Windows Analysis Report KYC INQUIRY 14-01.exe

Overview

General Information

Sample Name: KYC INQUIRY 14-01.exe
Analysis ID: 553301
MD5: 16d01fd64df59776d3454734512ded3c
SHA1: dcfe9d148b76768ae3dea9875255c0873d58d1b0
SHA256: 77743ead6e13c024db3534a837c669ee3c4fbaac2320bbf937fbe5e58de4a3b3
Tags: exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Drops certificate files (DER)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0.2.KYC INQUIRY 14-01.exe.369a178.6.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "syed@amtartec.com", "Password": "Ra@454504", "Host": "mail.amtartec.com"}
Multi AV Scanner detection for submitted file
Source: KYC INQUIRY 14-01.exe Virustotal: Detection: 31% Perma Link
Machine Learning detection for sample
Source: KYC INQUIRY 14-01.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.0.KYC INQUIRY 14-01.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 4.2.KYC INQUIRY 14-01.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.KYC INQUIRY 14-01.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.KYC INQUIRY 14-01.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.KYC INQUIRY 14-01.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.KYC INQUIRY 14-01.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: KYC INQUIRY 14-01.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: KYC INQUIRY 14-01.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: EventIgnoreAttribu.pdb source: KYC INQUIRY 14-01.exe

Networking:

barindex
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UK2NET-ASGB UK2NET-ASGB
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49845 -> 185.9.51.36:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.4:49845 -> 185.9.51.36:587
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930634828.0000000002D2B000.00000004.00000001.sdmp String found in binary or memory: http://amtartec.com
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930702649.0000000002D4F000.00000004.00000001.sdmp String found in binary or memory: http://bWuGMpUiLLMQeS0B9HKc.net
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930656310.0000000002D37000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000004.00000002.930634828.0000000002D2B000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.932595997.0000000005E36000.00000004.00000010.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b4599107e9ad4
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp String found in binary or memory: http://ecvgsx.com
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930634828.0000000002D2B000.00000004.00000001.sdmp String found in binary or memory: http://mail.amtartec.com
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930656310.0000000002D37000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000004.00000002.930634828.0000000002D2B000.00000004.00000001.sdmp String found in binary or memory: http://r3.i.lencr.org/0
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930656310.0000000002D37000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000004.00000002.930634828.0000000002D2B000.00000004.00000001.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.667848338.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667872959.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.668680200.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.668803095.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669633894.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669148799.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669074106.0000000005695000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.671164950.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669885794.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669377652.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.670254704.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667989126.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669281617.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669520183.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669723395.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669440181.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.671861127.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.671765144.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667940784.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.670988903.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669259523.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669919147.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.668886513.0000000005694000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.667989126.0000000005696000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.669401508.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.668680200.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.668803095.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669633894.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669148799.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669074106.0000000005695000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669377652.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667989126.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669281617.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669520183.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669723395.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669440181.000000000569B000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.669259523.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.668886513.0000000005694000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.668680200.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.668803095.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667989126.0000000005696000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comue
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000002.688371314.0000000000D57000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.com
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.671622125.00000000056CD000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.672827687.00000000056CD000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmll
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688371314.0000000000D57000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.comgreta
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688371314.0000000000D57000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.comuewaX
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.667848338.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667872959.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667709031.0000000005694000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667682755.0000000005694000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667769667.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667813528.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.667848338.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667872959.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667709031.0000000005694000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667682755.0000000005694000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667769667.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667813528.0000000005697000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667989126.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667940784.0000000005696000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cni
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.674939945.00000000056C7000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.674939945.00000000056C7000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/)
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691104031.00000000068A2000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667940784.0000000005696000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.667989126.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667940784.0000000005696000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cno.
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.667989126.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667940784.0000000005696000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cnt-p
Source: KYC INQUIRY 14-01.exe, 00000000.00000003.667989126.0000000005696000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000003.667940784.0000000005696000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cnue
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930634828.0000000002D2B000.00000004.00000001.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: 2D85F72862B55C4EADD9E66E06947F3D.4.dr String found in binary or memory: http://x1.i.lencr.org/
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930634828.0000000002D2B000.00000004.00000001.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.932567505.0000000005E01000.00000004.00000010.sdmp String found in binary or memory: http://x1.i.lencr.org/j
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%$
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.689364084.0000000003609000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000004.00000002.928613280.0000000000402000.00000040.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000004.00000000.684540552.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: mail.amtartec.com

E-Banking Fraud:

barindex
Drops certificate files (DER)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D Jump to dropped file

System Summary:

barindex
.NET source code contains very large array initializations
Source: 4.0.KYC INQUIRY 14-01.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b3F9652B0u002d6316u002d41B6u002d88C3u002d1801FE1BB841u007d/u00392255519u002d335Eu002d4240u002d92FDu002d43C6C020859F.cs Large array initialization: .cctor: array initializer size 11968
Source: 4.2.KYC INQUIRY 14-01.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b3F9652B0u002d6316u002d41B6u002d88C3u002d1801FE1BB841u007d/u00392255519u002d335Eu002d4240u002d92FDu002d43C6C020859F.cs Large array initialization: .cctor: array initializer size 11968
Source: 4.0.KYC INQUIRY 14-01.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b3F9652B0u002d6316u002d41B6u002d88C3u002d1801FE1BB841u007d/u00392255519u002d335Eu002d4240u002d92FDu002d43C6C020859F.cs Large array initialization: .cctor: array initializer size 11968
Source: 4.0.KYC INQUIRY 14-01.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b3F9652B0u002d6316u002d41B6u002d88C3u002d1801FE1BB841u007d/u00392255519u002d335Eu002d4240u002d92FDu002d43C6C020859F.cs Large array initialization: .cctor: array initializer size 11968
Source: 4.0.KYC INQUIRY 14-01.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b3F9652B0u002d6316u002d41B6u002d88C3u002d1801FE1BB841u007d/u00392255519u002d335Eu002d4240u002d92FDu002d43C6C020859F.cs Large array initialization: .cctor: array initializer size 11968
Uses 32bit PE files
Source: KYC INQUIRY 14-01.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Detected potential crypto function
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 0_2_00CBC9B4 0_2_00CBC9B4
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 0_2_00CBEDE8 0_2_00CBEDE8
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 0_2_00CBEDF8 0_2_00CBEDF8
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00B620E8 4_2_00B620E8
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00B64C78 4_2_00B64C78
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00B69C58 4_2_00B69C58
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00B681A0 4_2_00B681A0
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00D72D50 4_2_00D72D50
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00D7E2F0 4_2_00D7E2F0
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00D71FE0 4_2_00D71FE0
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00D7A770 4_2_00D7A770
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00D72768 4_2_00D72768
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00D7C308 4_2_00D7C308
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00F28C98 4_2_00F28C98
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00F25864 4_2_00F25864
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00F20040 4_2_00F20040
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00F2BE90 4_2_00F2BE90
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00F2EE78 4_2_00F2EE78
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00F20E58 4_2_00F20E58
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00F28FE1 4_2_00F28FE1
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00F20F08 4_2_00F20F08
Sample file is different than original file name gathered from version info
Source: KYC INQUIRY 14-01.exe Binary or memory string: OriginalFilename vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.691712863.00000000085E0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688470946.0000000002601000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameIPVSkwuOyeoRxTWWyCCMZJnGlQffbxV.exe4 vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe, 00000000.00000000.662068185.0000000000282000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameEventIgnoreAttribu.exe0 vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.689364084.0000000003609000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameIPVSkwuOyeoRxTWWyCCMZJnGlQffbxV.exe4 vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.689364084.0000000003609000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe Binary or memory string: OriginalFilename vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe, 00000004.00000000.682199691.00000000006A2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameEventIgnoreAttribu.exe0 vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.928613280.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameIPVSkwuOyeoRxTWWyCCMZJnGlQffbxV.exe4 vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.928876181.0000000000AF8000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe Binary or memory string: OriginalFilenameEventIgnoreAttribu.exe0 vs KYC INQUIRY 14-01.exe
Source: KYC INQUIRY 14-01.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: KYC INQUIRY 14-01.exe Virustotal: Detection: 31%
Source: KYC INQUIRY 14-01.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe "C:\Users\user\Desktop\KYC INQUIRY 14-01.exe"
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process created: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe C:\Users\user\Desktop\KYC INQUIRY 14-01.exe
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process created: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KYC INQUIRY 14-01.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/5@3/1
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: 4.0.KYC INQUIRY 14-01.exe.400000.4.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.KYC INQUIRY 14-01.exe.400000.4.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.KYC INQUIRY 14-01.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.KYC INQUIRY 14-01.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.KYC INQUIRY 14-01.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.KYC INQUIRY 14-01.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: KYC INQUIRY 14-01.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: KYC INQUIRY 14-01.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: KYC INQUIRY 14-01.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: EventIgnoreAttribu.pdb source: KYC INQUIRY 14-01.exe

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: KYC INQUIRY 14-01.exe, Cd/gJ.cs .Net Code: TW System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.KYC INQUIRY 14-01.exe.280000.0.unpack, Cd/gJ.cs .Net Code: TW System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.KYC INQUIRY 14-01.exe.280000.0.unpack, Cd/gJ.cs .Net Code: TW System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.KYC INQUIRY 14-01.exe.6a0000.1.unpack, Cd/gJ.cs .Net Code: TW System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.KYC INQUIRY 14-01.exe.6a0000.9.unpack, Cd/gJ.cs .Net Code: TW System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.KYC INQUIRY 14-01.exe.6a0000.3.unpack, Cd/gJ.cs .Net Code: TW System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
.NET source code contains method to dynamically call methods (often used by packers)
Source: KYC INQUIRY 14-01.exe, Cd/gJ.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", stackVariable694, null, null)
Source: 0.2.KYC INQUIRY 14-01.exe.280000.0.unpack, Cd/gJ.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", stackVariable694, null, null)
Source: 0.0.KYC INQUIRY 14-01.exe.280000.0.unpack, Cd/gJ.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", stackVariable694, null, null)
Source: 4.0.KYC INQUIRY 14-01.exe.6a0000.1.unpack, Cd/gJ.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", stackVariable694, null, null)
Source: 4.0.KYC INQUIRY 14-01.exe.6a0000.9.unpack, Cd/gJ.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", stackVariable694, null, null)
Source: 4.0.KYC INQUIRY 14-01.exe.6a0000.3.unpack, Cd/gJ.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", stackVariable694, null, null)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 0_2_04C2C109 push cs; ret 0_2_04C2C14E
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 0_2_04C2E644 push cs; ret 0_2_04C2F3C6
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 0_2_04C2C2A0 push cs; ret 0_2_04C2C2AE
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 0_2_04C28D7D push ebp; iretd 0_2_04C28D80
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00D77A37 push edi; retn 0000h 4_2_00D77A39
Source: initial sample Static PE information: section name: .text entropy: 7.23594935691

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.2637820.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.26766b4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.262f814.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.688722039.000000000264A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.688470946.0000000002601000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KYC INQUIRY 14-01.exe PID: 6504, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688722039.000000000264A000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000002.688470946.0000000002601000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688722039.000000000264A000.00000004.00000001.sdmp, KYC INQUIRY 14-01.exe, 00000000.00000002.688470946.0000000002601000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe TID: 6512 Thread sleep time: -37638s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe TID: 2264 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe TID: 6936 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe TID: 6920 Thread sleep count: 907 > 30 Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe TID: 6920 Thread sleep count: 8937 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Window / User API: threadDelayed 907 Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Window / User API: threadDelayed 8937 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Thread delayed: delay time: 37638 Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688470946.0000000002601000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688470946.0000000002601000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688470946.0000000002601000.00000004.00000001.sdmp Binary or memory string: vmware
Source: KYC INQUIRY 14-01.exe, 00000004.00000003.906047500.0000000005E9F000.00000004.00000010.sdmp, KYC INQUIRY 14-01.exe, 00000004.00000002.932626951.0000000005E95000.00000004.00000010.sdmp Binary or memory string: Hyper-V RAW
Source: KYC INQUIRY 14-01.exe, 00000000.00000002.688470946.0000000002601000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Code function: 4_2_00B64C78 LdrInitializeThunk, 4_2_00B64C78
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Memory written: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Process created: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Jump to behavior
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930019635.0000000001410000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930019635.0000000001410000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930019635.0000000001410000.00000002.00020000.sdmp Binary or memory string: Progman
Source: KYC INQUIRY 14-01.exe, 00000004.00000002.930019635.0000000001410000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.369a178.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.3663f58.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.KYC INQUIRY 14-01.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.3663f58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.369a178.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.928613280.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.685488835.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.684540552.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.685016391.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.685872653.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.689364084.0000000003609000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KYC INQUIRY 14-01.exe PID: 6504, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: KYC INQUIRY 14-01.exe PID: 5984, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\KYC INQUIRY 14-01.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KYC INQUIRY 14-01.exe PID: 5984, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.369a178.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.3663f58.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.KYC INQUIRY 14-01.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.KYC INQUIRY 14-01.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.3663f58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.KYC INQUIRY 14-01.exe.369a178.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.928613280.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.685488835.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.684540552.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.685016391.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.685872653.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.689364084.0000000003609000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.930221885.00000000029C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KYC INQUIRY 14-01.exe PID: 6504, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: KYC INQUIRY 14-01.exe PID: 5984, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs