: AE31F1B0D052498FDB14CF99C684ACEFBF5BB48304F29816AE40AAB301C7759985CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01374A27, Relevance: 1.6, APIs: 1, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01374AB9

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: be7cec5c5599439cb101200cc65aaba8be7365681992c26c056995cef34e3aa7
Instruction ID: 4cc9357b17b539d30d3b1666b9507c4c9d5306993095eeaef10551a88e8f17c9
Opcode Fuzzy Hash: be7cec5c5599439cb101200cc65aaba8be7365681992c26c056995cef34e3aa7
Instruction Fuzzy Hash: 4F317C30A00209DFDB25DFA8D858BADBBF2FF89318F148469D401AB395CB39A845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 031D6D71, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 031D6DFF

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1d1071ed792c3ef388a693036e0248bb012a2a3e6ce8817cb2c127685bc2bef7
Instruction ID: 45ff35d8ec7f8d50452440946179eda7092d9472228dac723923ac0f537b92e4
Opcode Fuzzy Hash: 1d1071ed792c3ef388a693036e0248bb012a2a3e6ce8817cb2c127685bc2bef7
Instruction Fuzzy Hash: 0B21E3B59002489FDB10CFA9D984ADEBBF8EB48324F54855AE914B3310D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031D6D78, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 031D6DFF

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 783c4816106bb2d777a3a46d51ff932344eca95fdb1cec2c77cce2bdd1cad727
Instruction ID: d308f9d6a7633a2df31f64ff05ae9b7abf2f88ef2f4bc1bbffe379658827b091
Opcode Fuzzy Hash: 783c4816106bb2d777a3a46d51ff932344eca95fdb1cec2c77cce2bdd1cad727
Instruction Fuzzy Hash: 4121C2B59002489FDB10CFA9D984ADEFBF8EB48324F54845AE918B7310D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015706AC, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 01570717

Memory Dump Source

Source File: 00000006.00000002.484928142.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b3e6476124d85d14ef657c45b8265464bddc87c7a4cbb713ad9db4de2de5f3dc
Instruction ID: bbd1dd6fcc170ef2a311b388d3279eee1bf4ab37e4d591783856c9b06a8a9cf9
Opcode Fuzzy Hash: b3e6476124d85d14ef657c45b8265464bddc87c7a4cbb713ad9db4de2de5f3dc
Instruction Fuzzy Hash: B911F2B1C006199BCB10CFAAD545BDEFBF4AB48224F15856AD418B7240D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031DBE08, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 031DBE82

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 4cfbe985fe0cba6c14a93492cc594fe5b3115be4fc7dbd80c4526e6cdb24186f
Instruction ID: 9371e5ad0775bd0bdc767ef1b1b864c0a5275240cef039ed0a0b64b87eb70809
Opcode Fuzzy Hash: 4cfbe985fe0cba6c14a93492cc594fe5b3115be4fc7dbd80c4526e6cdb24186f
Instruction Fuzzy Hash: F2119AB1904708CFDB10DFA9C54879EBBF8EB49714F248429D50AB7701DB796944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017B4361, Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE ref: 017B43BD

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: da953fa1c335572205e9966e86be2a4d6f90c99eb954fd38afaf6f31f48537fd
Instruction ID: 98de3a92f2f1a884d119009da142807079b4213b5957f89606b690f602e52c07
Opcode Fuzzy Hash: da953fa1c335572205e9966e86be2a4d6f90c99eb954fd38afaf6f31f48537fd
Instruction Fuzzy Hash: EB11F2B19003488FCB10DFA9D588BDEBBF4EB49324F248459D519B7600D779A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017B4368, Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE ref: 017B43BD

Memory Dump Source

Source File: 00000006.00000002.485403333.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 22e65941901c883a1ad3c27cfb8f1af419196db15ae6acc88d572582f139b6cc
Instruction ID: dd2130e99e0e621118fa03f9d4863b37cfe8825f00587b42bfcebf1072927c8d
Opcode Fuzzy Hash: 22e65941901c883a1ad3c27cfb8f1af419196db15ae6acc88d572582f139b6cc
Instruction Fuzzy Hash: EA1100B19003488FCB10CF9AD588BCEFBF4AB48324F248459D519B3600C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0181D53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485510094.000000000181D000.00000040.00000001.sdmp, Offset: 0181D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961073d17f54842cac0aabfbbcf919335d0a16e5580cbf23d891ddb6f25893be
Instruction ID: 8c72483af8a0f793d6f27743dbf2d64dbe29737db3da78cd8b79ba02e79e61e5
Opcode Fuzzy Hash: 961073d17f54842cac0aabfbbcf919335d0a16e5580cbf23d891ddb6f25893be
Instruction Fuzzy Hash: 59216AB3504244DFCB01DF94D9C4F66BF69FB84328F248668E8058B24AC336DA56CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0182D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485536945.000000000182D000.00000040.00000001.sdmp, Offset: 0182D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87e6ab2a779ba50395621413fdb6205d553cbbdf4d393d4498e5b0656f411b9
Instruction ID: 838d78184f0413007dd122f6236a00a638ef48817823275683798c85004ac5eb
Opcode Fuzzy Hash: d87e6ab2a779ba50395621413fdb6205d553cbbdf4d393d4498e5b0656f411b9
Instruction Fuzzy Hash: 7D213771504244DFCB12CFA4D9C0B16BF65FB84358F24C6ADD9098B356C73AD987CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0181D537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485510094.000000000181D000.00000040.00000001.sdmp, Offset: 0181D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9cd8aacd33506535d2ad590ff13daa1a79972ad8fbb3afe5d1e395e3249391
Instruction ID: ed84cb477b22c8b188279de1208b7c3542d2c33affd4026b783b09a26b5f1ff1
Opcode Fuzzy Hash: 9e9cd8aacd33506535d2ad590ff13daa1a79972ad8fbb3afe5d1e395e3249391
Instruction Fuzzy Hash: 4911D376404280CFCB12CF54D5C4B56BF72FB84324F28C6A9D8098B65AC33AD55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0182D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485536945.000000000182D000.00000040.00000001.sdmp, Offset: 0182D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf207d9f1e19865214e696f6889b3b8552dca42710745fc8c607f25a3992a05
Instruction ID: 3d710ba023ce171c9e38dd4c9ed11bcf10b0ac1d734dc7bb365d8dea36640984
Opcode Fuzzy Hash: 6bf207d9f1e19865214e696f6889b3b8552dca42710745fc8c607f25a3992a05
Instruction Fuzzy Hash: 8711BB75504280CFCB12CF54D5C4B15BFA1FB84324F28C6AAD8498B666C33AD58ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0137C7F8, Relevance: 3.0, Strings: 1, Instructions: 1780COMMON

Download Yara Rule

Strings

D!l, xrefs: 0137C9A3

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID:
String ID: D!l
API String ID: 0-2363226792
Opcode ID: 2f386240204acf53eb138ba8ff859e2ca67f58c32d5c32e28a64b03b121ff59c
Instruction ID: 87427901a58b09351409628f0f1f84c168cd381f2e20da05967a193287bfda4d
Opcode Fuzzy Hash: 2f386240204acf53eb138ba8ff859e2ca67f58c32d5c32e28a64b03b121ff59c
Instruction Fuzzy Hash: DD033D70D10619CECB24EF68C884AADF7B1BF99314F15C6DAD559A7221EB30AAC4CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01372E38, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.483945628.0000000001370000.00000040.00000001.sdmp, Offset: 01370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7a05c440e1fbc4f1317c11b8658e72b97d82cfa57b26c4539fc9c13344f8d7
Instruction ID: 28c2d4efa0ded5c546e0a71f068329b419152d3ef32d2dbc855ca2430dd0af0c
Opcode Fuzzy Hash: 5b7a05c440e1fbc4f1317c11b8658e72b97d82cfa57b26c4539fc9c13344f8d7
Instruction Fuzzy Hash: 5491D631B003045FDB24EFB998557AE76FAAF88714F148428E506EB794DF39DD018B91

Uniqueness

Uniqueness Score: -1.00%

Function 031DD661, Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.485884415.00000000031D0000.00000040.00000001.sdmp, Offset: 031D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92029c81866dcf9d189571826baeff8559c42cc9465a9065d4fbbff8266c05b
Instruction ID: 6fa7c44ee482e1f0e3d00006439c96be0be97befac28d58f3fe83a3a765f2f9e
Opcode Fuzzy Hash: d92029c81866dcf9d189571826baeff8559c42cc9465a9065d4fbbff8266c05b
Instruction Fuzzy Hash: E591D874F042149BCB1CEB75A45527EBAB7AFCD614B1A882DE407E7788DF358C018BA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Inv 0110617985 PO Wartsila quantiparts B.V..exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: Inv 0110617985 PO Wartsila quantiparts B.V..exe PID: 1236 Parent PID: 5544