flash

PI.exe

Status: finished
Submission Time: 14.10.2021 10:17:09
Malicious
Trojan
Evader
AgentTesla

Comments

Tags

  • agenttesla
  • exe

Details

  • Analysis ID:
    502697
  • API (Web) ID:
    870269
  • Analysis Started:
    14.10.2021 10:17:10
  • Analysis Finished:
    14.10.2021 10:26:05
  • MD5:
    59f7f57b8d6c0e55493eec56977d7cb4
  • SHA1:
    0740bebf070c16fca8aa5c0fada48edcc1bd9f12
  • SHA256:
    c932b6a0cbaa454668d2429d433fec76e7e544bb26b5bd1865a86aac4fa33434
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
17/66

URLs

Name Detection
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
http://127.0.0.1:HTTP/1.1
Click to see the 19 hidden entries
http://DynDns.comDynDNS
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
https://watson.telemetry.m
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
https://api.ipify.org%GETMozilla/5.0
http://upx.sf.net
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
http://bwoMKP.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PI.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\ZAYOk\ZAYOk.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\gBrGmFSvkGtF.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 8 hidden entries
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegSvcs.exe_35438265e855fa13c91512473cf11ea89278e4e6_7bbe79f8_10581952\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER86C6.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Oct 14 17:19:05 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9473.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER97A1.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZAYOk.exe.log
ASCII text, with CRLF line terminators
#
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
#
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
MS Windows registry file, NT/2000 or above
#
\Device\ConDrv
ASCII text, with CRLF line terminators
#