Loading ...

Play interactive tourEdit tour

Windows Analysis Report QT21136583_Order_Doc.exe

Overview

General Information

Sample Name:QT21136583_Order_Doc.exe
Analysis ID:502708
MD5:ac0f49a715ebc7eb6e51fb986425136e
SHA1:813346ea143739c3fede3cde1d612de75ab731bf
SHA256:ccc78c1d61ff6eb4b314c9ffbbd9f172984a6b3decb088b1398a96b382a3149e
Tags:agentteslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Detected unpacking (overwrites its own PE header)
Yara detected AgentTesla
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Injects a PE file into a foreign processes
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to call native functions
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • QT21136583_Order_Doc.exe (PID: 6740 cmdline: 'C:\Users\user\Desktop\QT21136583_Order_Doc.exe' MD5: AC0F49A715EBC7EB6E51FB986425136E)
    • QT21136583_Order_Doc.exe (PID: 6768 cmdline: 'C:\Users\user\Desktop\QT21136583_Order_Doc.exe' MD5: AC0F49A715EBC7EB6E51FB986425136E)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "accounts2@dsqtech.com", "Password": "Kolhapur123#", "Host": "mail.dsqtech.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.616077569.0000000000508000.00000004.00000020.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000001.00000002.616077569.0000000000508000.00000004.00000020.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000001.00000002.615598257.0000000000400000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000001.00000002.615598257.0000000000400000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000001.00000001.355689288.0000000000400000.00000040.00020000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 14 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.QT21136583_Order_Doc.exe.2851458.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.QT21136583_Order_Doc.exe.2851458.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                1.2.QT21136583_Order_Doc.exe.38b3258.5.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  1.2.QT21136583_Order_Doc.exe.38b3258.5.raw.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    0.2.QT21136583_Order_Doc.exe.2840000.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 33 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 1.2.QT21136583_Order_Doc.exe.543f60.2.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "accounts2@dsqtech.com", "Password": "Kolhapur123#", "Host": "mail.dsqtech.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: QT21136583_Order_Doc.exeReversingLabs: Detection: 17%
                      Machine Learning detection for sampleShow sources
                      Source: QT21136583_Order_Doc.exeJoe Sandbox ML: detected
                      Source: 1.2.QT21136583_Order_Doc.exe.2400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.2.QT21136583_Order_Doc.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.1.QT21136583_Order_Doc.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

                      Compliance:

                      barindex
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeUnpacked PE file: 1.2.QT21136583_Order_Doc.exe.400000.0.unpack
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeUnpacked PE file: 1.2.QT21136583_Order_Doc.exe.2400000.4.unpack
                      Source: QT21136583_Order_Doc.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
                      Source: Binary string: wntdll.pdbUGP source: QT21136583_Order_Doc.exe, 00000000.00000003.354146293.0000000002A20000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: QT21136583_Order_Doc.exe, 00000000.00000003.354146293.0000000002A20000.00000004.00000001.sdmp
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_00405E93 FindFirstFileA,FindClose,0_2_00405E93
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,0_2_004054BD
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_00402671 FindFirstFileA,0_2_00402671
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00404A29 FindFirstFileExW,1_2_00404A29
                      Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
                      Source: global trafficTCP traffic: 192.168.2.6:49754 -> 162.241.244.46:587
                      Source: global trafficTCP traffic: 192.168.2.6:49754 -> 162.241.244.46:587
                      Source: QT21136583_Order_Doc.exe, 00000001.00000002.618173385.00000000028B1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: QT21136583_Order_Doc.exe, 00000001.00000002.618173385.00000000028B1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: QT21136583_Order_Doc.exe, 00000001.00000002.618173385.00000000028B1000.00000004.00000001.sdmpString found in binary or memory: http://K5S3hn76lHBxHr.com
                      Source: QT21136583_Order_Doc.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
                      Source: QT21136583_Order_Doc.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                      Source: QT21136583_Order_Doc.exe, 00000001.00000002.618173385.00000000028B1000.00000004.00000001.sdmpString found in binary or memory: http://qNEWtD.com
                      Source: QT21136583_Order_Doc.exe, 00000001.00000002.618173385.00000000028B1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%(
                      Source: QT21136583_Order_Doc.exe, 00000001.00000002.618173385.00000000028B1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: QT21136583_Order_Doc.exeString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: QT21136583_Order_Doc.exe, 00000001.00000002.618173385.00000000028B1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: unknownDNS traffic detected: queries for: mail.dsqtech.com
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0220B982 recv,1_2_0220B982
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00404FC2

                      System Summary:

                      barindex
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: QT21136583_Order_Doc.exe
                      Source: initial sampleStatic PE information: Filename: QT21136583_Order_Doc.exe
                      Source: QT21136583_Order_Doc.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,0_2_004030FB
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_004047D30_2_004047D3
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_004061D40_2_004061D4
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_736F17E00_2_736F17E0
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_736F8A0F0_2_736F8A0F
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_736F8A1E0_2_736F8A1E
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0040A2A51_2_0040A2A5
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_008460A01_2_008460A0
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_008494F01_2_008494F0
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0084C4301_2_0084C430
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_008475301_2_00847530
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0084EA101_2_0084EA10
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0084F2201_2_0084F220
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0084C3D01_2_0084C3D0
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00A024E01_2_00A024E0
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00A079C01_2_00A079C0
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00A029381_2_00A02938
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00A00D1C1_2_00A00D1C
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00A073881_2_00A07388
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00A031701_2_00A03170
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0220B136 NtQuerySystemInformation,1_2_0220B136
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0220B105 NtQuerySystemInformation,1_2_0220B105
                      Source: QT21136583_Order_Doc.exe, 00000000.00000003.352447860.00000000029A6000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs QT21136583_Order_Doc.exe
                      Source: QT21136583_Order_Doc.exe, 00000000.00000002.357620213.0000000002840000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamerTljCOvqmtkfXeQCODdQUJAgATHv.exe4 vs QT21136583_Order_Doc.exe
                      Source: QT21136583_Order_Doc.exeBinary or memory string: OriginalFilename vs QT21136583_Order_Doc.exe
                      Source: QT21136583_Order_Doc.exe, 00000001.00000002.615598257.0000000000400000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamerTljCOvqmtkfXeQCODdQUJAgATHv.exe4 vs QT21136583_Order_Doc.exe
                      Source: QT21136583_Order_Doc.exeReversingLabs: Detection: 17%
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile read: C:\Users\user\Desktop\QT21136583_Order_Doc.exeJump to behavior
                      Source: QT21136583_Order_Doc.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\QT21136583_Order_Doc.exe 'C:\Users\user\Desktop\QT21136583_Order_Doc.exe'
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess created: C:\Users\user\Desktop\QT21136583_Order_Doc.exe 'C:\Users\user\Desktop\QT21136583_Order_Doc.exe'
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess created: C:\Users\user\Desktop\QT21136583_Order_Doc.exe 'C:\Users\user\Desktop\QT21136583_Order_Doc.exe' Jump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0220AFBA AdjustTokenPrivileges,1_2_0220AFBA
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_0220AF83 AdjustTokenPrivileges,1_2_0220AF83
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile created: C:\Users\user\AppData\Roaming\zUbDtJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile created: C:\Users\user\AppData\Local\Temp\nsz6C71.tmpJump to behavior
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/3@12/2
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_00402053 CoCreateInstance,MultiByteToWideChar,0_2_00402053
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 0_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_00404292
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,1_2_00401489
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
                      Source: Binary string: wntdll.pdbUGP source: QT21136583_Order_Doc.exe, 00000000.00000003.354146293.0000000002A20000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: QT21136583_Order_Doc.exe, 00000000.00000003.354146293.0000000002A20000.00000004.00000001.sdmp

                      Data Obfuscation:

                      barindex
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeUnpacked PE file: 1.2.QT21136583_Order_Doc.exe.400000.0.unpack
                      Detected unpacking (changes PE section rights)Show sources
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeUnpacked PE file: 1.2.QT21136583_Order_Doc.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeUnpacked PE file: 1.2.QT21136583_Order_Doc.exe.2400000.4.unpack
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeCode function: 1_2_00401F16 push ecx; ret 1_2_00401F29
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeFile created: C:\Users\user\AppData\Local\Temp\nsu6CA1.tmp\ikmsjx.dllJump to dropped file
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run zUbDtJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run zUbDtJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\QT21136583_Order_Doc.exe