Windows Analysis Report QUOTATION OF EQUIPMENT.exe

Overview

General Information

Sample Name: QUOTATION OF EQUIPMENT.exe
Analysis ID: 502687
MD5: 6f058c62ace41a97a12e6e7a47c9c76e
SHA1: 9c5e94ba757e2387a510bc10559136cb308ce535
SHA256: 713bcae8bce87e51a3b3f1448d816dce365302918c476d4bbe964b4834db3ccf
Tags: exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Detected unpacking (overwrites its own PE header)
Yara detected AgentTesla
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Uses FTP
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection:

barindex
Found malware configuration
Source: 1.2.QUOTATION OF EQUIPMENT.exe.415058.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "FTP Host": "ftp://ftp.omindexgroup.com/", "Username": "info@omindexgroup.com", "Password": "tlW}sP3mS7Z3"}
Machine Learning detection for sample
Source: QUOTATION OF EQUIPMENT.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.QUOTATION OF EQUIPMENT.exe.400000.1.unpack Avira: Label: TR/Spy.Gen8
Source: 1.2.QUOTATION OF EQUIPMENT.exe.4810000.5.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Unpacked PE file: 1.2.QUOTATION OF EQUIPMENT.exe.400000.1.unpack
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Unpacked PE file: 1.2.QUOTATION OF EQUIPMENT.exe.4810000.5.unpack
Uses 32bit PE files
Source: QUOTATION OF EQUIPMENT.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: wntdll.pdbUGP source: QUOTATION OF EQUIPMENT.exe, 00000000.00000003.306358828.000000000F0D0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: QUOTATION OF EQUIPMENT.exe, 00000000.00000003.306358828.000000000F0D0000.00000004.00000001.sdmp
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_00405E93 FindFirstFileA,FindClose, 0_2_00405E93
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_004054BD
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_00402671 FindFirstFileA, 0_2_00402671
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_00404A29 FindFirstFileExW, 1_2_00404A29

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2029927 ET TROJAN AgentTesla Exfil via FTP 192.168.2.3:49832 -> 192.119.9.178:21
Source: Traffic Snort IDS: 2029928 ET TROJAN AgentTesla HTML System Info Report Exfil via FTP 192.168.2.3:49833 -> 192.119.9.178:55115
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: 24SHELLSUS 24SHELLSUS
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 192.119.9.178 192.119.9.178
Uses FTP
Source: unknown FTP traffic detected: 192.119.9.178:21 -> 192.168.2.3:49832 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 08:49. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 08:49. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 08:49. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 08:49. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: ftp://ftp.omindexgroup.com/info
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: http://ftp.omindexgroup.com
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp, QUOTATION OF EQUIPMENT.exe, 00000001.00000003.514210140.00000000005C4000.00000004.00000001.sdmp String found in binary or memory: http://kMfms0NpHAa2q.org
Source: QUOTATION OF EQUIPMENT.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: QUOTATION OF EQUIPMENT.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: http://yJUdUS.com
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%$
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: QUOTATION OF EQUIPMENT.exe String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: ftp.omindexgroup.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404FC2

System Summary:

barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: QUOTATION OF EQUIPMENT.exe
.NET source code contains very large array initializations
Source: 1.2.QUOTATION OF EQUIPMENT.exe.4810000.5.unpack, u003cPrivateImplementationDetailsu003eu007bADDD92D2u002d841Au002d42EAu002dB77Cu002d1470A1722442u007d/u00347097661u002d7D05u002d4653u002d940Au002dC774450E8E39.cs Large array initialization: .cctor: array initializer size 11940
Uses 32bit PE files
Source: QUOTATION OF EQUIPMENT.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004030FB
Detected potential crypto function
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_004047D3 0_2_004047D3
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_004061D4 0_2_004061D4
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_72E46A24 0_2_72E46A24
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_72E46A33 0_2_72E46A33
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_0040A2A5 1_2_0040A2A5
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_021846A0 1_2_021846A0
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_021845B0 1_2_021845B0
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_0218D310 1_2_0218D310
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_05929790 1_2_05929790
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_059246F8 1_2_059246F8
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_05925310 1_2_05925310
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_0592E260 1_2_0592E260
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_05924A40 1_2_05924A40
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_05EB0EA0 1_2_05EB0EA0
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_1_0040A2A5 1_1_0040A2A5
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: String function: 00401ED0 appears 46 times
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: String function: 0040569E appears 36 times
Sample file is different than original file name gathered from version info
Source: QUOTATION OF EQUIPMENT.exe, 00000000.00000003.297338018.000000000F1E6000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION OF EQUIPMENT.exe
Source: QUOTATION OF EQUIPMENT.exe, 00000000.00000002.307528948.0000000002440000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameeoQopvcgKxToaqzqUBTWKQEmbNlozHuMTqggKL.exe4 vs QUOTATION OF EQUIPMENT.exe
Source: QUOTATION OF EQUIPMENT.exe Binary or memory string: OriginalFilename vs QUOTATION OF EQUIPMENT.exe
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.567930918.0000000003331000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameeoQopvcgKxToaqzqUBTWKQEmbNlozHuMTqggKL.exe4 vs QUOTATION OF EQUIPMENT.exe
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.565195545.0000000000199000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs QUOTATION OF EQUIPMENT.exe
PE file contains strange resources
Source: QUOTATION OF EQUIPMENT.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File read: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Jump to behavior
Source: QUOTATION OF EQUIPMENT.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe 'C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe'
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process created: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe 'C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe'
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process created: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe 'C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe' Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File created: C:\Users\user\AppData\Roaming\newapp Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File created: C:\Users\user\AppData\Local\Temp\nscC7D6.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/3@1/1
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_00402053 CoCreateInstance,MultiByteToWideChar, 0_2_00402053
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_00404292
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess, 1_2_00401489
Source: 1.2.QUOTATION OF EQUIPMENT.exe.4810000.5.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.QUOTATION OF EQUIPMENT.exe.4810000.5.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Binary string: wntdll.pdbUGP source: QUOTATION OF EQUIPMENT.exe, 00000000.00000003.306358828.000000000F0D0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: QUOTATION OF EQUIPMENT.exe, 00000000.00000003.306358828.000000000F0D0000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Unpacked PE file: 1.2.QUOTATION OF EQUIPMENT.exe.400000.1.unpack
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Unpacked PE file: 1.2.QUOTATION OF EQUIPMENT.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Unpacked PE file: 1.2.QUOTATION OF EQUIPMENT.exe.4810000.5.unpack
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_72E41080 push eax; ret 0_2_72E410AE
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_00401F16 push ecx; ret 1_2_00401F29
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_1_00401F16 push ecx; ret 1_1_00401F29
PE file contains an invalid checksum
Source: QUOTATION OF EQUIPMENT.exe Static PE information: real checksum: 0x0 should be: 0x6e839
Source: eluwnahujm.dll.0.dr Static PE information: real checksum: 0xca76 should be: 0x1039d

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File created: C:\Users\user\AppData\Local\Temp\nsxC806.tmp\eluwnahujm.dll Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run newapp Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run newapp Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe TID: 1304 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe TID: 3604 Thread sleep count: 756 > 30 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe TID: 3604 Thread sleep count: 9099 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Window / User API: threadDelayed 756 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Window / User API: threadDelayed 9099 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_00405E93 FindFirstFileA,FindClose, 0_2_00405E93
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_004054BD
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_00402671 FindFirstFileA, 0_2_00402671
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_00404A29 FindFirstFileExW, 1_2_00404A29
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566108651.000000000078B000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPow

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_0040446F
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_004067FE GetProcessHeap, 1_2_004067FE
Enables debug privileges
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_72E46402 mov eax, dword ptr fs:[00000030h] 0_2_72E46402
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_72E466C7 mov eax, dword ptr fs:[00000030h] 0_2_72E466C7
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_72E46744 mov eax, dword ptr fs:[00000030h] 0_2_72E46744
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_72E46706 mov eax, dword ptr fs:[00000030h] 0_2_72E46706
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_72E46616 mov eax, dword ptr fs:[00000030h] 0_2_72E46616
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_004035F1 mov eax, dword ptr fs:[00000030h] 1_2_004035F1
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_1_004035F1 mov eax, dword ptr fs:[00000030h] 1_1_004035F1
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_0218F640 LdrInitializeThunk, 1_2_0218F640
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Memory allocated: page read and write | page guard Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_00401E1D SetUnhandledExceptionFilter, 1_2_00401E1D
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_0040446F
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00401C88
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00401F30
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_1_00401E1D SetUnhandledExceptionFilter, 1_1_00401E1D

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Memory written: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Process created: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe 'C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe' Jump to behavior
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566499923.0000000000D30000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566499923.0000000000D30000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566499923.0000000000D30000.00000002.00020000.sdmp Binary or memory string: Progman
Source: QUOTATION OF EQUIPMENT.exe, 00000001.00000002.566499923.0000000000D30000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_0040208D cpuid 1_2_0040208D
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_00401B74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 1_2_00401B74
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004030FB
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Code function: 1_2_0592A9F8 GetUserNameW, 1_2_0592A9F8

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.3335530.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.QUOTATION OF EQUIPMENT.exe.2451458.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.QUOTATION OF EQUIPMENT.exe.2440000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.3335530.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.QUOTATION OF EQUIPMENT.exe.2440000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.4810000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.22e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.QUOTATION OF EQUIPMENT.exe.2451458.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.22e0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.7a9f68.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.7a9f68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.567930918.0000000003331000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.307528948.0000000002440000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.566777680.00000000022E0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.568210008.0000000004812000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.566108651.000000000078B000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.565262027.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: QUOTATION OF EQUIPMENT.exe PID: 6748, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QUOTATION OF EQUIPMENT.exe PID: 6716, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION OF EQUIPMENT.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: QUOTATION OF EQUIPMENT.exe PID: 6716, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.3335530.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.415058.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.QUOTATION OF EQUIPMENT.exe.2451458.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.QUOTATION OF EQUIPMENT.exe.2440000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.3335530.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.QUOTATION OF EQUIPMENT.exe.2440000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.4810000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.22e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.QUOTATION OF EQUIPMENT.exe.2451458.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.22e0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.7a9f68.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.415058.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.7a9f68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.QUOTATION OF EQUIPMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.567930918.0000000003331000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.307528948.0000000002440000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.566777680.00000000022E0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.568210008.0000000004812000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.566108651.000000000078B000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.565262027.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.566863487.0000000002331000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: QUOTATION OF EQUIPMENT.exe PID: 6748, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: QUOTATION OF EQUIPMENT.exe PID: 6716, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.119.9.178
 ftp.omindexgroup.com United States
55081 24SHELLSUS true

Contacted Domains

Name IP Active
ftp.omindexgroup.com 192.119.9.178 true