Loading ...

Play interactive tourEdit tour

Windows Analysis Report Price enquiry for test machine.exe

Overview

General Information

Sample Name:Price enquiry for test machine.exe
Analysis ID:502599
MD5:c7564ca82a81b09c5d401918fda024c2
SHA1:ef07d5e0c6f49aa75a63108ec655860da6591a6a
SHA256:f9db35de0ae4c59df7d3ef7525cc111b55e9304cf8d61714d69378aa201acd7f
Tags:agentteslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Detected unpacking (overwrites its own PE header)
Yara detected AgentTesla
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to call native functions
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "osy@seredebe.com", "Password": "@4u$1Ldri{uQ", "Host": "smtp.seredebe.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000001.00000002.544787506.0000000000400000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 14 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.Price enquiry for test machine.exe.7a77e8.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.Price enquiry for test machine.exe.7a77e8.2.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                1.2.Price enquiry for test machine.exe.4980000.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  1.2.Price enquiry for test machine.exe.4980000.4.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    0.2.Price enquiry for test machine.exe.2371458.3.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 27 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "osy@seredebe.com", "Password": "@4u$1Ldri{uQ", "Host": "smtp.seredebe.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Price enquiry for test machine.exeVirustotal: Detection: 25%Perma Link
                      Source: Price enquiry for test machine.exeReversingLabs: Detection: 24%
                      Machine Learning detection for sampleShow sources
                      Source: Price enquiry for test machine.exeJoe Sandbox ML: detected
                      Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.2.Price enquiry for test machine.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.1.Price enquiry for test machine.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

                      Compliance:

                      barindex
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeUnpacked PE file: 1.2.Price enquiry for test machine.exe.400000.1.unpack
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeUnpacked PE file: 1.2.Price enquiry for test machine.exe.4980000.4.unpack
                      Source: Price enquiry for test machine.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
                      Source: Binary string: wntdll.pdbUGP source: Price enquiry for test machine.exe, 00000000.00000003.287527899.000000000F380000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Price enquiry for test machine.exe, 00000000.00000003.287527899.000000000F380000.00000004.00000001.sdmp
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_00405E93 FindFirstFileA,FindClose,0_2_00405E93
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,0_2_004054BD
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_00402671 FindFirstFileA,0_2_00402671
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00404A29 FindFirstFileExW,1_2_00404A29
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_1_00404A29 FindFirstFileExW,1_1_00404A29
                      Source: Joe Sandbox ViewIP Address: 208.91.198.143 208.91.198.143
                      Source: Joe Sandbox ViewIP Address: 208.91.199.223 208.91.199.223
                      Source: global trafficTCP traffic: 192.168.2.3:49834 -> 208.91.198.143:587
                      Source: global trafficTCP traffic: 192.168.2.3:49838 -> 208.91.199.223:587
                      Source: global trafficTCP traffic: 192.168.2.3:49834 -> 208.91.198.143:587
                      Source: global trafficTCP traffic: 192.168.2.3:49838 -> 208.91.199.223:587
                      Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmpString found in binary or memory: http://fFlwaf.com
                      Source: Price enquiry for test machine.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
                      Source: Price enquiry for test machine.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                      Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmpString found in binary or memory: https://8CVKb4wLGkADrnEe6T.org
                      Source: Price enquiry for test machine.exeString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Price enquiry for test machine.exe, 00000001.00000002.545933351.0000000002841000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: unknownDNS traffic detected: queries for: smtp.seredebe.com
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C0B982 recv,1_2_00C0B982
                      Source: Price enquiry for test machine.exe, 00000000.00000002.288113341.00000000006CA000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00404FC2

                      System Summary:

                      barindex
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Price enquiry for test machine.exe
                      .NET source code contains very large array initializationsShow sources
                      Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack, u003cPrivateImplementationDetailsu003eu007bB0AD7952u002d9BA5u002d4C1Au002d8F12u002dF5F6821AA348u007d/CB52A583u002d7065u002d495Fu002d9FFBu002dDDFBDAC53907.csLarge array initialization: .cctor: array initializer size 11930
                      Source: Price enquiry for test machine.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,0_2_004030FB
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_004047D30_2_004047D3
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_004061D40_2_004061D4
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_72E46A2B0_2_72E46A2B
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_72E46A3A0_2_72E46A3A
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_0040A2A51_2_0040A2A5
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_049DA0181_2_049DA018
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_049DF1101_2_049DF110
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_049D7D001_2_049D7D00
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_054470271_2_05447027
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_054409A01_2_054409A0
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_054429A81_2_054429A8
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_1_0040A2A51_1_0040A2A5
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: String function: 00401ED0 appears 46 times
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: String function: 0040569E appears 36 times
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C0B136 NtQuerySystemInformation,1_2_00C0B136
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C0B105 NtQuerySystemInformation,1_2_00C0B105
                      Source: Price enquiry for test machine.exe, 00000000.00000003.286324609.000000000F49F000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Price enquiry for test machine.exe
                      Source: Price enquiry for test machine.exe, 00000000.00000002.288215698.0000000002360000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameRsjyOsdLqvhuIzXOfDQRRmNhPfWtmUIrRAfWeL.exe4 vs Price enquiry for test machine.exe
                      Source: Price enquiry for test machine.exeBinary or memory string: OriginalFilename vs Price enquiry for test machine.exe
                      Source: Price enquiry for test machine.exe, 00000001.00000002.544995726.0000000000768000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameRsjyOsdLqvhuIzXOfDQRRmNhPfWtmUIrRAfWeL.exe4 vs Price enquiry for test machine.exe
                      Source: Price enquiry for test machine.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: Price enquiry for test machine.exeVirustotal: Detection: 25%
                      Source: Price enquiry for test machine.exeReversingLabs: Detection: 24%
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile read: C:\Users\user\Desktop\Price enquiry for test machine.exeJump to behavior
                      Source: Price enquiry for test machine.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Price enquiry for test machine.exe 'C:\Users\user\Desktop\Price enquiry for test machine.exe'
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess created: C:\Users\user\Desktop\Price enquiry for test machine.exe 'C:\Users\user\Desktop\Price enquiry for test machine.exe'
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess created: C:\Users\user\Desktop\Price enquiry for test machine.exe 'C:\Users\user\Desktop\Price enquiry for test machine.exe' Jump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C0AFBA AdjustTokenPrivileges,1_2_00C0AFBA
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C0AF83 AdjustTokenPrivileges,1_2_00C0AF83
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile created: C:\Users\user\AppData\Roaming\ff3jhzsj.yhhJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile created: C:\Users\user\AppData\Local\Temp\nslB4A9.tmpJump to behavior
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/3@3/2
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_00402053 CoCreateInstance,MultiByteToWideChar,0_2_00402053
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_00404292
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,1_2_00401489
                      Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.2.Price enquiry for test machine.exe.4980000.4.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
                      Source: Binary string: wntdll.pdbUGP source: Price enquiry for test machine.exe, 00000000.00000003.287527899.000000000F380000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Price enquiry for test machine.exe, 00000000.00000003.287527899.000000000F380000.00000004.00000001.sdmp

                      Data Obfuscation:

                      barindex
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeUnpacked PE file: 1.2.Price enquiry for test machine.exe.400000.1.unpack
                      Detected unpacking (changes PE section rights)Show sources
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeUnpacked PE file: 1.2.Price enquiry for test machine.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeUnpacked PE file: 1.2.Price enquiry for test machine.exe.4980000.4.unpack
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 0_2_72E41080 push eax; ret 0_2_72E410AE
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00401F16 push ecx; ret 1_2_00401F29
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C0306D push edi; ret 1_2_00C0306E
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C03401 push eax; ret 1_2_00C0340E
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C025DD push eax; ret 1_2_00C025DE
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C02DA8 push edi; ret 1_2_00C02DB6
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C02570 push ecx; ret 1_2_00C02572
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C032DC push eax; ret 1_2_00C032DE
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C02685 push edi; ret 1_2_00C02686
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C03389 push eax; ret 1_2_00C0340E
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_2_00C02B20 push eax; ret 1_2_00C02B22
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeCode function: 1_1_00401F16 push ecx; ret 1_1_00401F29
                      Source: Price enquiry for test machine.exeStatic PE information: real checksum: 0x0 should be: 0x7a0a3
                      Source: hjoxggvy.dll.0.drStatic PE information: real checksum: 0x7bd8 should be: 0xaeed
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFile created: C:\Users\user\AppData\Local\Temp\nslB4AA.tmp\hjoxggvy.dllJump to dropped file
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Found evasive API chain (trying to detect sleep duration tampering with parallel thread)Show sources
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeFunction Chain: memAlloc,systemQueried,systemQueried,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,systemQueried,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadAPCQueued,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exe TID: 4848Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exe TID: 4848Thread sleep time: -14250000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exe TID: 4848Thread sleep time: -90000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Price enquiry for test machine.exeThread delayed: delay time: 922337203685477