Edit tour

Windows Analysis Report
DHL_Shippment_Notification_File1_TRK#92992.exe

Overview

General Information

Sample Name:	DHL_Shippment_Notification_File1_TRK#92992.exe
Analysis ID:	703288
MD5:	ae1ece1ab35f950a1822c606a7c31468
SHA1:	a03b8e19d1618de3b01f614fec4e7f2009a8d246
SHA256:	c6dae959f8e5373c6ac8746cfd8227b8d8099b692ee726aacbe18ecf1479282e
Tags:	AgentTeslaDHLexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: MSBuild connects to smtp port

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Yara detected Generic Downloader

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

DHL_Shippment_Notification_File1_TRK#92992.exe (PID: 2088 cmdline: "C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe" MD5: AE1ECE1AB35F950A1822C606A7C31468)

MSBuild.exe (PID: 5504 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: D621FD77BD585874F9686D3A76462EF1)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "marou.ouerghi@phossphea.com", "Password": "EpP@%mB2", "Host": "smtp.phossphea.com"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31064:$a3: MailAccountConfiguration 0x3107d:$a5: SmtpAccountConfiguration 0x31044:$a8: set_BindingAccountConfiguration 0x2ffb1:$a11: get_securityProfile 0x2fe52:$a12: get_useSeparateFolderTree 0x317a7:$a13: get_DnsResolver 0x30261:$a14: get_archivingScope 0x30089:$a15: get_providerName 0x32792:$a17: get_priority 0x31d66:$a18: get_advancedParameters 0x3117e:$a19: get_disabledByRestriction 0x2fc28:$a20: get_LastAccessed 0x302fb:$a21: get_avatarType 0x31e7d:$a22: get_signaturePresets 0x30923:$a23: get_enableLog 0x30106:$a26: set_accountName 0x322c8:$a27: set_InternalServerPort 0x2f599:$a28: set_bindingConfigurationUID 0x31e43:$a29: set_IdnAddress 0x32646:$a30: set_GuidMasterKey 0x30161:$a31: set_username
00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2fb2c:$s10: logins 0x2c4284:$s11: credential 0x1e42:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x296c:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x1f63:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera
00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x76bec:$a3: MailAccountConfiguration 0x174a0c:$a3: MailAccountConfiguration 0x1aaa2c:$a3: MailAccountConfiguration 0x76c05:$a5: SmtpAccountConfiguration 0x174a25:$a5: SmtpAccountConfiguration 0x1aaa45:$a5: SmtpAccountConfiguration 0x76bcc:$a8: set_BindingAccountConfiguration 0x1749ec:$a8: set_BindingAccountConfiguration 0x1aaa0c:$a8: set_BindingAccountConfiguration 0x75b39:$a11: get_securityProfile 0x173959:$a11: get_securityProfile 0x1a9979:$a11: get_securityProfile 0x759da:$a12: get_useSeparateFolderTree 0x1737fa:$a12: get_useSeparateFolderTree 0x1a981a:$a12: get_useSeparateFolderTree 0x7732f:$a13: get_DnsResolver 0x17514f:$a13: get_DnsResolver 0x1ab16f:$a13: get_DnsResolver 0x75de9:$a14: get_archivingScope 0x173c09:$a14: get_archivingScope 0x1a9c29:$a14: get_archivingScope
Process Memory Space: DHL_Shippment_Notification_File1_TRK#92992.exe PID: 2088	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL_Shippment_Notification_File1_TRK#92992.exe PID: 2088	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DHL_Shippment_Notification_File1_TRK#92992.exe PID: 2088	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x1096eb:$a3: MailAccountConfiguration 0x109704:$a5: SmtpAccountConfiguration 0x1096cb:$a8: set_BindingAccountConfiguration 0x1087c3:$a11: get_securityProfile 0x108667:$a12: get_useSeparateFolderTree 0x109d89:$a13: get_DnsResolver 0x108a6f:$a14: get_archivingScope 0x10889b:$a15: get_providerName 0x10ac55:$a17: get_priority 0x10a318:$a18: get_advancedParameters 0x109805:$a19: get_disabledByRestriction 0x10846f:$a20: get_LastAccessed 0x108b09:$a21: get_avatarType 0x10a42f:$a22: get_signaturePresets 0x1090d6:$a23: get_enableLog 0x108918:$a26: set_accountName 0x10a859:$a27: set_InternalServerPort 0x108242:$a28: set_bindingConfigurationUID 0x10a3f5:$a29: set_IdnAddress 0x10ab13:$a30: set_GuidMasterKey 0x108973:$a31: set_username
Process Memory Space: MSBuild.exe PID: 5504	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 5504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 5504	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x3edab:$s1: get_kbok 0x3f62b:$s2: get_CHoo 0x401c6:$s3: set_passwordIsSet 0x3ec57:$s4: get_enableLog 0x3e0c7:$g1: get_Clipboard 0x3e0d5:$g2: get_Keyboard 0x3e0e2:$g3: get_Password 0x3f505:$g4: get_CtrlKeyDown 0x3f515:$g5: get_ShiftKeyDown 0x3f526:$g6: get_AltKeyDown 0x1db3b:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x1fd63:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x1e665:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x2088c:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x1dc5c:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera 0x1fe84:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera
Process Memory Space: MSBuild.exe PID: 5504	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x3f26c:$a3: MailAccountConfiguration 0x3f285:$a5: SmtpAccountConfiguration 0x3f24c:$a8: set_BindingAccountConfiguration 0x3e344:$a11: get_securityProfile 0x3e1e8:$a12: get_useSeparateFolderTree 0x3f90a:$a13: get_DnsResolver 0x3e5f0:$a14: get_archivingScope 0x3e41c:$a15: get_providerName 0x407d6:$a17: get_priority 0x3fe99:$a18: get_advancedParameters 0x3f386:$a19: get_disabledByRestriction 0x3dff0:$a20: get_LastAccessed 0x3e68a:$a21: get_avatarType 0x3ffb0:$a22: get_signaturePresets 0x3ec57:$a23: get_enableLog 0x3e499:$a26: set_accountName 0x403da:$a27: set_InternalServerPort 0x3ddc3:$a28: set_bindingConfigurationUID 0x3ff76:$a29: set_IdnAddress 0x40694:$a30: set_GuidMasterKey 0x3e4f4:$a31: set_username
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2ef1f:$s1: get_kbok 0x2f853:$s2: get_CHoo 0x304ae:$s3: set_passwordIsSet 0x2ed23:$s4: get_enableLog 0x333cb:$s8: torbrowser 0x31da7:$s10: logins 0x3171f:$s11: credential 0x2e116:$g1: get_Clipboard 0x2e124:$g2: get_Keyboard 0x2e131:$g3: get_Password 0x2f701:$g4: get_CtrlKeyDown 0x2f711:$g5: get_ShiftKeyDown 0x2f722:$g6: get_AltKeyDown
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2f464:$a3: MailAccountConfiguration 0x2f47d:$a5: SmtpAccountConfiguration 0x2f444:$a8: set_BindingAccountConfiguration 0x2e3b1:$a11: get_securityProfile 0x2e252:$a12: get_useSeparateFolderTree 0x2fba7:$a13: get_DnsResolver 0x2e661:$a14: get_archivingScope 0x2e489:$a15: get_providerName 0x30b92:$a17: get_priority 0x30166:$a18: get_advancedParameters 0x2f57e:$a19: get_disabledByRestriction 0x2e028:$a20: get_LastAccessed 0x2e6fb:$a21: get_avatarType 0x3027d:$a22: get_signaturePresets 0x2ed23:$a23: get_enableLog 0x2e506:$a26: set_accountName 0x306c8:$a27: set_InternalServerPort 0x2d999:$a28: set_bindingConfigurationUID 0x30243:$a29: set_IdnAddress 0x30a46:$a30: set_GuidMasterKey 0x2e561:$a31: set_username
1.0.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.0.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.0.MSBuild.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.MSBuild.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d1f:$s1: get_kbok 0x31653:$s2: get_CHoo 0x322ae:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x351cb:$s8: torbrowser 0x33ba7:$s10: logins 0x3351f:$s11: credential 0x2ff16:$g1: get_Clipboard 0x2ff24:$g2: get_Keyboard 0x2ff31:$g3: get_Password 0x31501:$g4: get_CtrlKeyDown 0x31511:$g5: get_ShiftKeyDown 0x31522:$g6: get_AltKeyDown
1.0.MSBuild.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31264:$a3: MailAccountConfiguration 0x3127d:$a5: SmtpAccountConfiguration 0x31244:$a8: set_BindingAccountConfiguration 0x301b1:$a11: get_securityProfile 0x30052:$a12: get_useSeparateFolderTree 0x319a7:$a13: get_DnsResolver 0x30461:$a14: get_archivingScope 0x30289:$a15: get_providerName 0x32992:$a17: get_priority 0x31f66:$a18: get_advancedParameters 0x3137e:$a19: get_disabledByRestriction 0x2fe28:$a20: get_LastAccessed 0x304fb:$a21: get_avatarType 0x3207d:$a22: get_signaturePresets 0x30b23:$a23: get_enableLog 0x30306:$a26: set_accountName 0x324c8:$a27: set_InternalServerPort 0x2f799:$a28: set_bindingConfigurationUID 0x32043:$a29: set_IdnAddress 0x32846:$a30: set_GuidMasterKey 0x30361:$a31: set_username
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2ef1f:$s1: get_kbok 0x2f853:$s2: get_CHoo 0x304ae:$s3: set_passwordIsSet 0x2ed23:$s4: get_enableLog 0x333cb:$s8: torbrowser 0x31da7:$s10: logins 0x3171f:$s11: credential 0x2e116:$g1: get_Clipboard 0x2e124:$g2: get_Keyboard 0x2e131:$g3: get_Password 0x2f701:$g4: get_CtrlKeyDown 0x2f711:$g5: get_ShiftKeyDown 0x2f722:$g6: get_AltKeyDown
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2f464:$a3: MailAccountConfiguration 0x2f47d:$a5: SmtpAccountConfiguration 0x2f444:$a8: set_BindingAccountConfiguration 0x2e3b1:$a11: get_securityProfile 0x2e252:$a12: get_useSeparateFolderTree 0x2fba7:$a13: get_DnsResolver 0x2e661:$a14: get_archivingScope 0x2e489:$a15: get_providerName 0x30b92:$a17: get_priority 0x30166:$a18: get_advancedParameters 0x2f57e:$a19: get_disabledByRestriction 0x2e028:$a20: get_LastAccessed 0x2e6fb:$a21: get_avatarType 0x3027d:$a22: get_signaturePresets 0x2ed23:$a23: get_enableLog 0x2e506:$a26: set_accountName 0x306c8:$a27: set_InternalServerPort 0x2d999:$a28: set_bindingConfigurationUID 0x30243:$a29: set_IdnAddress 0x30a46:$a30: set_GuidMasterKey 0x2e561:$a31: set_username
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d1f:$s1: get_kbok 0x66d3f:$s1: get_kbok 0x31653:$s2: get_CHoo 0x67673:$s2: get_CHoo 0x322ae:$s3: set_passwordIsSet 0x682ce:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x66b43:$s4: get_enableLog 0x351cb:$s8: torbrowser 0x6b1eb:$s8: torbrowser 0x33ba7:$s10: logins 0x69bc7:$s10: logins 0x3351f:$s11: credential 0x6953f:$s11: credential 0x2ff16:$g1: get_Clipboard 0x65f36:$g1: get_Clipboard 0x2ff24:$g2: get_Keyboard 0x65f44:$g2: get_Keyboard 0x2ff31:$g3: get_Password 0x65f51:$g3: get_Password 0x31501:$g4: get_CtrlKeyDown
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x2ac60f:$s1: file:/// 0x2ac51f:$s2: {11111-22222-10009-11112} 0x2ac59f:$s3: {11111-22222-50001-00000} 0x2a98b5:$s4: get_Module 0x305e9:$s5: Reverse 0x66609:$s5: Reverse 0x2a9d2e:$s5: Reverse 0x328f5:$s6: BlockCopy 0x68915:$s6: BlockCopy 0x2abcd7:$s6: BlockCopy 0x3088a:$s7: ReadByte 0x668aa:$s7: ReadByte 0x2ac621:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31264:$a3: MailAccountConfiguration 0x67284:$a3: MailAccountConfiguration 0x3127d:$a5: SmtpAccountConfiguration 0x6729d:$a5: SmtpAccountConfiguration 0x31244:$a8: set_BindingAccountConfiguration 0x67264:$a8: set_BindingAccountConfiguration 0x301b1:$a11: get_securityProfile 0x661d1:$a11: get_securityProfile 0x30052:$a12: get_useSeparateFolderTree 0x66072:$a12: get_useSeparateFolderTree 0x319a7:$a13: get_DnsResolver 0x679c7:$a13: get_DnsResolver 0x30461:$a14: get_archivingScope 0x66481:$a14: get_archivingScope 0x30289:$a15: get_providerName 0x662a9:$a15: get_providerName 0x32992:$a17: get_priority 0x689b2:$a17: get_priority 0x31f66:$a18: get_advancedParameters 0x67f86:$a18: get_advancedParameters 0x3137e:$a19: get_disabledByRestriction
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d1f:$s1: get_kbok 0x12eb3f:$s1: get_kbok 0x164b5f:$s1: get_kbok 0x31653:$s2: get_CHoo 0x12f473:$s2: get_CHoo 0x165493:$s2: get_CHoo 0x322ae:$s3: set_passwordIsSet 0x1300ce:$s3: set_passwordIsSet 0x1660ee:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x12e943:$s4: get_enableLog 0x164963:$s4: get_enableLog 0x351cb:$s8: torbrowser 0x132feb:$s8: torbrowser 0x16900b:$s8: torbrowser 0x33ba7:$s10: logins 0x1319c7:$s10: logins 0x1679e7:$s10: logins 0x3351f:$s11: credential 0x13133f:$s11: credential 0x16735f:$s11: credential
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x3aa42f:$s1: file:/// 0x3aa33f:$s2: {11111-22222-10009-11112} 0x3aa3bf:$s3: {11111-22222-50001-00000} 0x3a76d5:$s4: get_Module 0x305e9:$s5: Reverse 0x12e409:$s5: Reverse 0x164429:$s5: Reverse 0x3a7b4e:$s5: Reverse 0x328f5:$s6: BlockCopy 0x130715:$s6: BlockCopy 0x166735:$s6: BlockCopy 0x3a9af7:$s6: BlockCopy 0x3088a:$s7: ReadByte 0x12e6aa:$s7: ReadByte 0x1646ca:$s7: ReadByte 0x3aa441:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31264:$a3: MailAccountConfiguration 0x12f084:$a3: MailAccountConfiguration 0x1650a4:$a3: MailAccountConfiguration 0x3127d:$a5: SmtpAccountConfiguration 0x12f09d:$a5: SmtpAccountConfiguration 0x1650bd:$a5: SmtpAccountConfiguration 0x31244:$a8: set_BindingAccountConfiguration 0x12f064:$a8: set_BindingAccountConfiguration 0x165084:$a8: set_BindingAccountConfiguration 0x301b1:$a11: get_securityProfile 0x12dfd1:$a11: get_securityProfile 0x163ff1:$a11: get_securityProfile 0x30052:$a12: get_useSeparateFolderTree 0x12de72:$a12: get_useSeparateFolderTree 0x163e92:$a12: get_useSeparateFolderTree 0x319a7:$a13: get_DnsResolver 0x12f7c7:$a13: get_DnsResolver 0x1657e7:$a13: get_DnsResolver 0x30461:$a14: get_archivingScope 0x12e281:$a14: get_archivingScope 0x1642a1:$a14: get_archivingScope
Click to see the 20 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 208.91.198.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 5504, Protocol: tcp, SourceIp: 192.168.2.3, SourceIsIpv6: false, SourcePort: 49756

Snort Signatures

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.3 - Destination IP: 208.91.198.143

Timestamp:	192.168.2.3208.91.198.143497565872840032 09/15/22-09:39:04.357043
SID:	2840032
Source Port:	49756
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.3 - Destination IP: 208.91.198.143

Timestamp:	192.168.2.3208.91.198.143497565872030171 09/15/22-09:39:04.356923
SID:	2030171
Source Port:	49756
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.3 - Destination IP: 208.91.198.143

Timestamp:	192.168.2.3208.91.198.143497565872851779 09/15/22-09:39:04.357043
SID:	2851779
Source Port:	49756
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.3 - Destination IP: 208.91.198.143

Timestamp:	192.168.2.3208.91.198.143497565872839723 09/15/22-09:39:04.356923
SID:	2839723
Source Port:	49756
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for sample

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Joe Sandbox ML: detected

Source: 1.0.MSBuild.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 1.0.MSBuild.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "marou.ouerghi@phossphea.com", "Password": "EpP@%mB2", "Host": "smtp.phossphea.com"}

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49756 -> 208.91.198.143:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49756 -> 208.91.198.143:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49756 -> 208.91.198.143:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.3:49756 -> 208.91.198.143:587

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

IP Address: 208.91.198.143 208.91.198.143

Source: global traffic

TCP traffic: 192.168.2.3:49756 -> 208.91.198.143:587

Source: global traffic

TCP traffic: 192.168.2.3:49756 -> 208.91.198.143:587

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.50.106.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.50.106.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.50.106.206
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.35.237.194
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 178.79.242.0
Source: unknown	TCP traffic detected without corresponding DNS query: 178.79.242.0
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.151
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.151
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.151
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.120.151

Source: MSBuild.exe, 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: MSBuild.exe, 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.253317969.0000000005384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: MSBuild.exe, 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hGabWS.com
Source: MSBuild.exe, 00000001.00000002.521960498.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.phossphea.com
Source: MSBuild.exe, 00000001.00000002.522163112.00000000032B4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.522069418.00000000032AC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.521387791.000000000324C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.mailhostbox.com/email-administrators-guide-error-codes/
Source: MSBuild.exe, 00000001.00000002.521960498.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256375119.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256216319.000000000538E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256216319.000000000538E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256375119.000000000538F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comueF
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.261926018.0000000005387000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.261828021.0000000005386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcom
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.275655212.0000000005380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcoma
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.275655212.0000000005380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comionoz
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255588553.0000000005385000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255679482.000000000538B000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255588553.0000000005385000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255633975.0000000005387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255679482.000000000538B000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256071956.0000000005386000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255908003.000000000538E000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255775479.0000000005383000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255842864.000000000538D000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255633975.0000000005387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnp
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.276075299.0000000000597000.00000004.00000020.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.krFc
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/:
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/u
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s_trh
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/tu
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/u
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/z
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.252597277.000000000539B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comTF
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.252597277.000000000539B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comt
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr.kr
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr4
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krN.TTFz
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255633975.0000000005387000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255692889.0000000005382000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255633975.0000000005387000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comNorm
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.253381410.0000000005384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.253381410.0000000005384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net:
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256152857.0000000005385000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256375119.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256216319.000000000538E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256152857.0000000005385000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.
Source: MSBuild.exe, 00000001.00000002.521863996.000000000329E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ZXnohkADwCrkK9XFdZI.com
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: MSBuild.exe, 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: smtp.phossphea.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: DHL_Shippment_Notification_File1_TRK#92992.exe PID: 2088, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: MSBuild.exe PID: 5504, type: MEMORYSTR	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: MSBuild.exe PID: 5504, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown

.NET source code contains very large array initializations

Source: 1.0.MSBuild.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bEC398326u002d75D0u002d4C9Eu002dAE6Du002dDF28D1FDAC04u007d/u00367652608u002dD25Cu002d4A4Cu002dA5F8u002dF1C8C9C57E68.cs

Large array initialization: .cctor: array initializer size 11937

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: DHL_Shippment_Notification_File1_TRK#92992.exe PID: 2088, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: MSBuild.exe PID: 5504, type: MEMORYSTR	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: MSBuild.exe PID: 5504, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Code function: 0_2_0237E690	0_2_0237E690
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Code function: 0_2_0237C244	0_2_0237C244
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Code function: 0_2_0237E680	0_2_0237E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_013646A0	1_2_013646A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01364630	1_2_01364630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01364690	1_2_01364690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0136D2E1	1_2_0136D2E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01560910	1_2_01560910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01564AD8	1_2_01564AD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0156D378	1_2_0156D378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015673D8	1_2_015673D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01569718	1_2_01569718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0156BA78	1_2_0156BA78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01569EA0	1_2_01569EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01565450	1_2_01565450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_01563430	1_2_01563430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0157B618	1_2_0157B618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_015765E0	1_2_015765E0

Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000000.249352605.0000000000012000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemQstcs.exeL vs DHL_Shippment_Notification_File1_TRK#92992.exe
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.294035854.0000000006C40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMetal.dllJ vs DHL_Shippment_Notification_File1_TRK#92992.exe
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameewGZpXyfvZrYFVQpPowkwWoYE.exe4 vs DHL_Shippment_Notification_File1_TRK#92992.exe
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMetal.dllJ vs DHL_Shippment_Notification_File1_TRK#92992.exe
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.277993136.000000000257D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameewGZpXyfvZrYFVQpPowkwWoYE.exe4 vs DHL_Shippment_Notification_File1_TRK#92992.exe
Source: DHL_Shippment_Notification_File1_TRK#92992.exe	Binary or memory string: OriginalFilenamemQstcs.exeL vs DHL_Shippment_Notification_File1_TRK#92992.exe

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe "C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe"
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_Shippment_Notification_File1_TRK#92992.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@3/1@2/1

Source: DHL_Shippment_Notification_File1_TRK#92992.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: 1.0.MSBuild.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.MSBuild.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static file information: File size 1113600 > 1048576

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10f400

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

.NET source code contains potential unpacker

Source: DHL_Shippment_Notification_File1_TRK#92992.exe, GreenPixelsCalculator/FormPixel.cs	.Net Code: ResourceTemplateDefine System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.DHL_Shippment_Notification_File1_TRK#92992.exe.10000.0.unpack, GreenPixelsCalculator/FormPixel.cs	.Net Code: ResourceTemplateDefine System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: DHL_Shippment_Notification_File1_TRK#92992.exe

Static PE information: 0xF3BCEC5A [Sat Aug 1 05:19:22 2099 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.239736670767991

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_Shippment_Notification_File1_TRK#92992.exe PID: 2088, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAMETSOFTWARE\ORACLE\VIRTUALBOX GUEST ADDITIONSFSELECT * FROM WIN32_VIDEOCONTROLLER
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe TID: 5420	Thread sleep time: -41226s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe TID: 1360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4124	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4124	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1964	Thread sleep count: 9861 > 30	Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window / User API: threadDelayed 9861

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Thread delayed: delay time: 41226	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBOXDSOFTWARE\VMware, Inc.\VMware Tools
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\6HARDWARE\Description\System"SystemBiosVersion
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMUNSYSTEM\ControlSet001\Services\Disk\Enum
Source: DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: MSBuild.exe, 00000001.00000003.498523950.000000000618A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.525090001.000000000618E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllAA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0156E1A8 LdrInitializeThunk,

1_2_0156E1A8

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_Shippment_Notification_File1_TRK#92992.exe PID: 2088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5504, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5504, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.36747a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Shippment_Notification_File1_TRK#92992.exe.3576988.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_Shippment_Notification_File1_TRK#92992.exe PID: 2088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5504, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	2 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	114 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	13 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL_Shippment_Notification_File1_TRK#92992.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.0.MSBuild.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
smtp.phossphea.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/:	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnp	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.fontbureau.comcom	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.fontbureau.comcoma	0%	URL Reputation	safe
http://www.sajatypeworks.comt	0%	URL Reputation	safe
http://www.sajatypeworks.comTF	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/u	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/=	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/z	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/u	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.zhongyicts.com.cno.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/c	0%	URL Reputation	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.goodfont.co.krFc	0%	Avira URL Cloud	safe
http://www.typography.net:	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/tu	0%	Avira URL Cloud	safe
http://www.carterandcone.comueF	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr.kr	0%	Avira URL Cloud	safe
http://www.sandoll.co.krN.TTFz	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr4	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/s_trh	0%	Avira URL Cloud	safe
http://smtp.phossphea.com	0%	Avira URL Cloud	safe
http://www.fontbureau.comionoz	0%	Avira URL Cloud	safe
https://ZXnohkADwCrkK9XFdZI.com	0%	Avira URL Cloud	safe
http://www.tiro.comNorm	0%	Avira URL Cloud	safe
http://hGabWS.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	false		high
smtp.phossphea.com	unknown	unknown	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	MSBuild.exe, 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.krFc	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://us2.smtp.mailhostbox.com	MSBuild.exe, 00000001.00000002.521960498.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr4	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/s_trh	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255633975.0000000005387000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255692889.0000000005382000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.krN.TTFz	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256375119.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256216319.000000000538E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/:	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.276075299.0000000000597000.00000004.00000020.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.253317969.0000000005384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnp	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255679482.000000000538B000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256071956.0000000005386000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255908003.000000000538E000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255775479.0000000005383000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255842864.000000000538D000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255633975.0000000005387000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comueF	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256375119.000000000538F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.net	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.253381410.0000000005384000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comcom	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.261926018.0000000005387000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.261828021.0000000005386000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.net:	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.253381410.0000000005384000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr.kr	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.254721116.0000000005383000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256152857.0000000005385000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256375119.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256216319.000000000538E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.como.	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256216319.000000000538E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/tu	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://smtp.phossphea.com	MSBuild.exe, 00000001.00000002.521960498.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://DynDns.comDynDNS	MSBuild.exe, 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comcoma	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.275655212.0000000005380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comt	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.252597277.000000000539B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comTF	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.252597277.000000000539B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	MSBuild.exe, 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/F	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/u	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/=	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255679482.000000000538B000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255588553.0000000005385000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255633975.0000000005387000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/z	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://support.mailhostbox.com/email-administrators-guide-error-codes/	MSBuild.exe, 00000001.00000002.522163112.00000000032B4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.522069418.00000000032AC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.521387791.000000000324C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255588553.0000000005385000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/u	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ZXnohkADwCrkK9XFdZI.com	MSBuild.exe, 00000001.00000002.521863996.000000000329E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257020072.000000000538A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comionoz	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.275655212.0000000005380000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cno.	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.256152857.0000000005385000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000002.292348570.0000000006592000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.comNorm	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.255633975.0000000005387000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/c	DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.257916309.000000000538F000.00000004.00000800.00020000.00000000.sdmp, DHL_Shippment_Notification_File1_TRK#92992.exe, 00000000.00000003.258185482.000000000538F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://hGabWS.com	MSBuild.exe, 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	703288
Start date and time:	2022-09-15 09:36:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DHL_Shippment_Notification_File1_TRK#92992.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@3/1@2/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 54 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.50.105.163, 20.31.108.18, 80.67.82.235, 80.67.82.211, 209.197.3.8, 20.199.120.182, 20.234.34.18, 104.214.104.116, 20.199.120.85
Excluded domains from analysis (whitelisted): asf-ris-prod-scus-azsc.southcentralus.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, eudb.ris.api.iris.microsoft.com, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, iris-de-prod-azsc-weu-b.westeurope.cloudapp.azure.com, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu-bg-shim.trafficmanager.net, ris.api.iris.microsoft.com, wns.notify.trafficmanager.net, e16604.g.akamaiedge.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, ris-prod-eudb.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:37:16	API Interceptor	1x Sleep call for process: DHL_Shippment_Notification_File1_TRK#92992.exe modified
09:37:32	API Interceptor	692x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
208.91.198.143	Dynatect Quoting-SP 6048-1.exe	Get hash	malicious	Browse
	yp4Lcb8iNuoakvV.exe	Get hash	malicious	Browse
	78JbpvX5I2.exe	Get hash	malicious	Browse
	26082022Mga detalye ng pagbabayad_PDF.exe	Get hash	malicious	Browse
	RzNYM7YvjV.exe	Get hash	malicious	Browse
	Bank Slip.exe	Get hash	malicious	Browse
	PO.exe	Get hash	malicious	Browse
	TRANSFERENCIA 112987.17.js	Get hash	malicious	Browse
	PO_FRUITILEGBH200220815.exe	Get hash	malicious	Browse
	#U8a62#U50f9 5000649.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.4726.exe	Get hash	malicious	Browse
	Order Inquiry List.exe	Get hash	malicious	Browse
	Payment slip #59221301.exe	Get hash	malicious	Browse
	Document.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Olock.1.1431.exe	Get hash	malicious	Browse
	DOC_6000019430_AUGUST2022.EXE	Get hash	malicious	Browse
	PURCHASE ORDER.exe	Get hash	malicious	Browse
	PAYMENT ADVICE.exe	Get hash	malicious	Browse
	Doc_Requisition Quote_JULY2022.exe	Get hash	malicious	Browse
	pdf.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us2.smtp.mailhostbox.com	Dynatect Quoting-SP 6048-1.exe	Get hash	malicious	Browse	208.91.198.143
	PO080M2022.exe	Get hash	malicious	Browse	208.91.199.223
	GtkmlwjtDuBs57n.exe	Get hash	malicious	Browse	208.91.199.223
	gs3TdJOr4H.exe	Get hash	malicious	Browse	208.91.199.223
	SecuriteInfo.com.Win32.PWSX-gen.7505.exe	Get hash	malicious	Browse	208.91.199.223
	or22fuJ5syXer7N.exe	Get hash	malicious	Browse	208.91.199.225
	SOA Shenzhen H&O International Pdf.exe	Get hash	malicious	Browse	208.91.199.223
	kZBnWfdiFSc3EzW.exe	Get hash	malicious	Browse	208.91.199.225
	PmXNEivvO5NiSJh.exe	Get hash	malicious	Browse	208.91.199.223
	yp4Lcb8iNuoakvV.exe	Get hash	malicious	Browse	208.91.198.143
	DHLTracking_File02092022N289282100000.exe	Get hash	malicious	Browse	208.91.199.223
	SecuriteInfo.com.Trojan.PackedNET.1505.29145.25484.exe	Get hash	malicious	Browse	208.91.199.223
	LGri43t5b5MMet7.exe	Get hash	malicious	Browse	208.91.198.143
	23082022Paymentdetails_PDF.exe	Get hash	malicious	Browse	208.91.199.223
	Curriculum vitae.exe	Get hash	malicious	Browse	208.91.199.225
	Ordem de compra.exe	Get hash	malicious	Browse	208.91.199.225
	RFQ-6066789.exe	Get hash	malicious	Browse	208.91.199.225
	78JbpvX5I2.exe	Get hash	malicious	Browse	208.91.198.143
	CV.exe	Get hash	malicious	Browse	208.91.199.223
	26082022Mga detalye ng pagbabayad_PDF.exe	Get hash	malicious	Browse	208.91.198.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Confirmation transfer Copy MT103 02426.js	Get hash	malicious	Browse	103.53.40.15
	Dynatect Quoting-SP 6048-1.exe	Get hash	malicious	Browse	208.91.198.143
	PAYMENT COPY.exe	Get hash	malicious	Browse	162.215.240.200
	EMss.N1.cSoZ.js	Get hash	malicious	Browse	103.50.163.157
	PO080M2022.exe	Get hash	malicious	Browse	208.91.199.223
	Item List_RFQ 42723.exe	Get hash	malicious	Browse	199.79.62.20
	IMAGESCANDOCUMENTSFILE5656HU.exe	Get hash	malicious	Browse	199.79.62.221
	GtkmlwjtDuBs57n.exe	Get hash	malicious	Browse	208.91.199.223
	Confirmation transfer Copy MT103 00162426.js	Get hash	malicious	Browse	103.53.40.15
	k9FVGvrYfH.exe	Get hash	malicious	Browse	199.79.62.221
	k9FVGvrYfH.exe	Get hash	malicious	Browse	199.79.62.221
	gs3TdJOr4H.exe	Get hash	malicious	Browse	208.91.199.223
	SecuriteInfo.com.Win32.PWSX-gen.7505.exe	Get hash	malicious	Browse	208.91.199.223
	Swift Copy.exe	Get hash	malicious	Browse	103.195.185.115
	Confirmation transfer Copy MT103 Ref-101019906.js	Get hash	malicious	Browse	103.53.40.15
	SOA Shenzhen H&O International Pdf.exe	Get hash	malicious	Browse	208.91.199.223
	kZBnWfdiFSc3EzW.exe	Get hash	malicious	Browse	208.91.199.225
	PmXNEivvO5NiSJh.exe	Get hash	malicious	Browse	208.91.199.223
	yp4Lcb8iNuoakvV.exe	Get hash	malicious	Browse	208.91.198.143
	Proforma Invoice.exe	Get hash	malicious	Browse	103.195.185.115

Process:	C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.345811588615766
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
MD5:	2E016B886BDB8389D2DD0867BE55F87B
SHA1:	25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
SHA-256:	1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
SHA-512:	C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.2345776578337535
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	DHL_Shippment_Notification_File1_TRK#92992.exe
File size:	1113600
MD5:	ae1ece1ab35f950a1822c606a7c31468
SHA1:	a03b8e19d1618de3b01f614fec4e7f2009a8d246
SHA256:	c6dae959f8e5373c6ac8746cfd8227b8d8099b692ee726aacbe18ecf1479282e
SHA512:	ce3a0f0a7d53079431a2d71233bf3dbfa37151d3ebccffd1a63f5521b8bf451e1396fc17b9febc7ffeb156462344a4b657ea12cd799de0341706cb9cb8f1ae97
SSDEEP:	12288:rdgvgZ2hNxedCcbbRZJsP+Jz7P7O77OKJDszIeQUq3MnemCj1XrNYATi+U/L:Z+Uyelbj2Enz4yKVa2cXC5rSCe
TLSH:	4C35F1281666C90AC8AAA574DCD2F2711E685DD1836FC74B08EC3C7BF27738C6D913A5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z.................0.............".... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x511322
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF3BCEC5A [Sat Aug 1 05:19:22 2099 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1112d0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x112000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x114000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1112b4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x10f328	0x10f400	False	0.7842003888248847	data	7.239736670767991	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x112000	0x5d4	0x600	False	0.427734375	data	4.136423920181342	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x114000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x112090	0x344	data
RT_MANIFEST	0x1123e4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3208.91.198.143497565872840032 09/15/22-09:39:04.357043	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49756	587	192.168.2.3	208.91.198.143
192.168.2.3208.91.198.143497565872030171 09/15/22-09:39:04.356923	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49756	587	192.168.2.3	208.91.198.143
192.168.2.3208.91.198.143497565872851779 09/15/22-09:39:04.357043	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49756	587	192.168.2.3	208.91.198.143
192.168.2.3208.91.198.143497565872839723 09/15/22-09:39:04.356923	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49756	587	192.168.2.3	208.91.198.143

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2022 09:37:02.762892008 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.762964964 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.763011932 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.763046026 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.763078928 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.763102055 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.763114929 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.763134003 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.763148069 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.763164043 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.780224085 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780261993 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780287981 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780312061 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780338049 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780360937 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780534983 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780560017 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780584097 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780608892 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780709982 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780756950 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780782938 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780874014 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780961990 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.780997038 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781021118 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781112909 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781138897 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781328917 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781354904 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781436920 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781462908 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781485081 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781779051 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781809092 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781917095 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781943083 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.781965017 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782001972 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782236099 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782264948 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782289028 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782375097 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.782404900 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782432079 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782454967 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782479048 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782608986 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.782638073 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783195019 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783219099 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783241987 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783266068 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783288956 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783313036 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783335924 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:02.783337116 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783431053 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783457041 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783479929 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783503056 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783674002 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783698082 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783723116 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783745050 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783790112 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.783813953 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.830828905 CEST	443	49720	204.79.197.200	192.168.2.3
Sep 15, 2022 09:37:02.831214905 CEST	49720	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:50.769051075 CEST	80	49685	93.184.220.29	192.168.2.3
Sep 15, 2022 09:37:50.772986889 CEST	49685	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:37:52.752085924 CEST	49693	443	192.168.2.3	23.50.106.206
Sep 15, 2022 09:37:52.786793947 CEST	443	49693	23.50.106.206	192.168.2.3
Sep 15, 2022 09:37:52.786825895 CEST	443	49693	23.50.106.206	192.168.2.3
Sep 15, 2022 09:37:52.786901951 CEST	49693	443	192.168.2.3	23.50.106.206
Sep 15, 2022 09:37:52.786959887 CEST	49693	443	192.168.2.3	23.50.106.206
Sep 15, 2022 09:37:52.871049881 CEST	80	49690	93.184.220.29	192.168.2.3
Sep 15, 2022 09:37:52.871154070 CEST	49690	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:37:53.315464973 CEST	49683	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:53.315571070 CEST	49684	443	192.168.2.3	204.79.197.200
Sep 15, 2022 09:37:53.315814972 CEST	49685	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:37:53.331041098 CEST	49689	443	192.168.2.3	23.35.237.194
Sep 15, 2022 09:37:53.331247091 CEST	49690	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:37:53.957889080 CEST	80	49711	178.79.242.0	192.168.2.3
Sep 15, 2022 09:37:53.958055973 CEST	49711	80	192.168.2.3	178.79.242.0
Sep 15, 2022 09:37:53.958085060 CEST	49711	80	192.168.2.3	178.79.242.0
Sep 15, 2022 09:37:53.986481905 CEST	80	49711	178.79.242.0	192.168.2.3
Sep 15, 2022 09:37:54.040400982 CEST	80	49708	93.184.220.29	192.168.2.3
Sep 15, 2022 09:37:54.040591002 CEST	49708	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:37:54.449733019 CEST	49715	443	192.168.2.3	20.199.120.151
Sep 15, 2022 09:37:54.478545904 CEST	443	49715	20.199.120.151	192.168.2.3
Sep 15, 2022 09:37:54.530620098 CEST	49715	443	192.168.2.3	20.199.120.151
Sep 15, 2022 09:37:55.723659992 CEST	80	49714	93.184.220.29	192.168.2.3
Sep 15, 2022 09:37:55.723777056 CEST	49714	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:37:55.733139038 CEST	80	49712	93.184.221.240	192.168.2.3
Sep 15, 2022 09:37:55.733292103 CEST	49712	80	192.168.2.3	93.184.221.240
Sep 15, 2022 09:38:35.904993057 CEST	49714	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:38:35.922214031 CEST	80	49714	93.184.220.29	192.168.2.3
Sep 15, 2022 09:38:35.922348022 CEST	49714	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:38:43.582127094 CEST	49708	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:38:43.582217932 CEST	49712	80	192.168.2.3	93.184.221.240
Sep 15, 2022 09:38:43.599730968 CEST	80	49712	93.184.221.240	192.168.2.3
Sep 15, 2022 09:38:43.599865913 CEST	49712	80	192.168.2.3	93.184.221.240
Sep 15, 2022 09:38:43.601295948 CEST	80	49708	93.184.220.29	192.168.2.3
Sep 15, 2022 09:38:43.601429939 CEST	49708	80	192.168.2.3	93.184.220.29
Sep 15, 2022 09:38:54.453660965 CEST	49715	443	192.168.2.3	20.199.120.151
Sep 15, 2022 09:38:54.481374979 CEST	443	49715	20.199.120.151	192.168.2.3
Sep 15, 2022 09:38:54.535696030 CEST	49715	443	192.168.2.3	20.199.120.151
Sep 15, 2022 09:39:02.855232000 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:03.019243956 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:03.019401073 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:03.335588932 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:03.336009979 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:03.498748064 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:03.498826981 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:03.500922918 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:03.666688919 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:03.667407990 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:03.835633993 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:03.836508989 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:04.001338005 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:04.001666069 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:04.189774036 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:04.190390110 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:04.354229927 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:04.356923103 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:04.357043028 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:04.357719898 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:04.357810974 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:04.519874096 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:04.520318031 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:04.524334908 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:04.534440041 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:04.698221922 CEST	587	49756	208.91.198.143	192.168.2.3
Sep 15, 2022 09:39:04.698324919 CEST	49756	587	192.168.2.3	208.91.198.143
Sep 15, 2022 09:39:07.068054914 CEST	443	49720	204.79.197.200	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2022 09:39:02.417979956 CEST	58691	53	192.168.2.3	8.8.8.8
Sep 15, 2022 09:39:02.614197969 CEST	53	58691	8.8.8.8	192.168.2.3
Sep 15, 2022 09:39:02.631535053 CEST	53305	53	192.168.2.3	8.8.8.8
Sep 15, 2022 09:39:02.835714102 CEST	53	53305	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 15, 2022 09:39:02.417979956 CEST	192.168.2.3	8.8.8.8	0x3c63	Standard query (0)	smtp.phossphea.com	A (IP address)	IN (0x0001)
Sep 15, 2022 09:39:02.631535053 CEST	192.168.2.3	8.8.8.8	0xf9cd	Standard query (0)	smtp.phossphea.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 15, 2022 09:39:02.614197969 CEST	8.8.8.8	192.168.2.3	0x3c63	No error (0)	smtp.phossphea.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2022 09:39:02.614197969 CEST	8.8.8.8	192.168.2.3	0x3c63	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Sep 15, 2022 09:39:02.614197969 CEST	8.8.8.8	192.168.2.3	0x3c63	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Sep 15, 2022 09:39:02.614197969 CEST	8.8.8.8	192.168.2.3	0x3c63	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Sep 15, 2022 09:39:02.614197969 CEST	8.8.8.8	192.168.2.3	0x3c63	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Sep 15, 2022 09:39:02.835714102 CEST	8.8.8.8	192.168.2.3	0xf9cd	No error (0)	smtp.phossphea.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2022 09:39:02.835714102 CEST	8.8.8.8	192.168.2.3	0xf9cd	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Sep 15, 2022 09:39:02.835714102 CEST	8.8.8.8	192.168.2.3	0xf9cd	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Sep 15, 2022 09:39:02.835714102 CEST	8.8.8.8	192.168.2.3	0xf9cd	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Sep 15, 2022 09:39:02.835714102 CEST	8.8.8.8	192.168.2.3	0xf9cd	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 15, 2022 09:39:03.335588932 CEST	587	49756	208.91.198.143	192.168.2.3	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 15, 2022 09:39:03.336009979 CEST	49756	587	192.168.2.3	208.91.198.143	EHLO 536720
Sep 15, 2022 09:39:03.498826981 CEST	587	49756	208.91.198.143	192.168.2.3	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 15, 2022 09:39:03.500922918 CEST	49756	587	192.168.2.3	208.91.198.143	AUTH login bWFyb3Uub3VlcmdoaUBwaG9zc3BoZWEuY29t
Sep 15, 2022 09:39:03.666688919 CEST	587	49756	208.91.198.143	192.168.2.3	334 UGFzc3dvcmQ6
Sep 15, 2022 09:39:03.835633993 CEST	587	49756	208.91.198.143	192.168.2.3	235 2.7.0 Authentication successful
Sep 15, 2022 09:39:03.836508989 CEST	49756	587	192.168.2.3	208.91.198.143	MAIL FROM:<marou.ouerghi@phossphea.com>
Sep 15, 2022 09:39:04.001338005 CEST	587	49756	208.91.198.143	192.168.2.3	250 2.1.0 Ok
Sep 15, 2022 09:39:04.001666069 CEST	49756	587	192.168.2.3	208.91.198.143	RCPT TO:<marou.ouerghi@phossphea.com>
Sep 15, 2022 09:39:04.189774036 CEST	587	49756	208.91.198.143	192.168.2.3	250 2.1.5 Ok
Sep 15, 2022 09:39:04.190390110 CEST	49756	587	192.168.2.3	208.91.198.143	DATA
Sep 15, 2022 09:39:04.354229927 CEST	587	49756	208.91.198.143	192.168.2.3	354 End data with <CR><LF>.<CR><LF>
Sep 15, 2022 09:39:04.357810974 CEST	49756	587	192.168.2.3	208.91.198.143	.
Sep 15, 2022 09:39:04.524334908 CEST	587	49756	208.91.198.143	192.168.2.3	550 5.7.1 This message is rejected by our SPAM filters. Please refer http://support.mailhostbox.com/email-administrators-guide-error-codes/ for more information

Target ID:	0
Start time:	09:37:08
Start date:	15/09/2022
Path:	C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_Shippment_Notification_File1_TRK#92992.exe"
Imagebase:	0x10000
File size:	1113600 bytes
MD5 hash:	AE1ECE1AB35F950A1822C606A7C31468
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.278025439.0000000002582000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000000.00000002.287637852.0000000003531000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	09:37:18
Start date:	15/09/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Imagebase:	0xb60000
File size:	261728 bytes
MD5 hash:	D621FD77BD585874F9686D3A76462EF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000001.00000000.273505808.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AgentTeslaV3, Description: AgentTeslaV3 infostealer payload, Source: 00000001.00000002.518675466.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	93
Total number of Limit Nodes:	8

Executed Functions

Function 0237E680 Relevance: 1.5, Strings: 1, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 0237E689

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 1875e079334b15cc9f836a0862ce4e4029d47873d47a5b74218f26a388faed93
Instruction ID: 1055ee68074e9348f3f3d7ebf2fa00fa31d7cc5d58afc13c73e20c732be15dc4
Opcode Fuzzy Hash: 1875e079334b15cc9f836a0862ce4e4029d47873d47a5b74218f26a388faed93
Instruction Fuzzy Hash: CCC118F1CA17468BE718DF65ECC818D3BB1BB85328F924A0CD1616B6D0D7B8146ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 0237E690 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3d9d2626c3c4c810277b4d07c8b42e40b29683ccbcdbff70ac30b7d8573a23
Instruction ID: ec53515d2aed0c12a704a201bd6716d2f1ffe7457d14b5bcde80c2780b432a0b
Opcode Fuzzy Hash: 2f3d9d2626c3c4c810277b4d07c8b42e40b29683ccbcdbff70ac30b7d8573a23
Instruction Fuzzy Hash: 1A12B3F5CA17468BE318DF65ECD818D3BA1B744328FD24A0CD2612BAD1D7B8156ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 0237B7A0 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0237B810
GetCurrentThread.KERNEL32 ref: 0237B84D
GetCurrentProcess.KERNEL32 ref: 0237B88A
GetCurrentThreadId.KERNEL32 ref: 0237B8E3

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 72e9ff5994d6d15a7e7c46c02cdd789b3d2a1b5c632f16d9e89fe5b54c277127
Instruction ID: c95b8acd84db89240ea7477d9335bfa4fbe2e693443aea7ef3d3a3b2a11e14ec
Opcode Fuzzy Hash: 72e9ff5994d6d15a7e7c46c02cdd789b3d2a1b5c632f16d9e89fe5b54c277127
Instruction Fuzzy Hash: 505166B4D006899FDB54CFAAD588BEEBBF1EF48318F24846AE009A7350C7745844CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0237B7B0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0237B810
GetCurrentThread.KERNEL32 ref: 0237B84D
GetCurrentProcess.KERNEL32 ref: 0237B88A
GetCurrentThreadId.KERNEL32 ref: 0237B8E3

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8e598c76ca5a589ed82274dde1c607b9aa94bd3353ae7e7b5e3d307e3709b5f4
Instruction ID: 9c95d3230d77c237be1152028b6d6b57d4a87b8f0616111a6f334db95b5a0e01
Opcode Fuzzy Hash: 8e598c76ca5a589ed82274dde1c607b9aa94bd3353ae7e7b5e3d307e3709b5f4
Instruction Fuzzy Hash: 8E5165B4D002899FDB54CFAAD588BEEFBF1AF48318F24846AE019A7350D7785844CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0237FE0C Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0237FF2A

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 03f8c585541f14726b50f0a55d5c4e70e33a8d3f8cc95d460fb6322410f668f7
Instruction ID: 5282d9e64433bc95a4be9ea2600977d2ac9969ed588aa1a322ea2e5a90b6a54f
Opcode Fuzzy Hash: 03f8c585541f14726b50f0a55d5c4e70e33a8d3f8cc95d460fb6322410f668f7
Instruction Fuzzy Hash: 8951C0B1D003499FDF14CFA9D884ADEBBB5FF89314F24812AE819AB610D7749946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0237FE18 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0237FF2A

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b4b1bd24f51e53deb997f7233bd08b0b731375ffc23e35da0d4dc69a0667ca8e
Instruction ID: 7450ce4bc0ab6436b41fb04963ac64165c4347473f465b347e14d686b3fd2014
Opcode Fuzzy Hash: b4b1bd24f51e53deb997f7233bd08b0b731375ffc23e35da0d4dc69a0667ca8e
Instruction Fuzzy Hash: CF41B0B1D003499FDF14CFA9D884ADEFBB5BF48314F24812AE419AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02373DE8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02375421

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5966fb6de9ee46fcf6f0bf5a2696a4d40089478f634ac0134eba9bdc922e3de4
Instruction ID: 0d3f945470ca32ed7af11b819fbb516a61ebe6b4beb905f48605be6e9429fd13
Opcode Fuzzy Hash: 5966fb6de9ee46fcf6f0bf5a2696a4d40089478f634ac0134eba9bdc922e3de4
Instruction Fuzzy Hash: 794115B0D04218CFEF24CFA9C84478EBBB5BF88305F61806AD409BB251DBB95945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0237536E Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02375421

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a64d98bd6560d7e3b1571f026447fc3a075e81dfebffe8b7270a995893766e89
Instruction ID: ea84cc55cfbe333d0bf792151e30aa2187923540547a5c9f87c87af77a46d2df
Opcode Fuzzy Hash: a64d98bd6560d7e3b1571f026447fc3a075e81dfebffe8b7270a995893766e89
Instruction Fuzzy Hash: DA4115B0D00218CEEF24CFA9C8847CEBBB5BF88305F65806AD409BB251DBB51946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0237B9D2 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0237BA5F

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 37fb68691e40e33dfbb6f17b8208c7eb6696f5e2e1975280843816306ddf7fba
Instruction ID: 462ad3eb1dc003e838d9b138e7d3e64413ff593c5506035c72f71e6711c2d78b
Opcode Fuzzy Hash: 37fb68691e40e33dfbb6f17b8208c7eb6696f5e2e1975280843816306ddf7fba
Instruction Fuzzy Hash: E821E3B5900249AFDB10CFA9D984BEEBFF4EB48324F14806AE954A3210C378A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0237B9D8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0237BA5F

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6f07935e0c52a5c989b7145be7195117a5bf516e42830d3ae375a6beb317ee6b
Instruction ID: 7136a5185766d69179b9ed104de96429541abf1f0d569412f6137bf9d06e4e1d
Opcode Fuzzy Hash: 6f07935e0c52a5c989b7145be7195117a5bf516e42830d3ae375a6beb317ee6b
Instruction Fuzzy Hash: BA21C4B5900249AFDB10CFA9D984BDEFBF9FB48324F14841AE954A3310D378A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02379598 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02379A71,00000800,00000000,00000000), ref: 02379C82

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c00cdfcfa5e23a06a334d968206f4a798ce0ec5370b25d5dce4787d36e04e68e
Instruction ID: 888a21478cc99ac89018122a43a848313e1a8bd08027f07f905fe1dfc5d62855
Opcode Fuzzy Hash: c00cdfcfa5e23a06a334d968206f4a798ce0ec5370b25d5dce4787d36e04e68e
Instruction Fuzzy Hash: CF1103B6904249DFDF20CF9AC544BDEFBF8EB88324F14852AE415A7600C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02379C10 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02379A71,00000800,00000000,00000000), ref: 02379C82

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6346b26c9a2979b726375bca61c9b917dc68c2c00ed78beddaca0138d39c18a6
Instruction ID: f25be387da39a640bd10b0d6c1f8230578a60fedda030132b2565531b8a8652e
Opcode Fuzzy Hash: 6346b26c9a2979b726375bca61c9b917dc68c2c00ed78beddaca0138d39c18a6
Instruction Fuzzy Hash: 891103B69002498FDF20CFAAD584BDEFBF4AB88324F14856AD459A7200C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0237998A Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 023799F6

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f63b30a662b42cd1b4b85fa0f9447bdf7c2c964a5d1bde92acee2dad7f29afe8
Instruction ID: 10fad87242dd153a5cec8d33ec385d3bd8c67e89b959f6c350b783258627f800
Opcode Fuzzy Hash: f63b30a662b42cd1b4b85fa0f9447bdf7c2c964a5d1bde92acee2dad7f29afe8
Instruction Fuzzy Hash: 371134B5D006498FDB10CF9AC444BDEFBF4EF49224F14812AD859B7210C378A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02379990 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 023799F6

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a046bbe8ee2a3ae461733911f9c49af1d41b93d259207e41905d7064bb0d81a8
Instruction ID: 9cf24a9650f5f0945aeca7ea38092e67937e37ee66d6f4cfdfea2c783c0e0fd7
Opcode Fuzzy Hash: a046bbe8ee2a3ae461733911f9c49af1d41b93d259207e41905d7064bb0d81a8
Instruction Fuzzy Hash: 5D1110B5C006498FDB20CF9AC484BDEFBF4AF89224F14852AD469B7600C378A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0237C244 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.276913495.0000000002370000.00000040.00000800.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_DHL_Shippment_Notification_File1_TRK#92992.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4cf9d981b1936d215680c39c4bf578260f37d07dc160db3019075e2f0e7b90
Instruction ID: c62338ef44964b817224e9827bc0720953b658fce4866853ab451d67d3815a2e
Opcode Fuzzy Hash: 1e4cf9d981b1936d215680c39c4bf578260f37d07dc160db3019075e2f0e7b90
Instruction Fuzzy Hash: E8A15C32E1021ACFCF25DFA5C84499EB7F2FF89304B15856AE805BB261EB35A955CF40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 5504, Parent PID: 2088COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3%
Total number of Nodes:	233
Total number of Limit Nodes:	31

Executed Functions

Function 015673D8 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1457COMMON

Download Yara Rule

Strings

V, xrefs: 01567425

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 61b9444c0988824b3ca211fa908bbaa76f04f3a3a379d209dabb0ebae0ac2050
Instruction ID: e2b2f5397468b2a016873940ab92eb9c72f115f40f5559d22cefbb351cd14d1d
Opcode Fuzzy Hash: 61b9444c0988824b3ca211fa908bbaa76f04f3a3a379d209dabb0ebae0ac2050
Instruction Fuzzy Hash: 60C2DF30B043418FDB56DB78D858A6EBBF6AF85304F1980AAD409DB396DB38DC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01569EA0 Relevance: 1.9, APIs: 1, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStructW.KERNEL32 ref: 01569F29

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: b52b537311f284bb98c788ab48da6186de2416843c93e7080e9f62f5a6716f69
Instruction ID: 96b6ae5bbba9de1438102c230a9dd09839bd0fd8d53369c8954b49e3a1d16a85
Opcode Fuzzy Hash: b52b537311f284bb98c788ab48da6186de2416843c93e7080e9f62f5a6716f69
Instruction Fuzzy Hash: 1DE1A030B042159FE728EB78885476EBAEBAFC5348F15C528D12AEF384DF759C418791

Uniqueness

Uniqueness Score: -1.00%

Function 01569718 Relevance: 1.9, APIs: 1, Instructions: 398
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01569A7F

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 48591dcebc6e5ab87c71d4e6ad5d1f3b5d567f1d1fbe8caab46faf0b04bfd734
Instruction ID: e502f18247dbc5589ac11bc4e4a33104cc3314ab25d2af632d672464239f4565
Opcode Fuzzy Hash: 48591dcebc6e5ab87c71d4e6ad5d1f3b5d567f1d1fbe8caab46faf0b04bfd734
Instruction Fuzzy Hash: E6D1D131A042058FDB25DB78C8846AEB7BAFF85308F148969D505DF396EB38D841C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0157B618 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.518031450.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6dd31f1940cc2af7c153660f146c9c5f03d8ddf7037afb0a4a5316657c3325
Instruction ID: 03774545dac53d05b9d5a373d72de6ef61e26cf345316855f4003b1c875d1fdb
Opcode Fuzzy Hash: 2a6dd31f1940cc2af7c153660f146c9c5f03d8ddf7037afb0a4a5316657c3325
Instruction Fuzzy Hash: 74F15C30A00209CFDB14DFA9D849BADBBF1FF88314F158569E519AF2A5DB70A945CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0156E1A8 Relevance: 1.7, APIs: 1, Instructions: 209libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0156E239

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3ce55bbcf385e84a296768b868b05a5a622db424ea0d7c4e6d4adc4d7a3a9570
Instruction ID: 4a16ca5e1d78d540f7ce250e3a8fc0ee95b72a7b8c55a72c208d58ce0420d019
Opcode Fuzzy Hash: 3ce55bbcf385e84a296768b868b05a5a622db424ea0d7c4e6d4adc4d7a3a9570
Instruction Fuzzy Hash: EE717834A01306DFDB14EBB8D55ABAE7BB6FF84305F108829E411AB394DF389845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0136691F Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013669A0
GetCurrentThread.KERNEL32 ref: 013669DD
GetCurrentProcess.KERNEL32 ref: 01366A1A
GetCurrentThreadId.KERNEL32 ref: 01366A73

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ccd0b5d7d134add11015f3223b95da41d0ae94fdbba9f33828baeda9112aa475
Instruction ID: e0e2ce12fe3b2b3ce0b49df27b374a3821abe16cb574f2181acd86a7df0da598
Opcode Fuzzy Hash: ccd0b5d7d134add11015f3223b95da41d0ae94fdbba9f33828baeda9112aa475
Instruction Fuzzy Hash: 0A5177B4900289DFEB04CFAAD549BDEBFF4EF88318F24846AE549A7350DB745844CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01366940 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013669A0
GetCurrentThread.KERNEL32 ref: 013669DD
GetCurrentProcess.KERNEL32 ref: 01366A1A
GetCurrentThreadId.KERNEL32 ref: 01366A73

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: feff3bbed0dac145667001a595e31c5ebbdc060f53d681cab4dfea011c896534
Instruction ID: 0f14c8c5fa83d59914d28d0254d5af751e8aa24b06aa495a8a3802ea350169cb
Opcode Fuzzy Hash: feff3bbed0dac145667001a595e31c5ebbdc060f53d681cab4dfea011c896534
Instruction Fuzzy Hash: 5A5153B4900249CFEB14CFAAC549BDEBFF4EF88318F24846AE559A7350DB746844CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0156DEF8 Relevance: 3.2, APIs: 2, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStructW.KERNEL32 ref: 0156E110
GetPrivateProfileStructW.KERNEL32 ref: 0156E14E

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: d94d52d8b641e7ccc07e1ab8ed5dba471a77338d4e5911b85a8ad45c7d678d0d
Instruction ID: 2a100e66606ebe362105bc88f39bb47716690fd4075377c6fbb4c99a38d4ce54
Opcode Fuzzy Hash: d94d52d8b641e7ccc07e1ab8ed5dba471a77338d4e5911b85a8ad45c7d678d0d
Instruction Fuzzy Hash: 9271C030B093458FD3429778D8556AA3BF5AB86700F0680B7E548DF3A7EB28DC06C792

Uniqueness

Uniqueness Score: -1.00%

Function 01569C10 Relevance: 3.1, APIs: 2, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStructW.KERNEL32 ref: 01569CE8
GetPrivateProfileStructW.KERNEL32 ref: 01569D26

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: f96f756b5b34fe575c8851ae66a1083bab8dd6c229d10eefcd0e44de36d94f5c
Instruction ID: e1c2c588429b325fd3bb578918a8b6d16686188e8f7f4f579d2d8d30a7305f76
Opcode Fuzzy Hash: f96f756b5b34fe575c8851ae66a1083bab8dd6c229d10eefcd0e44de36d94f5c
Instruction Fuzzy Hash: 12310670B043098FCB55EB78C8556AE77F5AF84248B1184BAD208DB366EB34CC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0156AEE8 Relevance: 3.1, APIs: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStructW.KERNEL32 ref: 0156AFC8
GetPrivateProfileStructW.KERNEL32 ref: 0156B006

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: d3c9925b45f644619d0de0c69879a5c2fef03f3c9f0a3c5c3c64f8abf600e0b2
Instruction ID: 9f3b84ef13a4f9b0e044bf0b8822b05796e6e4f162088e62b837a18df4dea078
Opcode Fuzzy Hash: d3c9925b45f644619d0de0c69879a5c2fef03f3c9f0a3c5c3c64f8abf600e0b2
Instruction Fuzzy Hash: C031D674B002099FCB54EBB8C8516AEB7F6FFC4254B108469D61AEB355EF349C028BD2

Uniqueness

Uniqueness Score: -1.00%

Function 01569D80 Relevance: 3.1, APIs: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStructW.KERNEL32 ref: 01569E08
GetPrivateProfileStructW.KERNEL32 ref: 01569E46

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: d32fb1fca98e41b35e2bcc790040bd0547a61bf288ee5d96e3c434a0df27031a
Instruction ID: b8b7e7a009d08e1f7d409034c13949a9b148bcfe004905546faa1a1b8f330b44
Opcode Fuzzy Hash: d32fb1fca98e41b35e2bcc790040bd0547a61bf288ee5d96e3c434a0df27031a
Instruction Fuzzy Hash: 8821B570B042498FCB41EB7CC815ABF77F5AF89248B1484B6D608DB356EB34DC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 015672F8 Relevance: 3.1, APIs: 2, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStructW.KERNEL32 ref: 01567340
GetPrivateProfileStructW.KERNEL32 ref: 0156737E

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: bf1b06f37e4e33300da80360d58b9560591b0102321e2be522912042e86014d4
Instruction ID: 374bd431bd5d54337a984a6aa2d1f1ff4feda2ee18ce661b5c02d011c2b89f2b
Opcode Fuzzy Hash: bf1b06f37e4e33300da80360d58b9560591b0102321e2be522912042e86014d4
Instruction Fuzzy Hash: 5611D075F002188F8F40EFB8D845AAEB7F5FF88254700846AD619E7355EB3499028B91

Uniqueness

Uniqueness Score: -1.00%

Function 01567308 Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStructW.KERNEL32 ref: 01567340
GetPrivateProfileStructW.KERNEL32 ref: 0156737E

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: 8fa4b7eb732d64eece5cd9e17c7c309d5dbf6814986b1bc735e192e5e6812190
Instruction ID: 6c1ece5f33456f3d52357823149738c0dd98eb90583c248a3f1b454415b5efb7
Opcode Fuzzy Hash: 8fa4b7eb732d64eece5cd9e17c7c309d5dbf6814986b1bc735e192e5e6812190
Instruction Fuzzy Hash: 64118E70F002198F8F40EBB8C855AAEB7F6FF882907008469D619E7354EF349D028B91

Uniqueness

Uniqueness Score: -1.00%

Function 0156AF90 Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStructW.KERNEL32 ref: 0156AFC8
GetPrivateProfileStructW.KERNEL32 ref: 0156B006

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: b35102aee557b548b29b1200a786c760f8667ee6a193457928485d7cb4fd1670
Instruction ID: be7549d5349beb80596915ac12ac91a0e70d210253530e9b596ab6932b7a44fe
Opcode Fuzzy Hash: b35102aee557b548b29b1200a786c760f8667ee6a193457928485d7cb4fd1670
Instruction Fuzzy Hash: C7115E71F0021D8F8B44EBB8D855AAEB7F5FF882507108469D619E7354EF349D028B91

Uniqueness

Uniqueness Score: -1.00%

Function 01363D50 Relevance: 1.8, APIs: 1, Instructions: 293COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01364116

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4d90cf468932dc53e3fe7d6db94dc906920325b0fc8e87b069266c8de4a96a29
Instruction ID: 8261d3bc0b438a1e7b6e4511de438891dbccac559a813f6164b8ddb259825c0c
Opcode Fuzzy Hash: 4d90cf468932dc53e3fe7d6db94dc906920325b0fc8e87b069266c8de4a96a29
Instruction Fuzzy Hash: E3B19C74B007068FDB08EF79C48466EBBF6FF88208B108A2DD55ADB755DB34E8158B90

Uniqueness

Uniqueness Score: -1.00%

Function 0156EDB8 Relevance: 1.7, APIs: 1, Instructions: 227COMMON

Download Yara Rule

APIs

DosPathToSessionPathW.KERNEL32 ref: 0156EEC4

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: Path$Session
String ID:
API String ID: 826575967-0
Opcode ID: 1bde9f2d472d1f3971ff1273e7641cb5eb03e8db21561dd56fabd7135ddb437e
Instruction ID: ed69e61aa783c1883a20b19d52ff1d9b721344546dc40ee4c18a043a55672b4e
Opcode Fuzzy Hash: 1bde9f2d472d1f3971ff1273e7641cb5eb03e8db21561dd56fabd7135ddb437e
Instruction Fuzzy Hash: 1471F834B050098FFF35AABCD45476E75AEE788344F10843AE10ACB786CE28CC5087E2

Uniqueness

Uniqueness Score: -1.00%

Function 0156EDC8 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

DosPathToSessionPathW.KERNEL32 ref: 0156EEC4

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: Path$Session
String ID:
API String ID: 826575967-0
Opcode ID: c8d064842dfc7c5940836d754d7a28a633ba70375313c61cb8cf5e7afb15cf66
Instruction ID: 2deca6282b906f3ae7a60ce2cd7298d3a8f302543e512661c2369550b10d948c
Opcode Fuzzy Hash: c8d064842dfc7c5940836d754d7a28a633ba70375313c61cb8cf5e7afb15cf66
Instruction Fuzzy Hash: 9861B634B010198FFF35AABCD45476E759EE788354F20853AE21ACB785CE69CC5147E2

Uniqueness

Uniqueness Score: -1.00%

Function 01365030 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f0d5c7475bb4ea178b580fd1bb542656a3ce9cc1f238fc558cb62742911fb0
Instruction ID: 59e396835a5b186fe5dd647c13954c2082f8a672b90729059ecadf0006503547
Opcode Fuzzy Hash: 31f0d5c7475bb4ea178b580fd1bb542656a3ce9cc1f238fc558cb62742911fb0
Instruction Fuzzy Hash: 12510FB1C00249EFDF16CFA9C980ADDBFB5BF48354F14816AE908AB220D7759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01365090 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013651A2

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 751c8fededbab009e559379946eaf96e35b87474b837c84feef02927317b5481
Instruction ID: f714c54bc6b722ee348ade675d1701d9c1c61b64beb225ef6878f600879ebe53
Opcode Fuzzy Hash: 751c8fededbab009e559379946eaf96e35b87474b837c84feef02927317b5481
Instruction Fuzzy Hash: 5041CDB1D00249DFDF14CFAAD884ADEBFB5BF88354F24812AE819AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01568A50 Relevance: 1.6, APIs: 1, Instructions: 107registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 01568B54

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 3be244278628a065bf076cdffd613faeb62904b0f131f3c83e1be60e30074a1e
Instruction ID: 94b64bd3797a9ad02f21ab69d8fc074b51d37745b63413badf8f31432ce83994
Opcode Fuzzy Hash: 3be244278628a065bf076cdffd613faeb62904b0f131f3c83e1be60e30074a1e
Instruction Fuzzy Hash: 624123B09003498FDB00CF99C588B9EFBF9BB49314F29C16AE909AB351C7759845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0136779C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01367F01

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4fee006f732c326a83b3e7e420ce3767b2a83ecc4e06b5ad8d197c7f4d3e3cd4
Instruction ID: b9982c9a4648cd94da1553c9a20b771e350471f5a9eefbc53265e80c28388a48
Opcode Fuzzy Hash: 4fee006f732c326a83b3e7e420ce3767b2a83ecc4e06b5ad8d197c7f4d3e3cd4
Instruction Fuzzy Hash: 14414CB5900205CFDB14CF99C448B9ABBF9FF88328F14C459E519AB325D734A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01568CFD Relevance: 1.6, APIs: 1, Instructions: 87registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 01568DC1

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 31c28b451ae9b202f207944269c96490c16a942f7b8cd6c26a8236b1019055ff
Instruction ID: 5b2106c834f9e29d39c487ad21e735c929a9591fdd1c02651175b23727ee7ad8
Opcode Fuzzy Hash: 31c28b451ae9b202f207944269c96490c16a942f7b8cd6c26a8236b1019055ff
Instruction Fuzzy Hash: 6B31EEB1D00259DFDB20CFAAC984A9EBFF5BF48310F15842AE819AB210D7749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01568D08 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 01568DC1

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8b501139bd6785bbcefd1c9c011150c0d44f73e97c8ed7baf453781e03302466
Instruction ID: b7f805b84125c69163f1624dbac9e7ebf912c0a47a6b39a50781c99198e4ec0c
Opcode Fuzzy Hash: 8b501139bd6785bbcefd1c9c011150c0d44f73e97c8ed7baf453781e03302466
Instruction Fuzzy Hash: 8831BEB1D00259DFDB10CF9AD984A9EFFF9BF48310F55842AE819AB210D7749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01366B63 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01366BEF

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 256c573744a838040a25acf40830bb1e2dbd52c6a614d233a4bec30e805e828c
Instruction ID: 0f1308f72a6272fa840b93c8f33a821146e0aebf88c2863df620f47978376ea7
Opcode Fuzzy Hash: 256c573744a838040a25acf40830bb1e2dbd52c6a614d233a4bec30e805e828c
Instruction Fuzzy Hash: 7021E4B5900248EFDB10CF9AD984BDEBFF8EB48324F14842AE955A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01366B68 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01366BEF

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b95720f19559d6f5ed848b39af832d5af77401de3cee8c8da5a0b6443128f733
Instruction ID: 7adbe1d28ea59b5c4c2792a6e065e48c1e4ec7379d327553a03e05c852eba36d
Opcode Fuzzy Hash: b95720f19559d6f5ed848b39af832d5af77401de3cee8c8da5a0b6443128f733
Instruction Fuzzy Hash: 9121C4B5900249DFDB10CF9AD584ADEBFF8EB48324F14842AE955A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0136BE69 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0136BEF2

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d0b0050302e44eead6dd2c2d15b739c77245abb780db84803e6467d38966af6e
Instruction ID: 52a53383de37514b4ad460b2e7d188ceefd919058989be749caa732b7fdc7493
Opcode Fuzzy Hash: d0b0050302e44eead6dd2c2d15b739c77245abb780db84803e6467d38966af6e
Instruction Fuzzy Hash: 56219DB690434A8FDB10DFA9D5493DEBFF8EB08328F14842AE449E7645C7395544CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01576744 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,00000000,?,01577999,00000800), ref: 01577A2A

Memory Dump Source

Source File: 00000001.00000002.518031450.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1570000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bd972776f69a45620e08b014afc4ac35046c34100a532e4b721ef3fe44490b0b
Instruction ID: 7b217f0f7b9b9b87f984f20352efeb86d5cb0638cda90fd5a6a70e8287b88b22
Opcode Fuzzy Hash: bd972776f69a45620e08b014afc4ac35046c34100a532e4b721ef3fe44490b0b
Instruction Fuzzy Hash: E01106B59002499FDB10DF9AE448BDEBBF4EB88310F04842EE515A7200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0136BE78 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0136BEF2

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 96a1949882e51c81ddc8144a6b0c7e52437b0f5d0817650cfb3db0c679125832
Instruction ID: 09becf2f565b5aa216153127f30fb055996dcf4c3471f4ea13ebe6420d91f47f
Opcode Fuzzy Hash: 96a1949882e51c81ddc8144a6b0c7e52437b0f5d0817650cfb3db0c679125832
Instruction Fuzzy Hash: C3116AB1A003498FDB10DFAAD54979EBFF8EB48328F148429E449E7645C739A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015779B9 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,00000000,?,01577999,00000800), ref: 01577A2A

Memory Dump Source

Source File: 00000001.00000002.518031450.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1570000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7d5a893d5d3cdd22dfc07049ddedbc16bb4634a51f330a3c3a85216a0eb548f7
Instruction ID: 1b4ef85ea428bad20e18416c315b27531a7053c7e1f74678286cd2f9098f5c03
Opcode Fuzzy Hash: 7d5a893d5d3cdd22dfc07049ddedbc16bb4634a51f330a3c3a85216a0eb548f7
Instruction Fuzzy Hash: 6F1106B69002499FDB10CFAAE444BDEFFF4AB88314F14856ED456A7200C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01364080 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01364116

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c4b080cd6ea807835a16dda1f3edc7681001d779c924a346c00052efcd9aa417
Instruction ID: fedc264981a694109e7fefad266aa21ab233f783a3c8eb8d6e6a46760883db2a
Opcode Fuzzy Hash: c4b080cd6ea807835a16dda1f3edc7681001d779c924a346c00052efcd9aa417
Instruction Fuzzy Hash: BB11EEB6D006498BDB14CF9AC44478EFBF4EF88228F24C56AC459A7214D339A5468FA5

Uniqueness

Uniqueness Score: -1.00%

Function 01363300 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01364116

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 110addf330567c346b4829a45ad673db848e2967eaf25bea34ab3d59cf1c12cd
Instruction ID: 44d03960304ebe7983eaa41dc79ddde4367dfa2e6b1f8547d6f84a6ab107a147
Opcode Fuzzy Hash: 110addf330567c346b4829a45ad673db848e2967eaf25bea34ab3d59cf1c12cd
Instruction Fuzzy Hash: F21132B5D00649CFDB10DF9AD444BDEFBF8EB89224F00802AD829B7200C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013640AB Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01364116

Memory Dump Source

Source File: 00000001.00000002.517755778.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1360000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bcd8c51237819bff4dc9efe60cedf38ca47d4897ccfe06250f1a21cff41e032d
Instruction ID: 16f261cf0711c2c43ab17951428530cbeb9d84c089ab8846449c7ba53e9caacb
Opcode Fuzzy Hash: bcd8c51237819bff4dc9efe60cedf38ca47d4897ccfe06250f1a21cff41e032d
Instruction Fuzzy Hash: CF1113B6D006498FDB10CF9AC444BDEFBF8EF88224F15842AD859B7200C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157B3F8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0157B455

Memory Dump Source

Source File: 00000001.00000002.518031450.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1570000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 00a6e52c80cea79b046094f2b0a8bef9ef30e3870ba38159ce4ac7239b2eeef4
Instruction ID: 7b483af11f2a16f62db85ef0c404bda02264422ea803437d934e8058284701c6
Opcode Fuzzy Hash: 00a6e52c80cea79b046094f2b0a8bef9ef30e3870ba38159ce4ac7239b2eeef4
Instruction Fuzzy Hash: D11145B1900689CFDB10CF99D445BCEBBF4AF48324F14841AE519A7600C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157A540 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0157B455

Memory Dump Source

Source File: 00000001.00000002.518031450.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1570000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2382ffe9b54fcc01d9bdb47a2c3f1db154293d4ebe7ef7822ef2bb22deb88920
Instruction ID: 42c02dbac83b34cac6439db4c61ed88d1e8d409d516001f6f780aff4a9760800
Opcode Fuzzy Hash: 2382ffe9b54fcc01d9bdb47a2c3f1db154293d4ebe7ef7822ef2bb22deb88920
Instruction Fuzzy Hash: 2B1145B0800648CFDB10DF9AD449BDEBBF8EB48324F108469E519A7300C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01569D0F Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetPrivateProfileStructW.KERNEL32 ref: 01569D26

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: 7f05ab23d7a3be7383e4594f4233504ae53ca43a4b2c9dc5b11b3d888c86da12
Instruction ID: 8ca92c399b8361eb42e2d4dcebba4f8ab9d74e99dd572b18c38b22b2730e81f7
Opcode Fuzzy Hash: 7f05ab23d7a3be7383e4594f4233504ae53ca43a4b2c9dc5b11b3d888c86da12
Instruction Fuzzy Hash: 55E06D35B0001D8B8F04EBB8D8465ADB3F1BFC8254B014061E60AE7365EE389C018790

Uniqueness

Uniqueness Score: -1.00%

Function 0156E137 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetPrivateProfileStructW.KERNEL32 ref: 0156E14E

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: 75abee5d66a9795d3f4a24937ece9aa8aa442a29e5258bbb648c336300d99947
Instruction ID: e06ac71f617c2ef4339479dbf9bba44a1f3bdf8cc5e47612268c9791bd0913e3
Opcode Fuzzy Hash: 75abee5d66a9795d3f4a24937ece9aa8aa442a29e5258bbb648c336300d99947
Instruction Fuzzy Hash: 90E0ED36B0011D8B8F45FBB8D8559EEB3F1FFC8250B018465E61AE7365EE389C019B91

Uniqueness

Uniqueness Score: -1.00%

Function 01567367 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetPrivateProfileStructW.KERNEL32 ref: 0156737E

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: 672a1c1518d4e1e963b9361480efbe6bc0068aca995d1271416de33375707671
Instruction ID: 09c228d5ac01badc0d9e5a5a93e413b65e2d2edd7d85bc34e9d9e0ed063a6ab1
Opcode Fuzzy Hash: 672a1c1518d4e1e963b9361480efbe6bc0068aca995d1271416de33375707671
Instruction Fuzzy Hash: 7DE01235B0011D8B8F44FBB8D8559EDB3F1BFC86547018465EA1AE7365EF389C0297A1

Uniqueness

Uniqueness Score: -1.00%

Function 0156AFEF Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetPrivateProfileStructW.KERNEL32 ref: 0156B006

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: 3ecd534a216c327a797ed40119aa425220deeb5338b7fe5c0ae647cf5e23881b
Instruction ID: f26cd20f05b997f7820f2459422569def9288e7afd23baf25cbc1e9ced95fc85
Opcode Fuzzy Hash: 3ecd534a216c327a797ed40119aa425220deeb5338b7fe5c0ae647cf5e23881b
Instruction Fuzzy Hash: 25E06D35B0011C8B8F04EBB8D8459AEB3F1BFC82607014065E61AE7365EE389C018761

Uniqueness

Uniqueness Score: -1.00%

Function 01569E2F Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetPrivateProfileStructW.KERNEL32 ref: 01569E46

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: c5fbedbe4cb7151e421e9f8af770fec8bf0272e1f1d9168eec949412b37095f1
Instruction ID: 52be00e532815011a1f6f27dc52e7142b82872a641b96b455d05f4c57c07cfd0
Opcode Fuzzy Hash: c5fbedbe4cb7151e421e9f8af770fec8bf0272e1f1d9168eec949412b37095f1
Instruction Fuzzy Hash: FAE0ED35B0011D8F8F44EBB8D8555EDB3F1BFC8254B018465E61AE7365EE389C019B91

Uniqueness

Uniqueness Score: -1.00%

Function 015686CF Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetPrivateProfileStructW.KERNEL32 ref: 015686E6

Memory Dump Source

Source File: 00000001.00000002.517956285.0000000001560000.00000040.00000800.00020000.00000000.sdmp, Offset: 01560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1560000_MSBuild.jbxd

Similarity

API ID: PrivateProfileStruct
String ID:
API String ID: 1702260739-0
Opcode ID: 71d06848edd705db322fe15a913afbe6eec60714070102fe4dd0a0862f6d5317
Instruction ID: 7c18254cc8403483f64ea49dca1cb7da5c68be21df883d243b4692ac1d339072
Opcode Fuzzy Hash: 71d06848edd705db322fe15a913afbe6eec60714070102fe4dd0a0862f6d5317
Instruction Fuzzy Hash: 66E06D35B0011C8B8F04EBB8D8559ADB3F1BFC82507014065E60AE7365EE289C028790

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL_Shippment_Notification_File1_TRK#92992.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_Shippment_Notification_File1_TRK#92992.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Windows Analysis Report
DHL_Shippment_Notification_File1_TRK#92992.exe

Function 0237E680 Relevance: 1.5, Strings: 1, Instructions: 224
COMMON

Function 0237B7A0 Relevance: 6.1, APIs: 4, Instructions: 126
threadCOMMON

Function 0237B7B0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 0237FE0C Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Function 0237FE18 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 02373DE8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0237536E Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 0237B9D2 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 0237B9D8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 02379598 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 02379C10 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 0237998A Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 02379990 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 01569EA0 Relevance: 1.9, APIs: 1, Instructions: 419
COMMON

Function 01569718 Relevance: 1.9, APIs: 1, Instructions: 398
libraryCOMMON

Function 0157B618 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Function 0136691F Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 01366940 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 0156DEF8 Relevance: 3.2, APIs: 2, Instructions: 222
COMMON

Function 01569C10 Relevance: 3.1, APIs: 2, Instructions: 108
COMMON

Function 0156AEE8 Relevance: 3.1, APIs: 2, Instructions: 98
COMMON

Function 01569D80 Relevance: 3.1, APIs: 2, Instructions: 78
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre