Windows Analysis Report
D6GEVBNNH11111.exe

Overview

General Information

Sample Name: D6GEVBNNH11111.exe
Analysis ID: 673906
MD5: 9cef8265c679bafb06f885678ceab7bd
SHA1: ac7faaa7e8439951eaafd8e02007f33a555cd01b
SHA256: 18f7c9fcf55206644996038b2908aa3871e3ea9affa4c6d62a7460f5b95cca90
Tags: agentteslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Drops executable to a common third party application directory
Machine Learning detection for sample
Injects a PE file into a foreign processes
Hides that the sample has been downloaded from the Internet (zone.identifier)
Moves itself to temp directory
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to launch a process as a different user
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: D6GEVBNNH11111.exe Virustotal: Detection: 40% Perma Link
Source: D6GEVBNNH11111.exe ReversingLabs: Detection: 27%
Machine Learning detection for sample
Source: D6GEVBNNH11111.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 15.0.InstallUtil.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 15.0.InstallUtil.exe.400000.1.unpack Avira: Label: TR/Spy.Gen8
Source: 15.0.InstallUtil.exe.400000.2.unpack Avira: Label: TR/Spy.Gen8
Source: 15.0.InstallUtil.exe.400000.3.unpack Avira: Label: TR/Spy.Gen8
Source: 15.2.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 15.0.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 15.0.InstallUtil.exe.400000.4.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "logs@multimetals.cfd", "Password": "multimetals.cfd", "Host": "asset@multimetals.cfd"}
Uses 32bit PE files
Source: D6GEVBNNH11111.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: D6GEVBNNH11111.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: Acrobat.exe.15.dr
Source: Binary string: InstallUtil.pdb source: Acrobat.exe.15.dr
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: InstallUtil.exe, 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: InstallUtil.exe, 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: InstallUtil.exe, 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://OKJTye.com
Source: InstallUtil.exe, 0000000F.00000002.691205216.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694046075.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.696582451.0000000006725000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: InstallUtil.exe, 0000000F.00000002.691205216.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694046075.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.695758505.00000000066C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: InstallUtil.exe, 0000000F.00000002.691205216.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694046075.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.696582451.0000000006725000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: D6GEVBNNH11111.exe, 00000000.00000002.449096881.000000000125E000.00000004.00000020.00020000.00000000.sdmp, geater.exe, 00000006.00000003.556575748.0000000001218000.00000004.00000020.00020000.00000000.sdmp, geater.exe, 00000006.00000002.647229362.0000000001218000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694145293.0000000005ED1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: InstallUtil.exe, 0000000F.00000002.691205216.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694046075.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.696582451.0000000006725000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: D6GEVBNNH11111.exe, 00000000.00000003.419597185.000000000C182000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: InstallUtil.exe, 0000000F.00000002.691023728.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://maKknZWobi.net
Source: InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://multimetals.cfd
Source: geater.exe, 00000006.00000003.468594106.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.465086224.000000000C1F0000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.469714782.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.466707799.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.465370000.000000000C1F0000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.475458159.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.466241757.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.474734788.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.467189569.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.545768545.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.475210422.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.474948415.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.474548675.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.c/g
Source: geater.exe, 00000006.00000002.682161073.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.642265092.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.c/g%%n
Source: geater.exe, 00000006.00000003.474106682.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000003.464715331.000000000C1F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ns.adobe.c/g4
Source: InstallUtil.exe, 0000000F.00000002.691205216.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694046075.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.695758505.00000000066C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0W
Source: InstallUtil.exe, 0000000F.00000002.691205216.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694046075.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.695758505.00000000066C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: D6GEVBNNH11111.exe, 00000000.00000002.450466503.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000002.648331977.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 0000000F.00000002.694815599.0000000005FBE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: InstallUtil.exe, 0000000F.00000002.694815599.0000000005FBE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422003230.000000000C189000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: D6GEVBNNH11111.exe, 00000000.00000003.422408075.000000000C176000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comC
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comI
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comTC
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comadi
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comc
Source: D6GEVBNNH11111.exe, 00000000.00000003.422408075.000000000C176000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comcar
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comeguKx
Source: D6GEVBNNH11111.exe, 00000000.00000003.422408075.000000000C176000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comint
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422408075.000000000C176000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: D6GEVBNNH11111.exe, 00000000.00000003.422408075.000000000C176000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.commpa
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.como.
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.como.ox
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comw
Source: D6GEVBNNH11111.exe, 00000000.00000003.422408075.000000000C176000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comypo
Source: InstallUtil.exe, 0000000F.00000002.694815599.0000000005FBE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: D6GEVBNNH11111.exe, 00000000.00000003.430433465.000000000C189000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000002.460978674.000000000C17B000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.447630466.000000000C17B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comaH
Source: D6GEVBNNH11111.exe, 00000000.00000003.430433465.000000000C189000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.como
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.421067665.000000000C1A1000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.420985402.000000000C1A2000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.421003844.000000000C1A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: D6GEVBNNH11111.exe, 00000000.00000003.421430217.000000000C17E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: D6GEVBNNH11111.exe, 00000000.00000003.421412161.000000000C176000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/M
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: D6GEVBNNH11111.exe, 00000000.00000003.421067665.000000000C1A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn2
Source: D6GEVBNNH11111.exe, 00000000.00000003.421412161.000000000C176000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnCh
Source: D6GEVBNNH11111.exe, 00000000.00000003.421010083.000000000C181000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cna
Source: D6GEVBNNH11111.exe, 00000000.00000003.420985402.000000000C1A2000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.421003844.000000000C1A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cng
Source: D6GEVBNNH11111.exe, 00000000.00000003.421430217.000000000C17E000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.421594428.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cns-m
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: InstallUtil.exe, 0000000F.00000002.695795045.00000000066E2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423114721.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422880183.000000000C179000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423327035.000000000C17E000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423114721.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423327035.000000000C17E000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/1
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Sue
Source: D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423327035.000000000C17E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/U
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0n
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/e
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ers
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423114721.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422880183.000000000C179000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423327035.000000000C17E000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/g
Source: D6GEVBNNH11111.exe, 00000000.00000003.423114721.000000000C187000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/is
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423327035.000000000C17E000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/U
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423114721.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422880183.000000000C179000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423327035.000000000C17E000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/l
Source: D6GEVBNNH11111.exe, 00000000.00000003.423114721.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423327035.000000000C17E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/on
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423114721.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423447686.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423327035.000000000C17E000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/rk
Source: D6GEVBNNH11111.exe, 00000000.00000003.422880183.000000000C179000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/s
Source: D6GEVBNNH11111.exe, 00000000.00000003.423641322.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423753219.000000000C180000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423596826.000000000C187000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.423662070.000000000C184000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/~
Source: D6GEVBNNH11111.exe, 00000000.00000003.429144369.000000000C179000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.
Source: InstallUtil.exe, 0000000F.00000002.694145293.0000000005ED1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: D6GEVBNNH11111.exe, 00000000.00000002.461913156.000000000D382000.00000004.00000800.00020000.00000000.sdmp, D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: D6GEVBNNH11111.exe, 00000000.00000003.422384405.000000000C173000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn/w
Source: InstallUtil.exe, 0000000F.00000002.696225493.00000000066FC000.00000004.00000001.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.691205216.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694046075.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: InstallUtil.exe, 0000000F.00000002.696225493.00000000066FC000.00000004.00000001.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.691205216.0000000002DCB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.694046075.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.690780729.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: InstallUtil.exe, 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%
Source: InstallUtil.exe, 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%appdata
Source: D6GEVBNNH11111.exe, D6GEVBNNH11111.exe, 00000000.00000002.450466503.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000002.648331977.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: D6GEVBNNH11111.exe, 00000000.00000002.450466503.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000002.648331977.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: D6GEVBNNH11111.exe String found in binary or memory: https://www.google.com3GetManifestResourceStream
Source: D6GEVBNNH11111.exe, 00000000.00000002.450466503.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000002.648331977.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.comT
Source: InstallUtil.exe, 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: www.google.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.5:49765 version: TLS 1.2
Creates a DirectInput object (often for capturing keystrokes)
Source: D6GEVBNNH11111.exe, 00000000.00000002.448891415.000000000122A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.geater.exe.47ad7e2.5.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.47e20b8.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.47ad7e2.5.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.4744642.2.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.484bafa.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.4744642.2.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.48b4cca.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.470fd62.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.4952740.7.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.491de6a.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.47e20b8.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.46db472.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.48803ea.5.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.48803ea.5.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.4952740.7.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.491de6a.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.484bafa.4.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.D6GEVBNNH11111.exe.48b4cca.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.46db472.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 6.2.geater.exe.470fd62.4.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Uses 32bit PE files
Source: D6GEVBNNH11111.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 6.2.geater.exe.47ad7e2.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.47e20b8.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.47ad7e2.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.4744642.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.484bafa.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.4744642.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.48b4cca.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.470fd62.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.4952740.7.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.491de6a.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.47e20b8.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.46db472.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.48803ea.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.48803ea.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.4952740.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.491de6a.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.484bafa.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.D6GEVBNNH11111.exe.48b4cca.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.46db472.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 6.2.geater.exe.470fd62.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Detected potential crypto function
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF5310 0_2_02DF5310
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF0040 0_2_02DF0040
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF11D0 0_2_02DF11D0
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF0799 0_2_02DF0799
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF4790 0_2_02DF4790
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF6838 0_2_02DF6838
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF52DB 0_2_02DF52DB
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF42C8 0_2_02DF42C8
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF42B8 0_2_02DF42B8
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF5268 0_2_02DF5268
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF40D8 0_2_02DF40D8
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF40CB 0_2_02DF40CB
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF0007 0_2_02DF0007
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF61F3 0_2_02DF61F3
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF61A0 0_2_02DF61A0
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF564F 0_2_02DF564F
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DFB600 0_2_02DFB600
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF67CA 0_2_02DF67CA
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF4780 0_2_02DF4780
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF5580 0_2_02DF5580
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF45AB 0_2_02DF45AB
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF4578 0_2_02DF4578
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF456B 0_2_02DF456B
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF680F 0_2_02DF680F
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF2E98 0_2_02DF2E98
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF2E88 0_2_02DF2E88
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF3D43 0_2_02DF3D43
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84ED00 0_2_0D84ED00
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84DB27 0_2_0D84DB27
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84E3A0 0_2_0D84E3A0
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84ECF0 0_2_0D84ECF0
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D844F28 0_2_0D844F28
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84D408 0_2_0D84D408
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84C710 0_2_0D84C710
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84F050 0_2_0D84F050
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84F060 0_2_0D84F060
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84E38F 0_2_0D84E38F
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D84D3F9 0_2_0D84D3F9
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E0799 6_2_052E0799
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E4790 6_2_052E4790
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E11D0 6_2_052E11D0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E0040 6_2_052E0040
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E7040 6_2_052E7040
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E5310 6_2_052E5310
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E456B 6_2_052E456B
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E4578 6_2_052E4578
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E45AB 6_2_052E45AB
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E5580 6_2_052E5580
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E4780 6_2_052E4780
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052EB600 6_2_052EB600
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E564F 6_2_052E564F
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E61A4 6_2_052E61A4
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E61BE 6_2_052E61BE
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E7030 6_2_052E7030
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E0006 6_2_052E0006
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E40CB 6_2_052E40CB
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E40D8 6_2_052E40D8
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E526C 6_2_052E526C
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E42B8 6_2_052E42B8
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E42C8 6_2_052E42C8
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E52DB 6_2_052E52DB
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E3D4B 6_2_052E3D4B
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E2E88 6_2_052E2E88
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E2E98 6_2_052E2E98
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06514E90 6_2_06514E90
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06516E98 6_2_06516E98
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0651328A 6_2_0651328A
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06515F88 6_2_06515F88
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06510420 6_2_06510420
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0651E560 6_2_0651E560
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065155B8 6_2_065155B8
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06514251 6_2_06514251
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06514E61 6_2_06514E61
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06519601 6_2_06519601
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06516E29 6_2_06516E29
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06510A98 6_2_06510A98
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065132A0 6_2_065132A0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0651D728 6_2_0651D728
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06518F98 6_2_06518F98
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06518FA8 6_2_06518FA8
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06510410 6_2_06510410
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06518C28 6_2_06518C28
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0651D098 6_2_0651D098
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06517D40 6_2_06517D40
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0651A549 6_2_0651A549
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06510D09 6_2_06510D09
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06517D31 6_2_06517D31
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06518938 6_2_06518938
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06518929 6_2_06518929
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065191D0 6_2_065191D0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06516DD3 6_2_06516DD3
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06514DF1 6_2_06514DF1
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065191E0 6_2_065191E0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0651DD90 6_2_0651DD90
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06516DA1 6_2_06516DA1
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E53D8 6_2_065E53D8
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E0040 6_2_065E0040
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E3D28 6_2_065E3D28
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E9E58 6_2_065E9E58
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E1E70 6_2_065E1E70
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E3239 6_2_065E3239
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E1E80 6_2_065E1E80
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E3770 6_2_065E3770
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E3760 6_2_065E3760
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E93D8 6_2_065E93D8
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E53C9 6_2_065E53C9
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E3040 6_2_065E3040
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E0006 6_2_065E0006
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E3030 6_2_065E3030
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E5CB0 6_2_065E5CB0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E3D55 6_2_065E3D55
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0C19ED00 6_2_0C19ED00
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0C19DB27 6_2_0C19DB27
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0C19E3A0 6_2_0C19E3A0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0C19D408 6_2_0C19D408
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0C19C710 6_2_0C19C710
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0C194F28 6_2_0C194F28
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0C19F060 6_2_0C19F060
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0C196B08 6_2_0C196B08
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E4E40 CreateProcessAsUserW, 6_2_065E4E40
Sample file is different than original file name gathered from version info
Source: D6GEVBNNH11111.exe, 00000000.00000002.456920390.000000000491D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRwKntxILzrfTruqKGkLPcmQ.exe4 vs D6GEVBNNH11111.exe
Source: D6GEVBNNH11111.exe, 00000000.00000002.458059400.0000000006380000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameStrengthBody.dll: vs D6GEVBNNH11111.exe
Source: D6GEVBNNH11111.exe, 00000000.00000002.456040536.0000000004817000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRwKntxILzrfTruqKGkLPcmQ.exe4 vs D6GEVBNNH11111.exe
Source: D6GEVBNNH11111.exe, 00000000.00000002.448891415.000000000122A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs D6GEVBNNH11111.exe
Source: D6GEVBNNH11111.exe, 00000000.00000002.455208384.0000000003F11000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameStrengthBody.dll: vs D6GEVBNNH11111.exe
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\Acrobat\Acrobat.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
Source: D6GEVBNNH11111.exe Virustotal: Detection: 40%
Source: D6GEVBNNH11111.exe ReversingLabs: Detection: 27%
Source: D6GEVBNNH11111.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\D6GEVBNNH11111.exe "C:\Users\user\Desktop\D6GEVBNNH11111.exe"
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process created: C:\Users\user\AppData\Local\Temp\geater.exe "C:\Users\user\AppData\Local\Temp\geater.exe"
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process created: C:\Users\user\AppData\Local\Temp\geater.exe "C:\Users\user\AppData\Local\Temp\geater.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\D6GEVBNNH11111.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@5/3@3/1
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: D6GEVBNNH11111.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: D6GEVBNNH11111.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: D6GEVBNNH11111.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: Acrobat.exe.15.dr
Source: Binary string: InstallUtil.pdb source: Acrobat.exe.15.dr
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_02DF02D8 push eax; ret 0_2_02DF02D9
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D8408A7 pushfd ; retf 000Bh 0_2_0D8408AA
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D840828 pushfd ; retf 000Bh 0_2_0D84082A
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D8407B0 pushfd ; retf 000Bh 0_2_0D8407B2
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D8407F9 pushfd ; retf 000Bh 0_2_0D8407FA
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Code function: 0_2_0D840738 pushfd ; retf 000Bh 0_2_0D84073A
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_052E02D8 push eax; ret 6_2_052E02D9
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065140DE push es; retf 6_2_06514158
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_0651411D push es; retf 6_2_06514158
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06514DDD push es; ret 6_2_06514DF0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_06516DA1 push es; retn 5167h 6_2_06516DD0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E43C1 push es; iretd 6_2_065E43D0
Source: C:\Users\user\AppData\Local\Temp\geater.exe Code function: 6_2_065E85DE pushad ; iretd 6_2_065E85E1

Persistence and Installation Behavior
barindex
Drops executable to a common third party application directory
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File written: C:\Users\user\AppData\Roaming\Acrobat\Acrobat.exe Jump to behavior
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Roaming\Acrobat\Acrobat.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Acrobat Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Acrobat Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe File opened: C:\Users\user\Desktop\D6GEVBNNH11111.exe\:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe File opened: C:\Users\user\AppData\Local\Temp\geater.exe\:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Acrobat\Acrobat.exe:Zone.Identifier read attributes | delete Jump to behavior
Moves itself to temp directory
Source: c:\users\user\desktop\d6gevbnnh11111.exe File moved: C:\Users\user\AppData\Local\Temp\geater.exe Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe TID: 5456 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe TID: 5900 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe TID: 4828 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe TID: 4828 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3736 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3720 Thread sleep count: 9617 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\geater.exe Window / User API: threadDelayed 9840 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 9617 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: InstallUtil.exe, 0000000F.00000002.696582451.0000000006725000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWY
Source: D6GEVBNNH11111.exe, 00000000.00000002.450621182.0000000002F57000.00000004.00000800.00020000.00000000.sdmp, geater.exe, 00000006.00000002.648622832.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VBoxTray
Source: geater.exe, 00000006.00000002.648622832.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware VGAuth
Source: geater.exe, 00000006.00000002.648622832.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: sandboxierpcss#SOFTWARE\VMware, Inc.\VMware VGAuth
Source: geater.exe, 00000006.00000002.646783601.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, geater.exe, 00000006.00000003.556417032.00000000011EA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm
Source: InstallUtil.exe, 0000000F.00000002.696582451.0000000006725000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: InstallUtil.exe, 0000000F.00000002.694145293.0000000005ED1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8t
Source: D6GEVBNNH11111.exe, 00000000.00000002.449096881.000000000125E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Enables debug privileges
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\geater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 436000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 438000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 839008 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\geater.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Process created: C:\Users\user\AppData\Local\Temp\geater.exe "C:\Users\user\AppData\Local\Temp\geater.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Users\user\Desktop\D6GEVBNNH11111.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Queries volume information: C:\Users\user\AppData\Local\Temp\geater.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\geater.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\D6GEVBNNH11111.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 6.2.geater.exe.47ad7e2.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.47e20b8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.47ad7e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.4744642.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.484bafa.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.4744642.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.48b4cca.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.470fd62.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.4952740.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.491de6a.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.47e20b8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.46db472.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.48803ea.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.48803ea.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.4952740.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.491de6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.484bafa.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.48b4cca.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.46db472.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.470fd62.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.561341870.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.561888828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.668565825.00000000046A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.667459782.000000000464C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.456920390.000000000491D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.671650352.00000000047AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.682815690.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.456040536.0000000004817000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.562345029.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.560518912.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: D6GEVBNNH11111.exe PID: 3436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: geater.exe PID: 3972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3512, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3512, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 6.2.geater.exe.47ad7e2.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.47e20b8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.47ad7e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.4744642.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.484bafa.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.4744642.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.48b4cca.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.470fd62.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.4952740.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.491de6a.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.47e20b8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.46db472.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.48803ea.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.48803ea.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.InstallUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.4952740.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.491de6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.484bafa.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.D6GEVBNNH11111.exe.48b4cca.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.46db472.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.geater.exe.470fd62.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000000.561341870.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.561888828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.668565825.00000000046A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.667459782.000000000464C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.456920390.000000000491D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.671650352.00000000047AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.682815690.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.456040536.0000000004817000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.562345029.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.560518912.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.686918576.0000000002A21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: D6GEVBNNH11111.exe PID: 3436, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: geater.exe PID: 3972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 3512, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 673906 Sample: D6GEVBNNH11111.exe Startdate: 26/07/2022 Architecture: WINDOWS Score: 100 25 multimetals.cfd 2->25 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected AgentTesla 2->43 45 Machine Learning detection for sample 2->45 8 D6GEVBNNH11111.exe 15 4 2->8         started        signatures3 process4 dnsIp5 27 www.google.com 142.250.185.228, 443, 49749, 49765 GOOGLEUS United States 8->27 23 C:\Users\user\...\D6GEVBNNH11111.exe.log, ASCII 8->23 dropped 47 Moves itself to temp directory 8->47 49 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->49 13 geater.exe 14 3 8->13         started        file6 signatures7 process8 dnsIp9 29 www.google.com 13->29 51 Writes to foreign memory regions 13->51 53 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->53 55 Injects a PE file into a foreign processes 13->55 17 InstallUtil.exe 2 4 13->17         started        signatures10 process11 file12 21 C:\Users\user\AppData\Roaming\...\Acrobat.exe, PE32 17->21 dropped 31 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->31 33 Tries to steal Mail credentials (via file / registry access) 17->33 35 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 17->35 37 2 other signatures 17->37 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.185.228
 www.google.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
multimetals.cfd 192.185.37.183 true
www.google.com 142.250.185.228 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.google.com/ false
    		high