Windows Analysis Report Sipari#U015f formu.exe

Overview

General Information

Sample Name: Sipari#U015f formu.exe
Analysis ID: 528524
MD5: 032bbfd4181a7cee029849db610a318b
SHA1: c99434f7f007f6f0f1317839cc7129db813d0750
SHA256: 9ae8f73164a7e8159a942f5c304cb55560f975ca943f00c2ef4f6dd489ce0656
Tags: AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Yara detected Telegram RAT
Yara detected AgentTesla
Yara detected AntiVM3
Installs a global keyboard hook
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 3.0.Sipari#U015f formu.exe.400000.4.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Chat id": "-640017301", "Chat URL": "https://api.telegram.org/bot2124462934:AAGr-L06waDdFGpnKJz3_DCOFcJpWDQ7WIM/sendDocument"}
Source: Sipari#U015f formu.exe.5356.0.memstrmin Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot2124462934:AAGr-L06waDdFGpnKJz3_DCOFcJpWDQ7WIM/sendMessage"}
Antivirus or Machine Learning detection for unpacked file
Source: 3.0.Sipari#U015f formu.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 3.2.Sipari#U015f formu.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Sipari#U015f formu.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Sipari#U015f formu.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Sipari#U015f formu.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 3.0.Sipari#U015f formu.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: Sipari#U015f formu.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Sipari#U015f formu.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Sipari#U015f formu.exe, 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Sipari#U015f formu.exe, 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: Sipari#U015f formu.exe, 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp String found in binary or memory: http://nQZIDO.com
Source: Sipari#U015f formu.exe, 00000000.00000002.658539650.0000000002D31000.00000004.00000001.sdmp, Sipari#U015f formu.exe, 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Sipari#U015f formu.exe, 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%
Source: Sipari#U015f formu.exe, 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: Sipari#U015f formu.exe, 00000000.00000002.659041461.0000000003D3D000.00000004.00000001.sdmp, Sipari#U015f formu.exe, 00000003.00000000.656174478.0000000000402000.00000040.00000001.sdmp, Sipari#U015f formu.exe, 00000003.00000000.654836486.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://api.telegram.org/bot2124462934:AAGr-L06waDdFGpnKJz3_DCOFcJpWDQ7WIM/
Source: Sipari#U015f formu.exe, 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp String found in binary or memory: https://api.telegram.org/bot2124462934:AAGr-L06waDdFGpnKJz3_DCOFcJpWDQ7WIM/sendDocumentdocument-----
Source: Sipari#U015f formu.exe, 00000000.00000002.659041461.0000000003D3D000.00000004.00000001.sdmp, Sipari#U015f formu.exe, 00000003.00000000.656174478.0000000000402000.00000040.00000001.sdmp, Sipari#U015f formu.exe, 00000003.00000000.654836486.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Sipari#U015f formu.exe, 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Sipari#U015f formu.exe Jump to behavior
Creates a DirectInput object (often for capturing keystrokes)
Source: Sipari#U015f formu.exe, 00000000.00000002.658187478.0000000001228000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

Spam, unwanted Advertisements and Ransom Demands:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

System Summary:

barindex
.NET source code contains very large array initializations
Source: 3.0.Sipari#U015f formu.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b8A798CEDu002d3CCBu002d454Eu002d88B5u002dBAB811469A9Cu007d/u003103172F1u002dA66Fu002d4B76u002dA067u002d1A5E53DD2968.cs Large array initialization: .cctor: array initializer size 11987
Source: 3.2.Sipari#U015f formu.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b8A798CEDu002d3CCBu002d454Eu002d88B5u002dBAB811469A9Cu007d/u003103172F1u002dA66Fu002d4B76u002dA067u002d1A5E53DD2968.cs Large array initialization: .cctor: array initializer size 11987
Source: 3.0.Sipari#U015f formu.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b8A798CEDu002d3CCBu002d454Eu002d88B5u002dBAB811469A9Cu007d/u003103172F1u002dA66Fu002d4B76u002dA067u002d1A5E53DD2968.cs Large array initialization: .cctor: array initializer size 11987
Source: 3.0.Sipari#U015f formu.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b8A798CEDu002d3CCBu002d454Eu002d88B5u002dBAB811469A9Cu007d/u003103172F1u002dA66Fu002d4B76u002dA067u002d1A5E53DD2968.cs Large array initialization: .cctor: array initializer size 11987
Source: 3.0.Sipari#U015f formu.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b8A798CEDu002d3CCBu002d454Eu002d88B5u002dBAB811469A9Cu007d/u003103172F1u002dA66Fu002d4B76u002dA067u002d1A5E53DD2968.cs Large array initialization: .cctor: array initializer size 11987
Uses 32bit PE files
Source: Sipari#U015f formu.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Detected potential crypto function
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_00A85C24 0_2_00A85C24
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_02BC8250 0_2_02BC8250
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_02BCD2F8 0_2_02BCD2F8
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_055FF5D0 0_2_055FF5D0
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_055F5AB0 0_2_055F5AB0
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_055F5AA0 0_2_055F5AA0
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00595C24 3_2_00595C24
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CF6078 3_2_00CF6078
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CF5318 3_2_00CF5318
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CF2E70 3_2_00CF2E70
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CFD060 3_2_00CFD060
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CFA902 3_2_00CFA902
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00DC5D98 3_2_00DC5D98
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00DC1310 3_2_00DC1310
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00EB4960 3_2_00EB4960
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00EB4950 3_2_00EB4950
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00EBDF60 3_2_00EBDF60
Sample file is different than original file name gathered from version info
Source: Sipari#U015f formu.exe Binary or memory string: OriginalFilename vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000000.00000002.658539650.0000000002D31000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000000.00000002.658539650.0000000002D31000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameWgOeZtowfaTIOlypmkhHrWzxdUx.exe4 vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000000.00000002.660812533.0000000005DC0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000000.00000002.659041461.0000000003D3D000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameWgOeZtowfaTIOlypmkhHrWzxdUx.exe4 vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000000.00000002.659041461.0000000003D3D000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000000.00000002.658187478.0000000001228000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000000.00000002.662053728.0000000006350000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe Binary or memory string: OriginalFilename vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000003.00000000.656174478.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameWgOeZtowfaTIOlypmkhHrWzxdUx.exe4 vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe, 00000003.00000002.917015212.0000000000798000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe Binary or memory string: OriginalFilenameHa.exe. vs Sipari#U015f formu.exe
Source: Sipari#U015f formu.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File read: C:\Users\user\Desktop\Sipari#U015f formu.exe:Zone.Identifier Jump to behavior
Source: Sipari#U015f formu.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Sipari#U015f formu.exe "C:\Users\user\Desktop\Sipari#U015f formu.exe"
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process created: C:\Users\user\Desktop\Sipari#U015f formu.exe C:\Users\user\Desktop\Sipari#U015f formu.exe
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process created: C:\Users\user\Desktop\Sipari#U015f formu.exe C:\Users\user\Desktop\Sipari#U015f formu.exe Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sipari#U015f formu.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@3/2@0/0
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
Source: Sipari#U015f formu.exe String found in binary or memory: /Ha;component/views/addbook.xaml
Source: Sipari#U015f formu.exe String found in binary or memory: views/addbook.baml
Source: Sipari#U015f formu.exe String found in binary or memory: views/addcustomer.baml
Source: Sipari#U015f formu.exe String found in binary or memory: /Ha;component/views/addcustomer.xaml
Source: Sipari#U015f formu.exe String found in binary or memory: /Ha;component/views/addbook.xaml
Source: Sipari#U015f formu.exe String found in binary or memory: views/addcustomer.baml
Source: Sipari#U015f formu.exe String found in binary or memory: views/addbook.baml
Source: Sipari#U015f formu.exe String found in binary or memory: /Ha;component/views/addcustomer.xaml
Source: Sipari#U015f formu.exe String found in binary or memory: A/Ha;component/views/addbook.xamlW/Ha;component/views/borrowfrombookview.xamlM/Ha;component/views/borrowingview.xamlG/Ha;component/views/changebook.xamlO/Ha;component/views/changecustomer.xamlK/Ha;component/views/customerview.xamlO/Ha;component/views/deletecustomer.xamlE/Ha;component/views/errorview.xamlI/Ha;component/views/smallextras.xamlI/Ha;component/views/addcustomer.xaml
Source: Sipari#U015f formu.exe String found in binary or memory: *images/booksimage.jpg$views/addbook.baml1J,views/addcustomer.baml
Source: 3.0.Sipari#U015f formu.exe.400000.4.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.Sipari#U015f formu.exe.400000.4.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.Sipari#U015f formu.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.Sipari#U015f formu.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.Sipari#U015f formu.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.Sipari#U015f formu.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Sipari#U015f formu.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Sipari#U015f formu.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: Sipari#U015f formu.exe, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Sipari#U015f formu.exe.a80000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Sipari#U015f formu.exe.a80000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Sipari#U015f formu.exe.590000.1.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Sipari#U015f formu.exe.590000.5.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.Sipari#U015f formu.exe.590000.1.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Sipari#U015f formu.exe.590000.13.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Sipari#U015f formu.exe.590000.3.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Sipari#U015f formu.exe.590000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Sipari#U015f formu.exe.590000.7.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Sipari#U015f formu.exe.590000.9.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Sipari#U015f formu.exe.590000.2.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_00A89361 push ds; retf 0_2_00A89364
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_00A892F5 push ds; ret 0_2_00A89340
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_00A89347 push ds; ret 0_2_00A8934C
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 0_2_055F56E0 push esp; iretd 0_2_055F56E9
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00599347 push ds; ret 3_2_0059934C
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_005992F5 push ds; ret 3_2_00599340
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00599361 push ds; retf 3_2_00599364
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CFA35B pushfd ; iretd 3_2_00CFA35E
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CFA359 pushfd ; iretd 3_2_00CFA35A
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CFA354 pushfd ; iretd 3_2_00CFA356
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CFA360 pushfd ; iretd 3_2_00CFA362
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CF4778 push 00000041h; iretd 3_2_00CF477A
Source: initial sample Static PE information: section name: .text entropy: 7.88235938246
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.2d971c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.2e25574.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.658539650.0000000002D31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5356, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Sipari#U015f formu.exe, 00000000.00000002.658539650.0000000002D31000.00000004.00000001.sdmp, Sipari#U015f formu.exe, 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: Sipari#U015f formu.exe, 00000000.00000002.658539650.0000000002D31000.00000004.00000001.sdmp, Sipari#U015f formu.exe, 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3240 Thread sleep count: 591 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -239843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3240 Thread sleep count: 2085 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -239728s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 5404 Thread sleep time: -30884s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -239624s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -239515s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -239405s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -239296s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -239187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -239077s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -238968s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -238827s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -238718s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -238606s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -238390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -237343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -236750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -236390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 3152 Thread sleep time: -236249s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 1296 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 7084 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 5408 Thread sleep count: 865 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe TID: 5408 Thread sleep count: 8996 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239843 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239728 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239624 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239515 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239405 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239296 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239187 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239077 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238968 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238827 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238718 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238606 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238390 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 237343 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 236750 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 236390 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 236249 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Window / User API: threadDelayed 591 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Window / User API: threadDelayed 2085 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Window / User API: threadDelayed 865 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Window / User API: threadDelayed 8996 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239843 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239728 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 30884 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239624 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239515 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239405 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239296 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239187 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 239077 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238968 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238827 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238718 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238606 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 238390 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 237343 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 236750 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 236390 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 236249 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Sipari#U015f formu.exe, 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: Sipari#U015f formu.exe, 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Sipari#U015f formu.exe, 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp Binary or memory string: vmware
Source: Sipari#U015f formu.exe, 00000000.00000002.658683577.0000000002DF5000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Code function: 3_2_00CFEDC8 LdrInitializeThunk, 3_2_00CFEDC8
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Process created: C:\Users\user\Desktop\Sipari#U015f formu.exe C:\Users\user\Desktop\Sipari#U015f formu.exe Jump to behavior
Source: Sipari#U015f formu.exe, 00000003.00000002.917663848.0000000001380000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: Sipari#U015f formu.exe, 00000003.00000002.917663848.0000000001380000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: Sipari#U015f formu.exe, 00000003.00000002.917663848.0000000001380000.00000002.00020000.sdmp Binary or memory string: Progman
Source: Sipari#U015f formu.exe, 00000003.00000002.917663848.0000000001380000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Users\user\Desktop\Sipari#U015f formu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Users\user\Desktop\Sipari#U015f formu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Telegram RAT
Source: Yara match File source: 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5356, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5956, type: MEMORYSTR
Yara detected AgentTesla
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Sipari#U015f formu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.3e2de80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.3e63ea0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.3e63ea0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.3e2de80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.656174478.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.654836486.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.656667714.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.916854824.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.655483675.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.659041461.0000000003D3D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5356, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5956, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Sipari#U015f formu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5956, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected Telegram RAT
Source: Yara match File source: 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5356, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5956, type: MEMORYSTR
Yara detected AgentTesla
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.Sipari#U015f formu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.3e2de80.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.3e63ea0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.Sipari#U015f formu.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.3e63ea0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Sipari#U015f formu.exe.3e2de80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000000.656174478.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.654836486.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.656667714.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.916854824.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.655483675.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.659041461.0000000003D3D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.918210853.0000000002A51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5356, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Sipari#U015f formu.exe PID: 5956, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 528524 Sample: Sipari#U015f formu.exe Startdate: 25/11/2021 Architecture: WINDOWS Score: 100 14 Found malware configuration 2->14 16 Yara detected AgentTesla 2->16 18 Yara detected Telegram RAT 2->18 20 6 other signatures 2->20 6 Sipari#U015f formu.exe 3 2->6         started        process3 process4 8 Sipari#U015f formu.exe 2 6->8         started        file5 12 C:\Windows\System32\drivers\etc\hosts, ASCII 8->12 dropped 22 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 8->22 24 Tries to steal Mail credentials (via file / registry access) 8->24 26 Tries to harvest and steal browser information (history, passwords, etc) 8->26 28 2 other signatures 8->28 signatures6
No contacted IP infos