Windows Analysis Report
SecuriteInfo.com.W32.AIDetectNet.01.19723.25833

Overview

General Information

Sample Name: SecuriteInfo.com.W32.AIDetectNet.01.19723.25833 (renamed file extension from 25833 to exe)
Analysis ID: 615403
MD5: a27c8ee8b37605f3c05e4eb4d614f359
SHA1: 6a8b97217d52a752075b08207bad7d7c867a8854
SHA256: 910a6e4138cb422bf570130f05cdb463d726c0eddb2882bdc6e42fb1daace384
Tags: AgentTeslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Uses FTP
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "FTP Host": "ftp://ftp.unitelha.com/", "Username": "kilop@unitelha.com", "Password": "Wljp?j]gQwC?"}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Virustotal: Detection: 27% Perma Link
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe ReversingLabs: Detection: 21%
Machine Learning detection for sample
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 2.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Uses 32bit PE files
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ALMOUROLTECPT ALMOUROLTECPT
Uses FTP
Source: unknown FTP traffic detected: 130.185.84.152:21 -> 192.168.2.6:49741 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 06:01. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 06:01. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 06:01. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 23 of 50 allowed.220-Local time is now 06:01. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.633680403.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ftp://ftp.unitelha.com/kilop
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.633680403.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.633680403.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.633680403.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://MaQvjL.com
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.634279983.0000000003338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ftp.unitelha.com
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.634267246.000000000332C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.633680403.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: ftp.unitelha.com
Creates a DirectInput object (often for capturing keystrokes)
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.374500466.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3dd6c40.9.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3dd6c40.9.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3ba53c8.7.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3ba53c8.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 2.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
.NET source code contains very large array initializations
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007bC218DA29u002d3671u002d4142u002dBD88u002d09FBD8C3393Cu007d/u00304B15681u002dD571u002d4C21u002d938Du002dC3C29594E26A.cs Large array initialization: .cctor: array initializer size 11605
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007bC218DA29u002d3671u002d4142u002dBD88u002d09FBD8C3393Cu007d/u00304B15681u002dD571u002d4C21u002d938Du002dC3C29594E26A.cs Large array initialization: .cctor: array initializer size 11605
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007bC218DA29u002d3671u002d4142u002dBD88u002d09FBD8C3393Cu007d/u00304B15681u002dD571u002d4C21u002d938Du002dC3C29594E26A.cs Large array initialization: .cctor: array initializer size 11605
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007bC218DA29u002d3671u002d4142u002dBD88u002d09FBD8C3393Cu007d/u00304B15681u002dD571u002d4C21u002d938Du002dC3C29594E26A.cs Large array initialization: .cctor: array initializer size 11605
Source: 2.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bC218DA29u002d3671u002d4142u002dBD88u002d09FBD8C3393Cu007d/u00304B15681u002dD571u002d4C21u002d938Du002dC3C29594E26A.cs Large array initialization: .cctor: array initializer size 11605
Uses 32bit PE files
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3dd6c40.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3dd6c40.9.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3ba53c8.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3ba53c8.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_0292A078 1_2_0292A078
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_0292A9C8 1_2_0292A9C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_02929AD8 1_2_02929AD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_0292A9BA 1_2_0292A9BA
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_0292EEB0 1_2_0292EEB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_02929AC8 1_2_02929AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_061A0006 1_2_061A0006
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_061A0040 1_2_061A0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_061A2E50 1_2_061A2E50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_00722FF1 1_2_00722FF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_02DFF3C8 2_2_02DFF3C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_02DFF080 2_2_02DFF080
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_0675D228 2_2_0675D228
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_0675CB90 2_2_0675CB90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_06759850 2_2_06759850
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_0675E048 2_2_0675E048
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_067565A0 2_2_067565A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_06751F28 2_2_06751F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_06750040 2_2_06750040
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_067574B9 2_2_067574B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_067575B8 2_2_067575B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_0676DF21 2_2_0676DF21
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_06768184 2_2_06768184
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_00BF2FF1 2_2_00BF2FF1
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.376573034.0000000003BA5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekqdUkOuMkGzolndCdJfRkglQYHUXM.exe4 vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.376573034.0000000003BA5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.378112998.0000000003DD6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekqdUkOuMkGzolndCdJfRkglQYHUXM.exe4 vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.379999331.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.374500466.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.379121625.00000000051C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameFuncAttribute.dll" vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375072023.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekqdUkOuMkGzolndCdJfRkglQYHUXM.exe4 vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000000.371685383.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekqdUkOuMkGzolndCdJfRkglQYHUXM.exe4 vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.632747327.00000000010F8000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.632876241.000000000136A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Binary or memory string: OriginalFilenameCALLC.exe8 vs SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Virustotal: Detection: 27%
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe ReversingLabs: Detection: 21%
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Mutant created: \Sessions\1\BaseNamedObjects\PwWjJazXCWbBZRHqXuEfC
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.10.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.10.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.6.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.6.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 1_2_0072A39B push cs; ret 1_2_0072A3B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_00BFA39B push cs; ret 2_2_00BFA3B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_02DF3480 push FFFFFF8Bh; iretd 2_2_02DF348A
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_0676142F push edi; retn 0000h 2_2_06761431
Source: initial sample Static PE information: section name: .text entropy: 7.87323976123
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000001.00000002.375601643.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.375072023.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe PID: 5840, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375601643.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375072023.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375601643.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375072023.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe TID: 2460 Thread sleep time: -45733s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe TID: 5160 Thread sleep time: -21213755684765971s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe TID: 68 Thread sleep count: 5966 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe TID: 68 Thread sleep count: 2777 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Window / User API: threadDelayed 5966 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Window / User API: threadDelayed 2777 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Thread delayed: delay time: 45733 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375072023.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375072023.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375072023.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000002.00000002.632974126.00000000013CF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe, 00000001.00000002.375072023.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Code function: 2_2_0675E048 LdrInitializeThunk, 2_2_0675E048
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3dd6c40.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3dd6c40.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3ba53c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.371685383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.376573034.0000000003BA5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.378112998.0000000003DD6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.371337269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.372498524.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.372086381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.632505310.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.633680403.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe PID: 5840, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe PID: 2508, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetectNet.01.19723.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000002.00000002.633680403.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe PID: 2508, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3dd6c40.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3dd6c40.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3ba53c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.3bdb5e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.SecuriteInfo.com.W32.AIDetectNet.01.19723.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.371685383.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.376573034.0000000003BA5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.378112998.0000000003DD6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.371337269.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.372498524.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.372086381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.632505310.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.633680403.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe PID: 5840, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.W32.AIDetectNet.01.19723.exe PID: 2508, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
130.185.84.152
 ftp.unitelha.com Portugal
24768 ALMOUROLTECPT true

Contacted Domains

Name IP Active
ftp.unitelha.com 130.185.84.152 true