Windows Analysis Report AWB & Shipping Documents.exe

Source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "bangerlee@excetek-tw.com", "Password": "^zC)hee7", "Host": "smtp.excetek-tw.com"}

Source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: AWB & Shipping Documents.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: AWB & Shipping Documents.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		0_2_0604CAD0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		0_2_0604DC00

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49770 -> 208.91.199.224:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49771 -> 208.91.198.143:587

Source: global traffic	TCP traffic: 192.168.2.4:49770 -> 208.91.199.224:587
Source: global traffic	TCP traffic: 192.168.2.4:49771 -> 208.91.198.143:587

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 208.91.199.224 208.91.199.224

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: global traffic	TCP traffic: 192.168.2.4:49770 -> 208.91.199.224:587
Source: global traffic	TCP traffic: 192.168.2.4:49771 -> 208.91.198.143:587

Source: unknown

DNS traffic detected: queries for: smtp.excetek-tw.com

Source: AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: http://FOLTKb.com
Source: AWB & Shipping Documents.exe	String found in binary or memory: http://about.me/kanji.keraliya
Source: AWB & Shipping Documents.exe	String found in binary or memory: http://opensource.org/licenses/MS-PL
Source: AWB & Shipping Documents.exe, 00000000.00000002.650879240.0000000002BE1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AWB & Shipping Documents.exe, 00000003.00000002.911960106.0000000002FD5000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.excetek-tw.com
Source: AWB & Shipping Documents.exe	String found in binary or memory: http://totalyinfo.blogspot.com
Source: AWB & Shipping Documents.exe, 00000003.00000002.911960106.0000000002FD5000.00000004.00000001.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://LIfeBYqJBXDazIiLJG1z.net
Source: AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: AWB & Shipping Documents.exe, 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp, AWB & Shipping Documents.exe, 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b840C5944u002d536Au002d424Du002d866Fu002d5DF91DD2EAC7u007d/CEC51AC2u002dAD15u002d4CCFu002d8F33u002d76C6DA01F395.cs

Large array initialization: .cctor: array initializer size 11956

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: AWB & Shipping Documents.exe

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06045B18	0_2_06045B18
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06043728	0_2_06043728
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_0604CF98	0_2_0604CF98
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06046038	0_2_06046038
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06040040	0_2_06040040
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_0604BCB0	0_2_0604BCB0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06049CC8	0_2_06049CC8
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06045215	0_2_06045215
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06048228	0_2_06048228
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06045230	0_2_06045230
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06048238	0_2_06048238
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06043250	0_2_06043250
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06043260	0_2_06043260
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06045B08	0_2_06045B08
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06043718	0_2_06043718
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06044B58	0_2_06044B58
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_0604A380	0_2_0604A380
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06049F89	0_2_06049F89
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_0604A390	0_2_0604A390
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06049F98	0_2_06049F98
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06044BC0	0_2_06044BC0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_0604001D	0_2_0604001D
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_0604602A	0_2_0604602A
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_06049CB9	0_2_06049CB9
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_060434E9	0_2_060434E9
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_060434F8	0_2_060434F8
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_0604A527	0_2_0604A527
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_0604A57F	0_2_0604A57F
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_060429E0	0_2_060429E0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_060429F0	0_2_060429F0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00F948AC	3_2_00F948AC
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00F97CD8	3_2_00F97CD8
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00F9AED0	3_2_00F9AED0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00F92698	3_2_00F92698
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00F9E97A	3_2_00F9E97A
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_02A446A0	3_2_02A446A0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_02A44618	3_2_02A44618

Source: AWB & Shipping Documents.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AWB & Shipping Documents.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AWB & Shipping Documents.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: AWB & Shipping Documents.exe, 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamekRkuPgXeNEtlwWGdCpXprQbncYomawZYHuRpGB.exe4 vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000000.00000002.650989400.0000000002CC3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRelativeFileUrl.dllL vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000000.00000002.650249886.000000000090C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSiteMembershipCondition.exeL vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000000.00000002.651324084.0000000003BE9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSparselyPopulated.dll@ vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000002.00000000.648230019.00000000003DC000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSiteMembershipCondition.exeL vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000003.00000002.908763324.00000000006DC000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSiteMembershipCondition.exeL vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000003.00000002.909560918.0000000000E00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamekRkuPgXeNEtlwWGdCpXprQbncYomawZYHuRpGB.exe4 vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000003.00000002.908841531.0000000000AF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000003.00000002.909691250.0000000000F80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe, 00000003.00000002.909170431.0000000000D0A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs AWB & Shipping Documents.exe
Source: AWB & Shipping Documents.exe	Binary or memory string: OriginalFilenameSiteMembershipCondition.exeL vs AWB & Shipping Documents.exe

Source: AWB & Shipping Documents.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: AWB & Shipping Documents.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/2@4/3

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AWB & Shipping Documents.exe.log

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Mutant created: \Sessions\1\BaseNamedObjects\TaNhYuTL

Source: AWB & Shipping Documents.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: AWB & Shipping Documents.exe	String found in binary or memory: pVr0//add3tV+V5AtRhurnLanvWPbPeffW7yfz8D/qiBcdePe2YuzhnD3iWoNeSN/FvCK+HLUvlfuAlsIMja6Q0vyP31HrazAI1082KIwalbfUFK8effnZCI6mVdbbwhup
Source: AWB & Shipping Documents.exe	String found in binary or memory: pVr0//add3tV+V5AtRhurnLanvWPbPeffW7yfz8D/qiBcdePe2YuzhnD3iWoNeSN/FvCK+HLUvlfuAlsIMja6Q0vyP31HrazAI1082KIwalbfUFK8effnZCI6mVdbbwhup
Source: AWB & Shipping Documents.exe	String found in binary or memory: pVr0//add3tV+V5AtRhurnLanvWPbPeffW7yfz8D/qiBcdePe2YuzhnD3iWoNeSN/FvCK+HLUvlfuAlsIMja6Q0vyP31HrazAI1082KIwalbfUFK8effnZCI6mVdbbwhup
Source: AWB & Shipping Documents.exe	String found in binary or memory: OZ+Pu43aMPVLhAuZG5vPsy6M7RhEPNSN1GdJmfcPguZ/xG9L0ZDeZ0Xtz7xPGoAY/fv2o7cTK65P263C3VGtwaK1YtCjW/Xe2KYesm9Iq9MOgP5+0NhNnzBjqrNchsj55cMQpVr0//add3tV+V5AtRhurnLanvWPbPeffW7yfz8D/qiBcdePe2YuzhnD3iWoNeSN/FvCK+HLUvlfuAlsIMja6Q0vyP31HrazAI1082KIwalbfUFK8effnZCI6mVdbbwhupTyjXbtY8zvpzwehdnNu5QxccHbpwuH5xjzqkt2MevcVv3wl1c5Q2kl7hJE9j3d1xYMq+ddWXtokaXO/Y8/qENc43zzjupp16G7gxDaZdGNYoWr5JUytcbhkwZ+409IlBpeuvN3nOrdrm0ajRhzsPIEx9EaZc01Yw+n6bkGj3qJ3bGbJpz8KmbKo9LeFURqdDp7ut74mXd8J1291+xeq9x/pk3K9Yc/Gm6hP35ffMf2XvNrNZ81FVrh7p8gb96Ma+p9jhZ9s76o1vg+rpv1HhwqLpJ2/HR+5JvPbq1eSllwgj/jlT5Nh/wVcTnVnmo9yJXVUcP+TNSbqohkkSyZw8sF3FEPrSIWPnT587UT9oXJOJm1JrDbfILm0Xep0PuUO2CM6fMW3AVWwxkDYuMsU9ceq0MOaCqbWb+9/XmW4cT618ql6fVvdmPG3T4XiVD1MON8M2PJ29ebytgcjAnEvA7XrlrTpzecOWXe8MTB3a/JDrkHRtJUbjKUmLybmZqaM2/Nnh6vikZo3bSpjGXnN4Jy/ptI71xwvqNayxcEjFTEFz891iXWNVVA7t1vrQgzUaLl4mx2OlO0JnfZQfWd9u2MPhvZYecWAnaue2Krq+Vcpf09a9ZP2Bxd1vjshDzXLufjm8MHGbuU/Vyy2nvPg4rw/KulSZ9mJ3dscBzOMzl3ZePrhlyx61m1xRWI2nk2UjTjVjpGZNaj9ljZd5/I+QFKn5bI4+QouZuoNgS8j9GHefM1g5zHWOZW/WJDSfOmX/pp29fKtuW0cN3ziEe35Ot2W7RvZ/bddnD5jaq9ru6dz690T17FFHNkh37pyMvTBt9LG52pXdKlzJS12NP4Ca1X1hysDDdz+OJD5Rbe4TsdZnE4b32Hx1rnzmcfuUoZ30YQmiBEGP8fH9153MG77FkD61h2Po84U7Rl748LbzLXrP4zkNBmx/dunu3bj7Ffa5yAb7pc5Q79rP9kjelGAXZvev3Td+t3FAB3pG/XojO61pcWXcAWuhd9u9m6JqdxZIDUcO9mmV7xnVvb7lSHXCUaWjg7P6BlMudn4Px+M/mzSobDtwzXtrbscJM/uzeoxuKyGMH3FwZmVnkwZj50V419g2jZ1Js/Xa3vbi5sIB7tzLmU/bd/t4bWTHZ1WxqU+6Xay4/vo/Z70V/TfWmzKw3jaM78KWqeIPVHapyMx6ZxTKsFOCalXkNWsPWrH6onrchbl3GmzkHG7Cu8TKORa/1eU0/VGjBHtm4bq4BZxTsXVG7zSYWfXiKA3Pr/WQyPfW+lrfu8JaOTLpfv6QkKf+2ddKB0x518rxOvfG5jlU24gKaz/0ZieeWDXLE3J364LXkf0/xTA+KG/UXUIdNjWEvgA9xZ1Tq8WIYRNODbwgHrmxfuJDVssLUbwJ6FOHSRPZPh92/r6Lss7JzOk3vIl75/cmavd83BVywd5Wy5z3Ovnyyjonnz7CYuce6HQ+72WBf2wk7pRkawVRpWoVYkpxUm8nC7pjtyEr5UMdzMQzg7akyXYPoRUN6LxvkHzsoNYX66APHT3Oj3CRHmHoXlWT7jTX9gr59wY925jS9PX61AHbTFUSa+PZU93nNo56AI3gjHjQMXrhweaxvf1x4wwR1DetBu88O7q5rNXxLg/7Sw35nTWDGbqBqxe3Tjh5+bfCiSeGHhpaSzZmS+S1awPHbMoYa+c+v2iLHK

Source: unknown	Process created: C:\Users\user\Desktop\AWB & Shipping Documents.exe 'C:\Users\user\Desktop\AWB & Shipping Documents.exe'
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process created: C:\Users\user\Desktop\AWB & Shipping Documents.exe C:\Users\user\Desktop\AWB & Shipping Documents.exe
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process created: C:\Users\user\Desktop\AWB & Shipping Documents.exe C:\Users\user\Desktop\AWB & Shipping Documents.exe
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process created: C:\Users\user\Desktop\AWB & Shipping Documents.exe C:\Users\user\Desktop\AWB & Shipping Documents.exe	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process created: C:\Users\user\Desktop\AWB & Shipping Documents.exe C:\Users\user\Desktop\AWB & Shipping Documents.exe	Jump to behavior

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: AWB & Shipping Documents.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: AWB & Shipping Documents.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_00858AA1 push cs; ret	0_2_00858ADA
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_00858D47 push es; ret	0_2_00858D58
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_00858D41 push es; ret	0_2_00858D46
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_00858D59 push es; ret	0_2_00858D5E
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_00858D77 push es; ret	0_2_00858DA0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 0_2_060465E6 push esi; retf	0_2_060465E7
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 2_2_00328AA1 push cs; ret	2_2_00328ADA
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 2_2_00328D77 push es; ret	2_2_00328DA0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 2_2_00328D59 push es; ret	2_2_00328D5E
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 2_2_00328D41 push es; ret	2_2_00328D46
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 2_2_00328D47 push es; ret	2_2_00328D58
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_3_00DAB7D9 push edx; retf	3_3_00DAB7DE
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_3_00DAB7A0 push ss; retf	3_3_00DAB7C2
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_3_00DAB75F push ss; retf	3_3_00DAB762
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_3_00DAB777 push edx; retf	3_3_00DAB77E
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00628D77 push es; ret	3_2_00628DA0
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00628D41 push es; ret	3_2_00628D46
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00628D47 push es; ret	3_2_00628D58
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00628D59 push es; ret	3_2_00628D5E
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_00628AA1 push cs; ret	3_2_00628ADA
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Code function: 3_2_02A4CD51 push esp; iretd	3_2_02A4CD5D

Source: initial sample

Static PE information: section name: .text entropy: 7.57479829446

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB & Shipping Documents.exe PID: 7124, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Window / User API: threadDelayed 393			Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Window / User API: threadDelayed 9458			Jump to behavior

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe TID: 7128	Thread sleep time: -100632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe TID: 7160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe TID: 6296	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe TID: 6308	Thread sleep count: 393 > 30	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe TID: 6308	Thread sleep count: 9458 > 30	Jump to behavior

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Thread delayed: delay time: 100632	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: AWB & Shipping Documents.exe, 00000003.00000002.909449686.0000000000DC9000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Code function: 3_2_00F92698 LdrInitializeThunk,

3_2_00F92698

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Memory written: C:\Users\user\Desktop\AWB & Shipping Documents.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process created: C:\Users\user\Desktop\AWB & Shipping Documents.exe C:\Users\user\Desktop\AWB & Shipping Documents.exe			Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Process created: C:\Users\user\Desktop\AWB & Shipping Documents.exe C:\Users\user\Desktop\AWB & Shipping Documents.exe			Jump to behavior

Source: AWB & Shipping Documents.exe, 00000003.00000002.910266787.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: AWB & Shipping Documents.exe, 00000003.00000002.910266787.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: AWB & Shipping Documents.exe, 00000003.00000002.910266787.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: AWB & Shipping Documents.exe, 00000003.00000002.910266787.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Users\user\Desktop\AWB & Shipping Documents.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Users\user\Desktop\AWB & Shipping Documents.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected AgentTesla

Source: Yara match	File source: 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.651324084.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.AWB & Shipping Documents.exe.3f09cc8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB & Shipping Documents.exe.3f09cc8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Source: Yara match	File source: 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.651324084.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB & Shipping Documents.exe PID: 5600, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB & Shipping Documents.exe PID: 7124, type: MEMORY
Source: Yara match	File source: 0.2.AWB & Shipping Documents.exe.3f09cc8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB & Shipping Documents.exe.3f09cc8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\AWB & Shipping Documents.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB & Shipping Documents.exe PID: 5600, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Source: Yara match	File source: 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.651324084.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.2.AWB & Shipping Documents.exe.3f09cc8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB & Shipping Documents.exe.3f09cc8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Source: Yara match	File source: 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.651324084.0000000003BE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB & Shipping Documents.exe PID: 5600, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB & Shipping Documents.exe PID: 7124, type: MEMORY
Source: Yara match	File source: 0.2.AWB & Shipping Documents.exe.3f09cc8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB & Shipping Documents.exe.3f09cc8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AWB & Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.AWB & Shipping Documents.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
smtp.excetek-tw.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://FOLTKb.com	0%	Avira URL Cloud	safe
http://smtp.excetek-tw.com	0%	Avira URL Cloud	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://LIfeBYqJBXDazIiLJG1z.net	0%	Avira URL Cloud	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.199.224	true	false		high
smtp.excetek-tw.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://totalyinfo.blogspot.com	AWB & Shipping Documents.exe	false		high
http://us2.smtp.mailhostbox.com	AWB & Shipping Documents.exe, 00000003.00000002.911960106.0000000002FD5000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://FOLTKb.com	AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://smtp.excetek-tw.com	AWB & Shipping Documents.exe, 00000003.00000002.911960106.0000000002FD5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%GETMozilla/5.0	AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://LIfeBYqJBXDazIiLJG1z.net	AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AWB & Shipping Documents.exe, 00000000.00000002.650879240.0000000002BE1000.00000004.00000001.sdmp	false		high
https://api.ipify.org%	AWB & Shipping Documents.exe, 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	AWB & Shipping Documents.exe, 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp, AWB & Shipping Documents.exe, 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	AWB & Shipping Documents.exe, 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp	false		high
http://about.me/kanji.keraliya	AWB & Shipping Documents.exe	false		high
http://opensource.org/licenses/MS-PL	AWB & Shipping Documents.exe	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	unknown	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true
208.91.199.224	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	437389
Start date:	20.06.2021
Start time:	22:41:19
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	AWB & Shipping Documents.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/2@4/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 2.1% (good quality ratio 1.6%) Quality average: 46.3% Quality standard deviation: 28.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 50 Number of non-executed functions: 20
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 104.43.193.48, 13.88.21.125, 20.50.102.62, 20.54.104.15, 40.112.88.60, 20.82.209.183, 80.67.82.235, 80.67.82.211, 20.82.210.154 Excluded domains from analysis (whitelisted): www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:42:08	API Interceptor	780x Sleep call for process: AWB & Shipping Documents.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
208.91.198.143	Request for Catalog and quotation.exe	Get hash	malicious	Browse
	c1EvSeMGO7.exe	Get hash	malicious	Browse
	New Order-17.06.21.pdf.exe	Get hash	malicious	Browse
	TT.COPY.exe	Get hash	malicious	Browse
	QR 2021.6.16.exe	Get hash	malicious	Browse
	DOC 202910982722.exe	Get hash	malicious	Browse
	D68GX3uJ2A.exe	Get hash	malicious	Browse
	s0Twu0o3h84ZVXq.exe	Get hash	malicious	Browse
	Request for Quotation (RFQ).xlsx	Get hash	malicious	Browse
	RFQ-566888787.exe	Get hash	malicious	Browse
	mRfakcKuzY.exe	Get hash	malicious	Browse
	New Inquiry 20216013.exe	Get hash	malicious	Browse
	xZMUq36tQv.exe	Get hash	malicious	Browse
	QUOTE.exe	Get hash	malicious	Browse
	ORGINAL SHIPPING DOCUMENT.exe	Get hash	malicious	Browse
	dan.exe	Get hash	malicious	Browse
	PO#61420.exe	Get hash	malicious	Browse
	Request.exe	Get hash	malicious	Browse
	Payment Advice.exe	Get hash	malicious	Browse
	Recibo de banco.exe	Get hash	malicious	Browse
208.91.199.224	KaGC54QXnK.exe	Get hash	malicious	Browse
	Tjeca6q3y7.exe	Get hash	malicious	Browse
	n1Z3uvDRtO.exe	Get hash	malicious	Browse
	IMG-21U776777.doc	Get hash	malicious	Browse
	AHVFb4aIAd.exe	Get hash	malicious	Browse
	Nuevo pedido Aprobaci#U00f3n del pago.xlsx	Get hash	malicious	Browse
	Shipping_DocumentsINV.exe	Get hash	malicious	Browse
	Yeni sipari#U015f _WJO-001,pdf.exe	Get hash	malicious	Browse
	SugVz0cZPXagh2b.exe	Get hash	malicious	Browse
	Request.exe	Get hash	malicious	Browse
	KC8ZMn81JC.exe	Get hash	malicious	Browse
	NEW ORDER 112888#.exe	Get hash	malicious	Browse
	Trial order 20210609.exe	Get hash	malicious	Browse
	Bestil 5039066002128.exe	Get hash	malicious	Browse
	Urgent Contract Order GH7856648,pdf.exe	Get hash	malicious	Browse
	MAO2nSLj0v.exe	Get hash	malicious	Browse
	003BC09180600189.exe	Get hash	malicious	Browse
	$96,914.38 MT103 Copypdf.exe	Get hash	malicious	Browse
	MOQ FOB ORDER_________.exe	Get hash	malicious	Browse
	xQPYfcvw4TlPTR9.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us2.smtp.mailhostbox.com	order no ORD00404083_01.exe	Get hash	malicious	Browse	208.91.199.225
	Request for Catalog and quotation.exe	Get hash	malicious	Browse	208.91.198.143
	INQUIRY pdf.exe	Get hash	malicious	Browse	208.91.199.223
	Img-347654566091234.exe	Get hash	malicious	Browse	208.91.199.223
	Img-347654566091236.exe	Get hash	malicious	Browse	208.91.199.223
	KIkIc66LT4.exe	Get hash	malicious	Browse	208.91.199.223
	ORDER TSA-A090621B.exe	Get hash	malicious	Browse	208.91.199.223
	KaGC54QXnK.exe	Get hash	malicious	Browse	208.91.199.224
	Tjeca6q3y7.exe	Get hash	malicious	Browse	208.91.199.224
	c1EvSeMGO7.exe	Get hash	malicious	Browse	208.91.198.143
	n1Z3uvDRtO.exe	Get hash	malicious	Browse	208.91.199.224
	M2b5HaLuuK.exe	Get hash	malicious	Browse	208.91.199.223
	IMG-21U776777.doc	Get hash	malicious	Browse	208.91.199.224
	ORDER TSA-A090621B.exe	Get hash	malicious	Browse	208.91.199.223
	New Order-17.06.21.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	QDt4lXU7NWta2pb.exe	Get hash	malicious	Browse	208.91.199.225
	QR 2021.6.17.exe	Get hash	malicious	Browse	208.91.199.223
	AHVFb4aIAd.exe	Get hash	malicious	Browse	208.91.199.224
	wq7c7vxYS5.exe	Get hash	malicious	Browse	208.91.199.225
	Confirmed Order.xlsx	Get hash	malicious	Browse	208.91.199.225

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	order no ORD00404083_01.exe	Get hash	malicious	Browse	208.91.199.223
	PO#4500484210.exe	Get hash	malicious	Browse	208.91.199.233
	Request for Catalog and quotation.exe	Get hash	malicious	Browse	208.91.198.143
	INQUIRY pdf.exe	Get hash	malicious	Browse	208.91.199.223
	Img-347654566091234.exe	Get hash	malicious	Browse	208.91.199.223
	Img-347654566091236.exe	Get hash	malicious	Browse	208.91.199.223
	KIkIc66LT4.exe	Get hash	malicious	Browse	208.91.199.223
	ORDER TSA-A090621B.exe	Get hash	malicious	Browse	208.91.199.223
	KaGC54QXnK.exe	Get hash	malicious	Browse	208.91.199.224
	Tjeca6q3y7.exe	Get hash	malicious	Browse	208.91.199.224
	c1EvSeMGO7.exe	Get hash	malicious	Browse	208.91.198.143
	n1Z3uvDRtO.exe	Get hash	malicious	Browse	208.91.199.224
	M2b5HaLuuK.exe	Get hash	malicious	Browse	208.91.199.223
	IMG-21U776777.doc	Get hash	malicious	Browse	208.91.199.224
	ORDER TSA-A090621B.exe	Get hash	malicious	Browse	208.91.199.223
	New Order-17.06.21.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	QDt4lXU7NWta2pb.exe	Get hash	malicious	Browse	208.91.199.225
	QR 2021.6.17.exe	Get hash	malicious	Browse	208.91.199.223
	AHVFb4aIAd.exe	Get hash	malicious	Browse	208.91.199.224
	wq7c7vxYS5.exe	Get hash	malicious	Browse	208.91.199.225
PUBLIC-DOMAIN-REGISTRYUS	order no ORD00404083_01.exe	Get hash	malicious	Browse	208.91.199.223
	PO#4500484210.exe	Get hash	malicious	Browse	208.91.199.233
	Request for Catalog and quotation.exe	Get hash	malicious	Browse	208.91.198.143
	INQUIRY pdf.exe	Get hash	malicious	Browse	208.91.199.223
	Img-347654566091234.exe	Get hash	malicious	Browse	208.91.199.223
	Img-347654566091236.exe	Get hash	malicious	Browse	208.91.199.223
	KIkIc66LT4.exe	Get hash	malicious	Browse	208.91.199.223
	ORDER TSA-A090621B.exe	Get hash	malicious	Browse	208.91.199.223
	KaGC54QXnK.exe	Get hash	malicious	Browse	208.91.199.224
	Tjeca6q3y7.exe	Get hash	malicious	Browse	208.91.199.224
	c1EvSeMGO7.exe	Get hash	malicious	Browse	208.91.198.143
	n1Z3uvDRtO.exe	Get hash	malicious	Browse	208.91.199.224
	M2b5HaLuuK.exe	Get hash	malicious	Browse	208.91.199.223
	IMG-21U776777.doc	Get hash	malicious	Browse	208.91.199.224
	ORDER TSA-A090621B.exe	Get hash	malicious	Browse	208.91.199.223
	New Order-17.06.21.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	QDt4lXU7NWta2pb.exe	Get hash	malicious	Browse	208.91.199.225
	QR 2021.6.17.exe	Get hash	malicious	Browse	208.91.199.223
	AHVFb4aIAd.exe	Get hash	malicious	Browse	208.91.199.224
	wq7c7vxYS5.exe	Get hash	malicious	Browse	208.91.199.225

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AWB & Shipping Documents.exe.log Download File
Process:	C:\Users\user\Desktop\AWB & Shipping Documents.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Roaming\wocavwzb.1aa\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\AWB & Shipping Documents.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7006690334145785
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.59265515440062
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	AWB & Shipping Documents.exe
File size:	901632
MD5:	7c4194af8b96aba768004cf02dc66ff2
SHA1:	0316176e546e300c41ab967ed0b671aa843e5298
SHA256:	33a82cfa5ef0f113bfa98be28c2a3d8637423f8e22be91179ee36a907ef808ca
SHA512:	e2fd5179e9a86cf428ac2c1b2e02479be736e905c9a280c50989b0f7d76dd9966ec9a0284ac07cc5074d01dd9a455e6a5fff396123369b2f027c229cfc6f2c4f
SSDEEP:	12288:JFehlm4S4F3M9ykYlDxvgcw6Uc85v8+C/0a607C2L8kJRdPtsthhtg/2hppp7ETF:JEW9Yl5Yc85JC8V45Vqhw/2hppKZpp
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(..`..............P......6......*.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	3ab89e9a98d0c0f0

Static PE Info

General
Entrypoint:	0x4ba82a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60CE9628 [Sun Jun 20 01:13:12 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba7d8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbc000	0x232e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb8830	0xb8a00	False	0.865326940166	data	7.57479829446	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xbc000	0x232e8	0x23400	False	0.905966035018	data	7.6748287259	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe0000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xbc260	0x573f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xc19b0	0x668	data
RT_ICON	0xc2028	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 136, next used block 0
RT_ICON	0xc2320	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0xc2458	0x9dd4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xcc23c	0xea8	data
RT_ICON	0xcd0f4	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 15330803, next used block 15461369
RT_ICON	0xcd9ac	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0xcdf24	0xd288	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xdb1bc	0x25a8	data
RT_ICON	0xdd774	0x10a8	data
RT_ICON	0xde82c	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xdeca4	0xae	data
RT_VERSION	0xded64	0x384	data
RT_MANIFEST	0xdf0f8	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2013
Assembly Version	1.0.0.0
InternalName	SiteMembershipCondition.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Freeze Remote Desktop
ProductVersion	1.0.0.0
FileDescription	Freeze Remote Desktop
OriginalFilename	SiteMembershipCondition.exe

Network Behavior

Download Network PCAP: filtered – full

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/21-22:43:55.736758	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49770	587	192.168.2.4	208.91.199.224
06/20/21-22:44:00.101236	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49771	587	192.168.2.4	208.91.198.143

Network Port Distribution

Total Packets: 73
• 587 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2021 22:43:53.931355000 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:54.107237101 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:54.107372999 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:54.637207985 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:54.637882948 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:54.816154957 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:54.816219091 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:54.818641901 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:54.996848106 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:54.997839928 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:55.175457001 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:55.176191092 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:55.353140116 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:55.353446960 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:55.558177948 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:55.558994055 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:55.735059023 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:55.736757994 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:55.737076998 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:55.738167048 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:55.738343000 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:55.914480925 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:55.916064024 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:56.016592026 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:56.069801092 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:57.266542912 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:57.442508936 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:57.442523956 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:57.442924976 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:57.443660975 CEST	49770	587	192.168.2.4	208.91.199.224
Jun 20, 2021 22:43:57.619621038 CEST	587	49770	208.91.199.224	192.168.2.4
Jun 20, 2021 22:43:58.298311949 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:43:58.476012945 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:43:58.478224993 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:43:59.027229071 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:43:59.027708054 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:43:59.203325987 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:43:59.203377008 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:43:59.203989983 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:43:59.380506992 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:43:59.381509066 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:43:59.558953047 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:43:59.559319973 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:43:59.735852003 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:43:59.736457109 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:43:59.921449900 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:43:59.921962023 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.099508047 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:44:00.101031065 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.101236105 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.101326942 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.101461887 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.101605892 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.101682901 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.101723909 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.101794958 CEST	49771	587	192.168.2.4	208.91.198.143
Jun 20, 2021 22:44:00.278266907 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:44:00.279004097 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:44:00.279047012 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:44:00.376179934 CEST	587	49771	208.91.198.143	192.168.2.4
Jun 20, 2021 22:44:00.429666996 CEST	49771	587	192.168.2.4	208.91.198.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2021 22:42:01.159581900 CEST	53	54531	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:01.270685911 CEST	49714	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:01.321764946 CEST	53	49714	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:02.253086090 CEST	58028	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:02.303494930 CEST	53	58028	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:03.614430904 CEST	53097	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:03.665888071 CEST	53	53097	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:04.542624950 CEST	49257	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:04.597989082 CEST	53	49257	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:05.751305103 CEST	62389	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:05.801840067 CEST	53	62389	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:07.036884069 CEST	49910	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:07.105077028 CEST	53	49910	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:08.130405903 CEST	55854	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:08.189682961 CEST	53	55854	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:09.448039055 CEST	64549	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:09.507441998 CEST	53	64549	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:10.886750937 CEST	63153	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:10.937596083 CEST	53	63153	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:12.625886917 CEST	52991	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:12.682219028 CEST	53	52991	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:14.096601963 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:14.152559996 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:15.190162897 CEST	51726	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:15.248892069 CEST	53	51726	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:16.315263033 CEST	56794	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:16.377278090 CEST	53	56794	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:17.844460964 CEST	56534	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:17.896326065 CEST	53	56534	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:18.930093050 CEST	56627	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:18.980999947 CEST	53	56627	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:20.026626110 CEST	56621	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:20.077550888 CEST	53	56621	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:21.150629044 CEST	63116	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:21.201107979 CEST	53	63116	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:22.718846083 CEST	64078	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:22.777672052 CEST	53	64078	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:25.387264013 CEST	64801	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:25.453104973 CEST	53	64801	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:31.446942091 CEST	61721	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:31.527348042 CEST	53	61721	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:46.327627897 CEST	51255	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:46.463824987 CEST	53	51255	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:47.122601986 CEST	61522	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:47.245918989 CEST	52337	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:47.260665894 CEST	53	61522	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:47.316667080 CEST	53	52337	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:47.984674931 CEST	55046	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:48.046828032 CEST	53	55046	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:48.493957043 CEST	49612	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:48.555849075 CEST	53	49612	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:49.122494936 CEST	49285	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:49.195437908 CEST	53	49285	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:49.844794035 CEST	50601	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:49.915272951 CEST	53	50601	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:50.430618048 CEST	60875	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:50.494888067 CEST	53	60875	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:51.306330919 CEST	56448	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:51.368033886 CEST	53	56448	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:52.268454075 CEST	59172	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:52.330878019 CEST	53	59172	8.8.8.8	192.168.2.4
Jun 20, 2021 22:42:53.348517895 CEST	62420	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:42:53.412940025 CEST	53	62420	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:06.463126898 CEST	60579	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:06.498408079 CEST	50183	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:06.531079054 CEST	53	60579	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:06.557477951 CEST	53	50183	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:09.557420015 CEST	61531	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:09.635004997 CEST	53	61531	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:40.410927057 CEST	49228	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:40.486726046 CEST	53	49228	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:41.805584908 CEST	59794	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:41.864315033 CEST	53	59794	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:53.539762974 CEST	55916	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:53.732076883 CEST	53	55916	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:53.766616106 CEST	52752	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:53.825690031 CEST	53	52752	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:57.770670891 CEST	60542	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:57.961839914 CEST	53	60542	8.8.8.8	192.168.2.4
Jun 20, 2021 22:43:58.243540049 CEST	60689	53	192.168.2.4	8.8.8.8
Jun 20, 2021 22:43:58.295830011 CEST	53	60689	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 20, 2021 22:43:53.539762974 CEST	192.168.2.4	8.8.8.8	0x917a	Standard query (0)	smtp.excetek-tw.com	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:53.766616106 CEST	192.168.2.4	8.8.8.8	0x1a5b	Standard query (0)	smtp.excetek-tw.com	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:57.770670891 CEST	192.168.2.4	8.8.8.8	0x78cb	Standard query (0)	smtp.excetek-tw.com	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:58.243540049 CEST	192.168.2.4	8.8.8.8	0x1baf	Standard query (0)	smtp.excetek-tw.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 20, 2021 22:43:53.732076883 CEST	8.8.8.8	192.168.2.4	0x917a	No error (0)	smtp.excetek-tw.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Jun 20, 2021 22:43:53.732076883 CEST	8.8.8.8	192.168.2.4	0x917a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:53.732076883 CEST	8.8.8.8	192.168.2.4	0x917a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:53.732076883 CEST	8.8.8.8	192.168.2.4	0x917a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:53.732076883 CEST	8.8.8.8	192.168.2.4	0x917a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:53.825690031 CEST	8.8.8.8	192.168.2.4	0x1a5b	No error (0)	smtp.excetek-tw.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Jun 20, 2021 22:43:53.825690031 CEST	8.8.8.8	192.168.2.4	0x1a5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:53.825690031 CEST	8.8.8.8	192.168.2.4	0x1a5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:53.825690031 CEST	8.8.8.8	192.168.2.4	0x1a5b	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:53.825690031 CEST	8.8.8.8	192.168.2.4	0x1a5b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:57.961839914 CEST	8.8.8.8	192.168.2.4	0x78cb	No error (0)	smtp.excetek-tw.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Jun 20, 2021 22:43:57.961839914 CEST	8.8.8.8	192.168.2.4	0x78cb	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:57.961839914 CEST	8.8.8.8	192.168.2.4	0x78cb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:57.961839914 CEST	8.8.8.8	192.168.2.4	0x78cb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:57.961839914 CEST	8.8.8.8	192.168.2.4	0x78cb	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:58.295830011 CEST	8.8.8.8	192.168.2.4	0x1baf	No error (0)	smtp.excetek-tw.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Jun 20, 2021 22:43:58.295830011 CEST	8.8.8.8	192.168.2.4	0x1baf	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:58.295830011 CEST	8.8.8.8	192.168.2.4	0x1baf	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:58.295830011 CEST	8.8.8.8	192.168.2.4	0x1baf	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Jun 20, 2021 22:43:58.295830011 CEST	8.8.8.8	192.168.2.4	0x1baf	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 20, 2021 22:43:54.637207985 CEST	587	49770	208.91.199.224	192.168.2.4	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jun 20, 2021 22:43:54.637882948 CEST	49770	587	192.168.2.4	208.91.199.224	EHLO 830021
Jun 20, 2021 22:43:54.816219091 CEST	587	49770	208.91.199.224	192.168.2.4	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
Jun 20, 2021 22:43:54.818641901 CEST	49770	587	192.168.2.4	208.91.199.224	AUTH login YmFuZ2VybGVlQGV4Y2V0ZWstdHcuY29t
Jun 20, 2021 22:43:54.996848106 CEST	587	49770	208.91.199.224	192.168.2.4	334 UGFzc3dvcmQ6
Jun 20, 2021 22:43:55.175457001 CEST	587	49770	208.91.199.224	192.168.2.4	235 2.7.0 Authentication successful
Jun 20, 2021 22:43:55.176191092 CEST	49770	587	192.168.2.4	208.91.199.224	MAIL FROM:<bangerlee@excetek-tw.com>
Jun 20, 2021 22:43:55.353140116 CEST	587	49770	208.91.199.224	192.168.2.4	250 2.1.0 Ok
Jun 20, 2021 22:43:55.353446960 CEST	49770	587	192.168.2.4	208.91.199.224	RCPT TO:<bangerlee@excetek-tw.com>
Jun 20, 2021 22:43:55.558177948 CEST	587	49770	208.91.199.224	192.168.2.4	250 2.1.5 Ok
Jun 20, 2021 22:43:55.558994055 CEST	49770	587	192.168.2.4	208.91.199.224	DATA
Jun 20, 2021 22:43:55.735059023 CEST	587	49770	208.91.199.224	192.168.2.4	354 End data with <CR><LF>.<CR><LF>
Jun 20, 2021 22:43:55.738343000 CEST	49770	587	192.168.2.4	208.91.199.224	.
Jun 20, 2021 22:43:56.016592026 CEST	587	49770	208.91.199.224	192.168.2.4	250 2.0.0 Ok: queued as 756841C1D19
Jun 20, 2021 22:43:57.266542912 CEST	49770	587	192.168.2.4	208.91.199.224	QUIT
Jun 20, 2021 22:43:57.442508936 CEST	587	49770	208.91.199.224	192.168.2.4	221 2.0.0 Bye
Jun 20, 2021 22:43:59.027229071 CEST	587	49771	208.91.198.143	192.168.2.4	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jun 20, 2021 22:43:59.027708054 CEST	49771	587	192.168.2.4	208.91.198.143	EHLO 830021
Jun 20, 2021 22:43:59.203377008 CEST	587	49771	208.91.198.143	192.168.2.4	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
Jun 20, 2021 22:43:59.203989983 CEST	49771	587	192.168.2.4	208.91.198.143	AUTH login YmFuZ2VybGVlQGV4Y2V0ZWstdHcuY29t
Jun 20, 2021 22:43:59.380506992 CEST	587	49771	208.91.198.143	192.168.2.4	334 UGFzc3dvcmQ6
Jun 20, 2021 22:43:59.558953047 CEST	587	49771	208.91.198.143	192.168.2.4	235 2.7.0 Authentication successful
Jun 20, 2021 22:43:59.559319973 CEST	49771	587	192.168.2.4	208.91.198.143	MAIL FROM:<bangerlee@excetek-tw.com>
Jun 20, 2021 22:43:59.735852003 CEST	587	49771	208.91.198.143	192.168.2.4	250 2.1.0 Ok
Jun 20, 2021 22:43:59.736457109 CEST	49771	587	192.168.2.4	208.91.198.143	RCPT TO:<bangerlee@excetek-tw.com>
Jun 20, 2021 22:43:59.921449900 CEST	587	49771	208.91.198.143	192.168.2.4	250 2.1.5 Ok
Jun 20, 2021 22:43:59.921962023 CEST	49771	587	192.168.2.4	208.91.198.143	DATA
Jun 20, 2021 22:44:00.099508047 CEST	587	49771	208.91.198.143	192.168.2.4	354 End data with <CR><LF>.<CR><LF>
Jun 20, 2021 22:44:00.101794958 CEST	49771	587	192.168.2.4	208.91.198.143	.
Jun 20, 2021 22:44:00.376179934 CEST	587	49771	208.91.198.143	192.168.2.4	250 2.0.0 Ok: queued as CE0CD183AE0

Code Manipulations

Statistics

CPU Usage

• AWB & Shipping Documents.exe
• AWB & Shipping Documents.exe
• AWB & Shipping Documents.exe

Click to jump to process

Memory Usage

• AWB & Shipping Documents.exe
• AWB & Shipping Documents.exe
• AWB & Shipping Documents.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• AWB & Shipping Documents.exe
• AWB & Shipping Documents.exe
• AWB & Shipping Documents.exe

Click to jump to process

System Behavior

Analysis Process: AWB & Shipping Documents.exe PID: 7124 Parent PID: 5872

Function Logs

General

Start time:	22:42:07
Start date:	20/06/2021
Path:	C:\Users\user\Desktop\AWB & Shipping Documents.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\AWB & Shipping Documents.exe'
Imagebase:	0x850000
File size:	901632 bytes
MD5 hash:	7C4194AF8B96ABA768004CF02DC66FF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.651648606.0000000003E15000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.650959749.0000000002C84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.651324084.0000000003BE9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.651324084.0000000003BE9000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Section Activities

Sections loaded by Windows

Sections loaded by Program

Mutex Activities

Mutex Created

System Activities

Language or Locale ID Queried

System Information Queried

Windows UI Activities

Window Created

Message Posted to Windows UI

Process Token Activities

Token Adjusted

LPC Port Activities

Chronological Activities

Analysis Process: AWB & Shipping Documents.exe PID: 5944 Parent PID: 7124

Function Logs

General

Start time:	22:42:10
Start date:	20/06/2021
Path:	C:\Users\user\Desktop\AWB & Shipping Documents.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\AWB & Shipping Documents.exe
Imagebase:	0x320000
File size:	901632 bytes
MD5 hash:	7C4194AF8B96ABA768004CF02DC66FF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: AWB & Shipping Documents.exe PID: 5600 Parent PID: 7124

Function Logs

General

Start time:	22:42:11
Start date:	20/06/2021
Path:	C:\Users\user\Desktop\AWB & Shipping Documents.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\AWB & Shipping Documents.exe
Imagebase:	0x620000
File size:	901632 bytes
MD5 hash:	7C4194AF8B96ABA768004CF02DC66FF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000003.00000002.908591002.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.910887769.0000000002C41000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Section Activities

Sections loaded by Windows

Sections loaded by Program

COM Activities

WMI Operations

Mutex Activities

Mutex Created

System Activities

Language or Locale ID Queried

System Information Queried

Timing Activities

Windows UI Activities

Window Created

Network Activities

Socket bound

Socket connected

Process Token Activities

Token Adjusted