Edit tour

Windows Analysis Report
MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Overview

General Information

Sample name:	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Analysis ID:	1559050
MD5:	296a91d852273bd8f8ea784f814e8e54
SHA1:	47a5391f798e645c075a074a7cddfab468e449d5
SHA256:	bdf6c1caee139afdf9122554e47a2b1f56dd5598447dced5cf81cafac1dfb7a0
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Enables debug privileges

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe (PID: 7360 cmdline: "C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe" MD5: 296A91D852273BD8F8EA784F814E8E54)

MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe (PID: 7540 cmdline: "C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe" MD5: 296A91D852273BD8F8EA784F814E8E54)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://cash4cars.nz", "Username": "logbox@cash4cars.nz", "Password": "-[([pqM~nGA4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3390398449.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7360	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7360	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7540	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7540	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe.7360.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://cash4cars.nz", "Username": "logbox@cash4cars.nz", "Password": "-[([pqM~nGA4"}

Multi AV Scanner detection for submitted file

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	ReversingLabs: Detection: 42%
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Virustotal: Detection: 63%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Joe Sandbox ML: detected

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: RkOo.pdb source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source:	Binary string: RkOo.pdbSHA256mu source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3390398449.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	String found in binary or memory: http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp, MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp, MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3390398449.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3390398449.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3390398449.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2153174691.000000000105E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2170699029.0000000008E80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000000.2140819310.0000000000B26000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRkOo.exeP vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2155139447.0000000002F15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4d50e2f7-163c-49a2-bbd5-3cf7d6c08520.exe4 vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4d50e2f7-163c-49a2-bbd5-3cf7d6c08520.exe4 vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2155139447.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2168553737.0000000005930000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3389055566.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4d50e2f7-163c-49a2-bbd5-3cf7d6c08520.exe4 vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Binary or memory string: OriginalFilenameRkOo.exeP vs MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe.log

Source: unknown	Process created: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe "C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe"
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process created: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe "C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe"
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process created: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe "C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	File created: \mv busan star - calling to discharge about 55,000mt of aggregates.exe
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	File created: \mv busan star - calling to discharge about 55,000mt of aggregates.exe			Jump to behavior

Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: 14B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: 9000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: A000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: A200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: B200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior

Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3389350831.0000000001206000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz6!
Source: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2170699029.0000000008E80000.00000004.08000000.00040000.00000000.sdmp, MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vxHhgfSvMU

Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: Yara match	File source: 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7540, type: MEMORYSTR

Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Source: Yara match	File source: 00000003.00000002.3390398449.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe PID: 7540, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credentials in Registry	111 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Genie8DN
MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	63%	Virustotal		Browse
MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
https://api.ipify.org	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp, MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3390398449.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://account.dyn.com/	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp, MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3390398449.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe, 00000003.00000002.3390398449.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	false	high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559050
Start date and time:	2024-11-20 05:33:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/1
Cookbook Comments:	Found application associated with file extension: .exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	QuarantineMessage.zip	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://hmjpvx0wn1.gaimensebb.shop/	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	MVV ALIADO - S-REQ-19-00064 40ft 1x20.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Quotation.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DOCS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	1Sj5F6P4nv.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	5LEXIucyEP.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	44qLDKzsfO.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	gP5rh6fa0S.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	spacers.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://cdn-defac21.artcollective-snapclick.com/api/reg/update.json	Get hash	malicious	Unknown	Browse	104.21.78.162
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	need quotations.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://atpscan.global.hornetsecurity.com/?d=zgarMAzqF8gJdiyz7BRUZX8-Kt1RoHrhrMmKtaU9kW8&f=VhLn9tqiibnSyqWDnEopjApZtye8WgAc5bwx7BMFWiKwqjA1EcPjZyfvoQy11klP&i=&k=QQhP&m=0jL9ajZ_jxYnMJb2yb4luNRYQCXy24RTS6RPwUyZoAcuBVX0kzGA69aOJSo0d2htwIsi238bOVH3h3HqrhJGfzTuFk7GTjJWYsgIrocXphf5x2p4nZ7S2EABjAck31fG&n=TU5FjsulXTMv8aeSlx257utLr9bUpfdm0dDB4GNEHfOuhOvtIOr62mZHw3PXGZeG&r=qntyoaxGftDLRu_wopiK2t_EdeZaeg9mP15ZZI-qDen_3s7cQ10pAlhKQQnYAIUX&s=c4a8f5ec353e41b8b414bdcf47b33dd5d6b52b0394e0e4a09cc54527f49761c3&u=https%3A%2F%2Fthe1oomisagency.com%2Fthyu%2F	Get hash	malicious	Unknown	Browse	104.16.123.96
	Employee-SSN.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://estudioit.cl/starl/#ZGVicmEuY2FydGVyQGNhc2EuZ292LmF1	Get hash	malicious	Unknown	Browse	104.17.25.14

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.26.13.205
	https://s.id/sharedocument	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://trackru.top/us	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://www.google.ie/url?q=queryy8px(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$?	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://s.id/nelsi	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://www.google.ie/url?q=querymmjx(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fgrcbea7q6lbvpmruhnx3bojhvb2k6ojxdnvuw/Y3doaXRlQHdvcmxkZHJ5ZXIuY29t$?	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://ledger-checks.s3.us-east-1.amazonaws.com/index.html	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.938345895501036
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
File size:	668'672 bytes
MD5:	296a91d852273bd8f8ea784f814e8e54
SHA1:	47a5391f798e645c075a074a7cddfab468e449d5
SHA256:	bdf6c1caee139afdf9122554e47a2b1f56dd5598447dced5cf81cafac1dfb7a0
SHA512:	0b801c4a4abdff47d84138600eb9db78d68591a12332e2abf00fe0da3b53e51c415a157aae9934bce63ff6ad1c6e7bb8adebcb1bfa12b91f40ec374ce53bd1a6
SSDEEP:	12288:W1Bo7KvAGZ2/IwuiwQ6CTCPuNCgHt1WH/ctA9upSNtira7Xs:W/o703ZQ5pGPuMgCH/9upTrag
TLSH:	13E4125123E88F3BD4388FF04534940123F6B57B7A61E29D6ED361D925BAF100AA1F9B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3<g..............0..(...........G... ...`....@.. ....................................@................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe

Entrypoint:	0x4a479e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673C33A9 [Tue Nov 19 06:43:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa474c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa6000	0x64c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa2650	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa27a4	0xa2800	9e5a60562dfe2b233954ac0b1ecaed58	False	0.9557091346153846	data	7.94671283475243	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa6000	0x64c	0x800	27fbd4222499e7496c057cb29d2b90f5	False	0.341796875	data	3.510783460880617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa8000	0xc	0x200	026f781fd538a269c33e1ea887d4ecbe	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa6090	0x3bc	data			0.4131799163179916
RT_MANIFEST	0xa645c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 05:34:23.953257084 CET	49720	443	192.168.2.5	104.26.13.205
Nov 20, 2024 05:34:23.953356981 CET	443	49720	104.26.13.205	192.168.2.5
Nov 20, 2024 05:34:23.955306053 CET	49720	443	192.168.2.5	104.26.13.205
Nov 20, 2024 05:34:23.996582985 CET	49720	443	192.168.2.5	104.26.13.205
Nov 20, 2024 05:34:23.996644974 CET	443	49720	104.26.13.205	192.168.2.5
Nov 20, 2024 05:34:24.458874941 CET	443	49720	104.26.13.205	192.168.2.5
Nov 20, 2024 05:34:24.459203959 CET	49720	443	192.168.2.5	104.26.13.205
Nov 20, 2024 05:34:24.512362957 CET	49720	443	192.168.2.5	104.26.13.205
Nov 20, 2024 05:34:24.512409925 CET	443	49720	104.26.13.205	192.168.2.5
Nov 20, 2024 05:34:24.512648106 CET	443	49720	104.26.13.205	192.168.2.5
Nov 20, 2024 05:34:24.554033041 CET	49720	443	192.168.2.5	104.26.13.205
Nov 20, 2024 05:34:24.685626984 CET	49720	443	192.168.2.5	104.26.13.205
Nov 20, 2024 05:34:24.731336117 CET	443	49720	104.26.13.205	192.168.2.5
Nov 20, 2024 05:34:24.792761087 CET	443	49720	104.26.13.205	192.168.2.5
Nov 20, 2024 05:34:24.792802095 CET	443	49720	104.26.13.205	192.168.2.5
Nov 20, 2024 05:34:24.792890072 CET	49720	443	192.168.2.5	104.26.13.205
Nov 20, 2024 05:34:24.811419010 CET	49720	443	192.168.2.5	104.26.13.205

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 05:34:23.930491924 CET	52451	53	192.168.2.5	1.1.1.1
Nov 20, 2024 05:34:23.937432051 CET	53	52451	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2024-11-20 04:34:24 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-20 04:34:24 UTC	399	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:34:24 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e55ba389cf68c09-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1921&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1504379&cwnd=240&unsent_bytes=0&cid=2ec5211940d453fb&ts=342&x=0"
2024-11-20 04:34:24 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Target ID:	0
Start time:	23:34:20
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe"
Imagebase:	0xa80000
File size:	668'672 bytes
MD5 hash:	296A91D852273BD8F8EA784F814E8E54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2159660073.0000000003EA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	23:34:22
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe"
Imagebase:	0xaa0000
File size:	668'672 bytes
MD5 hash:	296A91D852273BD8F8EA784F814E8E54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3390398449.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3388849290.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre