Edit tour

Windows Analysis Report
invoices---DEC_2023.exe

Overview

General Information

Sample name:	invoices---DEC_2023.exe
Analysis ID:	1364951
MD5:	0483a991fb043b8fddcf818ada08b3a1
SHA1:	11f8037e019382be07f2c37210f388553b2a3760
SHA256:	85015ad6ba1de268a69c138776c23e9d1a39a69063d525f74b1ef349b9031ffd
Tags:	exe
Infos:

Detection

PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Sample has a suspicious name (potential lure to open the executable)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

invoices---DEC_2023.exe (PID: 2148 cmdline: C:\Users\user\Desktop\invoices---DEC_2023.exe MD5: 0483A991FB043B8FDDCF818ADA08B3A1)

invoices---DEC_2023.exe (PID: 748 cmdline: C:\Users\user\Desktop\invoices---DEC_2023.exe MD5: 0483A991FB043B8FDDCF818ADA08B3A1)

fikk.exe (PID: 4448 cmdline: "C:\Users\user\AppData\Roaming\fikk.exe" MD5: 0483A991FB043B8FDDCF818ADA08B3A1)

fikk.exe (PID: 1976 cmdline: C:\Users\user\AppData\Roaming\fikk.exe MD5: 0483A991FB043B8FDDCF818ADA08B3A1)

fikk.exe (PID: 3372 cmdline: "C:\Users\user\AppData\Roaming\fikk.exe" MD5: 0483A991FB043B8FDDCF818ADA08B3A1)

fikk.exe (PID: 3812 cmdline: C:\Users\user\AppData\Roaming\fikk.exe MD5: 0483A991FB043B8FDDCF818ADA08B3A1)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2592378463.000001FED9336000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2048259063.000001C127810000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2525528464.000002797BC70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.3249333538.000001EE90856000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2039823779.000001C12266B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: invoices---DEC_2023.exe PID: 2148	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: invoices---DEC_2023.exe PID: 2148	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: invoices---DEC_2023.exe PID: 748	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: fikk.exe PID: 4448	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: fikk.exe PID: 4448	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: fikk.exe PID: 1976	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: fikk.exe PID: 3372	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: fikk.exe PID: 3372	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: fikk.exe PID: 3812	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.fikk.exe.1fed93365a8.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.fikk.exe.2797bc70000.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
2.2.invoices---DEC_2023.exe.1ee908565a8.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.fikk.exe.279108565a8.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c122930e38.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c10ebade48.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
3.2.fikk.exe.2a4c8178370.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c1228e0e00.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
3.2.fikk.exe.2a4c8178370.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c1228e0e00.9.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c122930e38.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.fikk.exe.1d9099fbbb0.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c127810000.12.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c122b10ea8.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c1228b8dc8.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.fikk.exe.1d9099fbbb0.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c1228b8dc8.8.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.invoices---DEC_2023.exe.1c10ebade48.1.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.fikk.exe.279106b9938.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 14 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: invoices---DEC_2023.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://45.137.22.163/Wowoqku.wav	Avira URL Cloud: Label: malware
Source: http://45.137.22.163	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\fikk.exe

Avira: detection malicious, Label: HEUR/AGEN.1360909

Multi AV Scanner detection for domain / URL

Source: http://45.137.22.163/Wowoqku.wav	Virustotal: Detection: 12%			Perma Link
Source: http://45.137.22.163	Virustotal: Detection: 13%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\fikk.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Roaming\fikk.exe	Virustotal: Detection: 37%			Perma Link

Multi AV Scanner detection for submitted file

Source: invoices---DEC_2023.exe	ReversingLabs: Detection: 18%
Source: invoices---DEC_2023.exe	Virustotal: Detection: 37%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\fikk.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: invoices---DEC_2023.exe

Joe Sandbox ML: detected

Source: invoices---DEC_2023.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura.dotnetzip.pdb.compressed source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3249333538.000001EE90856000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2592378463.000001FED9336000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed2! source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 37d4c34f-a7fd-478e-84fe-ac246c9c46bb<Module>costura.costura.dll.compressedcostura.dotnetzip.dll.compressedcostura.dotnetzip.pdb.compressedcostura.protobuf-net.dll.compressedFoytgem.g.resourcesaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources source: invoices---DEC_2023.exe, 00000002.00000002.3249333538.000001EE90856000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2592378463.000001FED9336000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: @costura.dotnetzip.pdb.compressed source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Foytgem.pdb source: invoices---DEC_2023.exe, 00000002.00000002.3249333538.000001EE907BC000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279102E1000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2592378463.000001FED929C000.00000004.00000800.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 5.252.165.214:8088

Source: global traffic	HTTP traffic detected: GET /Wowoqku.wav HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Wowoqku.wav HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Wowoqku.wav HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 45.137.22.163 45.137.22.163
Source: Joe Sandbox View	IP Address: 45.137.22.163 45.137.22.163

Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163

Source: global traffic	HTTP traffic detected: GET /Wowoqku.wav HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Wowoqku.wav HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Wowoqku.wav HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive

Source: invoices---DEC_2023.exe, fikk.exe.0.dr	String found in binary or memory: http://127.0.0.1:
Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10E9B1000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C7F71000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.163
Source: invoices---DEC_2023.exe, fikk.exe.0.dr	String found in binary or memory: http://45.137.22.163/Wowoqku.wav
Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10E9B1000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C7F71000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2204458886.000002A4DC281000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2283674148.000001D91DB11000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8BFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: invoices---DEC_2023.exe

Sample has a suspicious name (potential lure to open the executable)

Source: invoices---DEC_2023.exe

Static file information: Suspicious name

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 0_2_00007FF848F148DE	0_2_00007FF848F148DE
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 2_2_00007FF848FF1E2E	2_2_00007FF848FF1E2E
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 3_2_00007FF848F448DE	3_2_00007FF848F448DE
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 5_2_00007FF848FE1B44	5_2_00007FF848FE1B44
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 6_2_00007FF848F5F380	6_2_00007FF848F5F380
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F3D2F3	7_2_00007FF848F3D2F3
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F3D1F3	7_2_00007FF848F3D1F3
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F3D4D3	7_2_00007FF848F3D4D3
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F3D0E3	7_2_00007FF848F3D0E3

Source: fikk.exe.0.dr	Static PE information: No import functions for PE file found
Source: invoices---DEC_2023.exe	Static PE information: No import functions for PE file found

Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs invoices---DEC_2023.exe
Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKsdrzconmz.exe" vs invoices---DEC_2023.exe
Source: invoices---DEC_2023.exe, 00000000.00000000.1992325575.000001C10CC9C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameliol.exe" vs invoices---DEC_2023.exe
Source: invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs invoices---DEC_2023.exe
Source: invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs invoices---DEC_2023.exe
Source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs invoices---DEC_2023.exe
Source: invoices---DEC_2023.exe, 00000002.00000002.3249333538.000001EE907BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFoytgem.dll" vs invoices---DEC_2023.exe
Source: invoices---DEC_2023.exe	Binary or memory string: OriginalFilenameliol.exe" vs invoices---DEC_2023.exe

Source: 0.2.invoices---DEC_2023.exe.1c11eba1b58.3.raw.unpack, DispatcherAttrInstance.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.invoices---DEC_2023.exe.1c11eba1b58.3.raw.unpack, DispatcherAttrInstance.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.invoices---DEC_2023.exe.1c11eba1b58.3.raw.unpack, DispatcherAttrInstance.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.invoices---DEC_2023.exe.1c11eba1b58.3.raw.unpack, StubClientConfig.cs	Task registration methods: 'CreateTask'
Source: 0.2.invoices---DEC_2023.exe.1c11eba1b58.3.raw.unpack, Collection.cs	Task registration methods: 'RegisterTask'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/4@0/2

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

File created: C:\Users\user\AppData\Roaming\fikk.exe

Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

Mutant created: \Sessions\1\BaseNamedObjects\5bec48dd15fbca32

Source: invoices---DEC_2023.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: invoices---DEC_2023.exe	Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: invoices---DEC_2023.exe	ReversingLabs: Detection: 18%
Source: invoices---DEC_2023.exe	Virustotal: Detection: 37%

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

File read: C:\Users\user\Desktop\invoices---DEC_2023.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\invoices---DEC_2023.exe C:\Users\user\Desktop\invoices---DEC_2023.exe
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process created: C:\Users\user\Desktop\invoices---DEC_2023.exe C:\Users\user\Desktop\invoices---DEC_2023.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fikk.exe "C:\Users\user\AppData\Roaming\fikk.exe"
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process created: C:\Users\user\AppData\Roaming\fikk.exe C:\Users\user\AppData\Roaming\fikk.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fikk.exe "C:\Users\user\AppData\Roaming\fikk.exe"
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process created: C:\Users\user\AppData\Roaming\fikk.exe C:\Users\user\AppData\Roaming\fikk.exe
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process created: C:\Users\user\Desktop\invoices---DEC_2023.exe C:\Users\user\Desktop\invoices---DEC_2023.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process created: C:\Users\user\AppData\Roaming\fikk.exe C:\Users\user\AppData\Roaming\fikk.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process created: C:\Users\user\AppData\Roaming\fikk.exe C:\Users\user\AppData\Roaming\fikk.exe	Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: invoices---DEC_2023.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: invoices---DEC_2023.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura.dotnetzip.pdb.compressed source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3249333538.000001EE90856000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2592378463.000001FED9336000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.dotnetzip.pdb.compressed2! source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 37d4c34f-a7fd-478e-84fe-ac246c9c46bb<Module>costura.costura.dll.compressedcostura.dotnetzip.dll.compressedcostura.dotnetzip.pdb.compressedcostura.protobuf-net.dll.compressedFoytgem.g.resourcesaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources source: invoices---DEC_2023.exe, 00000002.00000002.3249333538.000001EE90856000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2592378463.000001FED9336000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: @costura.dotnetzip.pdb.compressed source: invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Foytgem.pdb source: invoices---DEC_2023.exe, 00000002.00000002.3249333538.000001EE907BC000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279102E1000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2592378463.000001FED929C000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.invoices---DEC_2023.exe.1c11eba1b58.3.raw.unpack, DispatcherAttrInstance.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: invoices---DEC_2023.exe, PrinterMapperWrapper.cs	.Net Code: AddWorker System.Reflection.Assembly.Load(byte[])
Source: fikk.exe.0.dr, PrinterMapperWrapper.cs	.Net Code: AddWorker System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoices---DEC_2023.exe.1c127910000.13.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.invoices---DEC_2023.exe.1c127910000.13.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.invoices---DEC_2023.exe.1c127910000.13.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.invoices---DEC_2023.exe.1c127910000.13.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.invoices---DEC_2023.exe.1c127910000.13.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 7.2.fikk.exe.1fed93365a8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fikk.exe.2797bc70000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.invoices---DEC_2023.exe.1ee908565a8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fikk.exe.279108565a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c122930e38.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c10ebade48.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fikk.exe.2a4c8178370.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c1228e0e00.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.fikk.exe.2a4c8178370.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c1228e0e00.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c122930e38.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.fikk.exe.1d9099fbbb0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c127810000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c122b10ea8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c1228b8dc8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.fikk.exe.1d9099fbbb0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c1228b8dc8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoices---DEC_2023.exe.1c10ebade48.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fikk.exe.279106b9938.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2592378463.000001FED9336000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2048259063.000001C127810000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2525528464.000002797BC70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3249333538.000001EE90856000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2586831322.000001FEC8B29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2039823779.000001C12266B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoices---DEC_2023.exe PID: 2148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: invoices---DEC_2023.exe PID: 748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fikk.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fikk.exe PID: 1976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fikk.exe PID: 3372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fikk.exe PID: 3812, type: MEMORYSTR

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 0_2_00007FF848F100BD pushad ; iretd	0_2_00007FF848F100C1
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 0_2_00007FF848F180F1 push ecx; iretd	0_2_00007FF848F180F4
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 2_2_00007FF848F4184B push eax; iretd	2_2_00007FF848F41871
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 2_2_00007FF848F42650 push FFFFFFBEh; ret	2_2_00007FF848F42652
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 2_2_00007FF848F400BD pushad ; iretd	2_2_00007FF848F400C1
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 2_2_00007FF848F4533A push esi; retf	2_2_00007FF848F4533D
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 2_2_00007FF848F45366 push ds; retf	2_2_00007FF848F45375
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Code function: 2_2_00007FF848F455C5 push edi; iretd	2_2_00007FF848F455D6
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 3_2_00007FF848F400BD pushad ; iretd	3_2_00007FF848F400C1
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 3_2_00007FF848F480F1 push ecx; iretd	3_2_00007FF848F480F4
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 5_2_00007FF848F32650 push FFFFFFBEh; ret	5_2_00007FF848F32652
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 5_2_00007FF848F355C5 push edi; iretd	5_2_00007FF848F355D6
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 5_2_00007FF848F3184B push eax; iretd	5_2_00007FF848F31871
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 5_2_00007FF848F300BD pushad ; iretd	5_2_00007FF848F300C1
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 5_2_00007FF848F3533A push esi; retf	5_2_00007FF848F3533D
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 5_2_00007FF848F35366 push ds; retf	5_2_00007FF848F35375
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 6_2_00007FF848F300BD pushad ; iretd	6_2_00007FF848F300C1
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 6_2_00007FF848F380F1 push ecx; iretd	6_2_00007FF848F380F4
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F3184B push eax; iretd	7_2_00007FF848F31871
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F32650 push FFFFFFBEh; ret	7_2_00007FF848F32652
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F300BD pushad ; iretd	7_2_00007FF848F300C1
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F3533A push esi; retf	7_2_00007FF848F3533D
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F35366 push ds; retf	7_2_00007FF848F35375
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F355C5 push edi; iretd	7_2_00007FF848F355D6
Source: C:\Users\user\AppData\Roaming\fikk.exe	Code function: 7_2_00007FF848F468B5 push edx; ret	7_2_00007FF848F468BB

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

File created: C:\Users\user\AppData\Roaming\fikk.exe

Jump to dropped file

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fikk			Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fikk			Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe TID: 2992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe TID: 4984	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe TID: 3172	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe TID: 5960	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe TID: 1520	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe TID: 6776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe TID: 7032	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe TID: 6768	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: invoices---DEC_2023.exe, 00000000.00000002.2038331719.000001C10CEA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllVV[6P
Source: fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: invoices---DEC_2023.exe, 00000002.00000002.3249926425.000001EEE8D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlltureOF
Source: fikk.exe, 00000003.00000002.2197305779.000002A4C62E5000.00000004.00000020.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2278103305.000001D907A96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Memory written: C:\Users\user\Desktop\invoices---DEC_2023.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Memory written: C:\Users\user\AppData\Roaming\fikk.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Memory written: C:\Users\user\AppData\Roaming\fikk.exe base: 140000000 value starts with: 4D5A	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Thread register set: target process: 748	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread register set: target process: 1976	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Thread register set: target process: 3812	Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Process created: C:\Users\user\Desktop\invoices---DEC_2023.exe C:\Users\user\Desktop\invoices---DEC_2023.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process created: C:\Users\user\AppData\Roaming\fikk.exe C:\Users\user\AppData\Roaming\fikk.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Process created: C:\Users\user\AppData\Roaming\fikk.exe C:\Users\user\AppData\Roaming\fikk.exe	Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Queries volume information: C:\Users\user\Desktop\invoices---DEC_2023.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoices---DEC_2023.exe	Queries volume information: C:\Users\user\Desktop\invoices---DEC_2023.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Queries volume information: C:\Users\user\AppData\Roaming\fikk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Queries volume information: C:\Users\user\AppData\Roaming\fikk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Queries volume information: C:\Users\user\AppData\Roaming\fikk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fikk.exe	Queries volume information: C:\Users\user\AppData\Roaming\fikk.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\invoices---DEC_2023.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoices---DEC_2023.exe PID: 2148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fikk.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fikk.exe PID: 3372, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoices---DEC_2023.exe PID: 2148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fikk.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fikk.exe PID: 3372, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	211 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	211 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	1 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
invoices---DEC_2023.exe	19%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
invoices---DEC_2023.exe	38%	Virustotal		Browse
invoices---DEC_2023.exe	100%	Avira	HEUR/AGEN.1360909
invoices---DEC_2023.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\fikk.exe	100%	Avira	HEUR/AGEN.1360909
C:\Users\user\AppData\Roaming\fikk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\fikk.exe	19%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\fikk.exe	38%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://45.137.22.163/Wowoqku.wav	100%	Avira URL Cloud	malware
http://127.0.0.1:	0%	Avira URL Cloud	safe
http://45.137.22.163	100%	Avira URL Cloud	malware
http://45.137.22.163/Wowoqku.wav	12%	Virustotal		Browse
http://45.137.22.163	13%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://45.137.22.163/Wowoqku.wav	false	12%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	invoices---DEC_2023.exe, fikk.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://45.137.22.163	invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10E9B1000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C7F71000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909810000.00000004.00000800.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://github.com/mgravell/protobuf-neti	invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000007.00000002.2586831322.000001FEC8BFB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2204458886.000002A4DC281000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2283674148.000001D91DB11000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10E9B1000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C7F71000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909810000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	invoices---DEC_2023.exe, 00000000.00000002.2038776044.000001C10EAE9000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, invoices---DEC_2023.exe, 00000002.00000002.3243572943.000001EE80001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000003.00000002.2199934431.000002A4C80AF000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2508019011.0000027900001000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000006.00000002.2279392532.000001D909937000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	invoices---DEC_2023.exe, 00000000.00000002.2048782210.000001C127910000.00000004.08000000.00040000.00000000.sdmp, invoices---DEC_2023.exe, 00000000.00000002.2039823779.000001C122B10000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.00000279106B9000.00000004.00000800.00020000.00000000.sdmp, fikk.exe, 00000005.00000002.2511602813.0000027910968000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.137.22.163	unknown	Netherlands		51447	ROOTLAYERNETNL	false
5.252.165.214	unknown	United States		64271	RIXCLOUD-INCUS	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1364951
Start date and time:	2023-12-20 09:12:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	invoices---DEC_2023.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/4@0/2
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target fikk.exe, PID 1976 because it is empty
Execution Graph export aborted for target fikk.exe, PID 3372 because it is empty
Execution Graph export aborted for target fikk.exe, PID 4448 because it is empty
Execution Graph export aborted for target invoices---DEC_2023.exe, PID 2148 because it is empty
Execution Graph export aborted for target invoices---DEC_2023.exe, PID 748 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:12:56	API Interceptor	1x Sleep call for process: invoices---DEC_2023.exe modified
09:12:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fikk C:\Users\user\AppData\Roaming\fikk.exe
09:13:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fikk C:\Users\user\AppData\Roaming\fikk.exe
09:13:12	API Interceptor	1x Sleep call for process: fikk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.137.22.163	Sysiq.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.137.22.163/Sluhmuv.mp3
	NEW_ORDER_12-18-23.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.137.22.163/Akoob.pdf
	SecuriteInfo.com.MSIL.Generik.FMUPQYX.tr.3045.24667.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.137.22.163/hiii.pdf
	Controllo saldo 30% Ordine 5667.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/bless_Jkvszuhw.png
	Quotation-pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/Toscgshw_Yvmodcuo.png
	#Uc8fc#Ubb38 30% #Uc794#Uc561 #Ud655#Uc778.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/orderfile_Hecqxfqw.png
	New order _xls.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/New_order__xls_Ivuuoipf.bmp
	SecuriteInfo.com.W32.MSIL_Kryptik.GXA.genEldorado.18172.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/fact_Sptqaevl.bmp
	order confirmation 46574 -QT-04-0022.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/order_confirmation_46574_-QT-04-0022_Yszciyqc.jpg
	Quotation-pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/Kwcmalox_Bcqlnfnp.jpg
	2467864 _INV_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/Hebvr_Lwvvdxxi.bmp
	conferma d'ordine 46574.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/fresh_Djctepjr.png
	factura proforma PI- PI04522 7486.exe	Get hash	malicious	Unknown	Browse	45.137.22.163/trans_Yygygcyg.jpg
	PI- PI04522 74868.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/proforma_invoice_Crnbdlom.png
	paymentcopy-pdf__________________________________.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/Wmdmjhtr_Pendcahw.bmp
	Paymentcopy-pdf___________________________________.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/Dhjuzchby_Xwgoflwi.bmp
	AIR CARGO BOARDING shipment MAWB 40608657504.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/Ejghs_Imuzrnrb.png
	PI- PI04522748-pdf.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/Cpogmqp_Qhkfesil.jpg
	Ordine di acquisto PO-JTT-00001018.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/Htrcekszm_Kcdcxrzw.jpg
5.252.165.214	rMSC-AQP-Newquotationrequest-ES0083ESP23.bat	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.32623.1958.exe	Get hash	malicious	PureLog Stealer	Browse
	tDEOY2VfAj.exe	Get hash	malicious	zgRAT	Browse
	Qtagiietkyb.png.bat	Get hash	malicious	Strela Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROOTLAYERNETNL	Sysiq.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.137.22.163
	NEW_ORDER_12-18-23.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.137.22.163
	PAYMENT_TT_COPY.pdf.exe	Get hash	malicious	RedLine	Browse	185.222.58.239
	SecuriteInfo.com.MSIL.Generik.FMUPQYX.tr.3045.24667.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.137.22.163
	cVw2fI6l0l.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8
	D4CJJrRyRV.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	C2qEwpO6ff.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, PureLog Stealer, RedLine, SmokeLoader, Xmrig	Browse	45.137.21.8
	rQ7KS66xHz.exe	Get hash	malicious	Glupteba, PureLog Stealer, RedLine, SmokeLoader, Xmrig	Browse	45.137.21.8
	cgROS79PO8.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	GQmlDdfIus.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	tFXV5OO73i.exe	Get hash	malicious	Glupteba, PureLog Stealer, RedLine, SmokeLoader, Xmrig	Browse	45.137.21.8
	xR0Sb2wGy9.exe	Get hash	malicious	RedLine	Browse	185.222.58.99
	rdU3cg9xmI.exe	Get hash	malicious	Glupteba, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader, Xmrig	Browse	45.137.21.8
	Dzc2otu6qd.exe	Get hash	malicious	Glupteba, LummaC Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	YRdCIU1WYM.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8
	ae6r1Pwu4b.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	8d6f8324030f8c1566ab38f8ade3c386b7b7740ccaf28.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report invoices---DEC_2023.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

Windows Analysis Report
invoices---DEC_2023.exe