Windows Analysis Report
Proforma Invoice - Well Ergon.exe

Overview

General Information

Sample name: Proforma Invoice - Well Ergon.exe
Analysis ID: 1426559
MD5: d6ef5b4c4627dc06ababa7f1276edc79
SHA1: ad9e36b336501512587f2796b602c133bb4dde3c
SHA256: e1a7994ddfd57c0e0e5640720bab427afa0d0ca11f5b09d50b4fe8c9d030c726
Tags: AgentTeslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes (.Net Source)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample has a suspicious name (potential lure to open the executable)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Proforma Invoice - Well Ergon.exe Avira: detected
Found malware configuration
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}
Multi AV Scanner detection for submitted file
Source: Proforma Invoice - Well Ergon.exe ReversingLabs: Detection: 52%
Source: Proforma Invoice - Well Ergon.exe Virustotal: Detection: 54% Perma Link
Machine Learning detection for sample
Source: Proforma Invoice - Well Ergon.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Proforma Invoice - Well Ergon.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: Proforma Invoice - Well Ergon.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ASLAGIDKOM-NETUA ASLAGIDKOM-NETUA
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.8:49706 -> 46.175.148.58:25
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: api.ipify.org
Source: Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3860396547.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.iaa-airferight.com
Source: Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3860396547.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Proforma Invoice - Well Ergon.exe, 00000000.00000002.1434279786.0000000002AD0000.00000040.00001000.00020000.00000000.sdmp, Proforma Invoice - Well Ergon.exe, 00000000.00000002.1434565759.0000000003B74000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3858276820.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: Proforma Invoice - Well Ergon.exe, 00000000.00000002.1434279786.0000000002AD0000.00000040.00001000.00020000.00000000.sdmp, Proforma Invoice - Well Ergon.exe, 00000000.00000002.1434565759.0000000003B74000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3858276820.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3860396547.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3860396547.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3860396547.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.8:49705 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, abAX9N.cs .Net Code: BFeixnEv
Source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.raw.unpack, abAX9N.cs .Net Code: BFeixnEv
Source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.raw.unpack, abAX9N.cs .Net Code: BFeixnEv
Installs a global keyboard hook
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.Proforma Invoice - Well Ergon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1434279786.0000000002AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Proforma Invoice - Well Ergon.exe
Sample has a suspicious name (potential lure to open the executable)
Source: Proforma Invoice - Well Ergon.exe Static file information: Suspicious name
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 0_2_02AC0054 CreateProcessW,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread, 0_2_02AC0054
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 0_2_02AC0000 CreateProcessW,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread, 0_2_02AC0000
Detected potential crypto function
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_02974A98 12_2_02974A98
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_0297A968 12_2_0297A968
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_02973E80 12_2_02973E80
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_0297ADF0 12_2_0297ADF0
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_029741C8 12_2_029741C8
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_0297F8A5 12_2_0297F8A5
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_06593578 12_2_06593578
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_06595D30 12_2_06595D30
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_065945A0 12_2_065945A0
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_065903DD 12_2_065903DD
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_0659E0B9 12_2_0659E0B9
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_0659A140 12_2_0659A140
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_065991F0 12_2_065991F0
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_06595650 12_2_06595650
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_0659C618 12_2_0659C618
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_06593CA0 12_2_06593CA0
One or more processes crash
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 80
Sample file is different than original file name gathered from version info
Source: Proforma Invoice - Well Ergon.exe, 00000000.00000002.1433740832.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Proforma Invoice - Well Ergon.exe
Source: Proforma Invoice - Well Ergon.exe, 00000000.00000002.1434279786.0000000002AD0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs Proforma Invoice - Well Ergon.exe
Source: Proforma Invoice - Well Ergon.exe, 00000000.00000002.1434565759.0000000003B74000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs Proforma Invoice - Well Ergon.exe
Source: Proforma Invoice - Well Ergon.exe, 00000000.00000000.1381182616.0000000000818000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamePskYeKR.exe< vs Proforma Invoice - Well Ergon.exe
Source: Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3859043803.0000000000AF9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Proforma Invoice - Well Ergon.exe
Source: Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3858276820.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs Proforma Invoice - Well Ergon.exe
Source: Proforma Invoice - Well Ergon.exe Binary or memory string: OriginalFilenamePskYeKR.exe< vs Proforma Invoice - Well Ergon.exe
Uses 32bit PE files
Source: Proforma Invoice - Well Ergon.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.Proforma Invoice - Well Ergon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1434279786.0000000002AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: Proforma Invoice - Well Ergon.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Proforma Invoice - Well Ergon.exe, usn.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, RsYAkkzVoy.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, Kqqzixk.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, xROdzGigX.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, ywes.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, iPVW0zV.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, 1Pi9sgbHwoV.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, YUgDfWK2g4.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, YUgDfWK2g4.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@12/0@2/2
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7600
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7656
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7448
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e70b0562-12b6-441a-a926-11e9329ab8c9 Jump to behavior
Source: Proforma Invoice - Well Ergon.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Proforma Invoice - Well Ergon.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Proforma Invoice - Well Ergon.exe ReversingLabs: Detection: 52%
Source: Proforma Invoice - Well Ergon.exe Virustotal: Detection: 54%
Source: unknown Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 80
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 80
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7656 -s 80
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe" Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe" Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe" Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe" Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: Proforma Invoice - Well Ergon.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Proforma Invoice - Well Ergon.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 12_2_02970CB5 push edi; ret 12_2_02970CC2
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Memory allocated: 1180000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Memory allocated: 2B70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Memory allocated: 4B70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Memory allocated: 2880000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Memory allocated: 2AA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Memory allocated: 28D0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Window / User API: threadDelayed 548 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Window / User API: threadDelayed 626 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Window / User API: threadDelayed 9238 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7476 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7592 Thread sleep count: 149 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7608 Thread sleep count: 548 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -21213755684765971s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -99875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7812 Thread sleep count: 626 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7812 Thread sleep count: 9238 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -99765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -99649s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -99531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -99422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -99312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -99203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -99094s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98984s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -98000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -97016s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -96000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -95891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -95766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -95641s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -95531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -95422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -95312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -95203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -95094s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -94984s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -94875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -94766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -94641s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe TID: 7808 Thread sleep time: -94516s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 99875 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 99765 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 99649 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 99531 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 99422 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 99312 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 99203 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 99094 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98984 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98875 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98765 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98656 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98547 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98437 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98328 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98219 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98109 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 98000 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97890 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97781 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97672 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97562 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97453 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97343 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97234 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97125 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 97016 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96891 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96766 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96656 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96547 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96437 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96328 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96219 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96109 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 96000 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 95891 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 95766 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 95641 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 95531 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 95422 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 95312 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 95203 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 95094 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 94984 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 94875 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 94766 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 94641 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Thread delayed: delay time: 94516 Jump to behavior
Source: Proforma Invoice - Well Ergon.exe, 0000000C.00000002.3859425102.0000000000C65000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Code function: 0_2_02AC0054 CreateProcessW,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread, 0_2_02AC0054
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Memory written: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe" Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe" Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe" Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Process created: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe "C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Queries volume information: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Queries volume information: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Proforma Invoice - Well Ergon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.3858276820.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3860396547.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1434279786.0000000002AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3860396547.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1434565759.0000000003B74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Proforma Invoice - Well Ergon.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Proforma Invoice - Well Ergon.exe PID: 7716, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Proforma Invoice - Well Ergon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.3858276820.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1434279786.0000000002AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3860396547.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1434565759.0000000003B74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Proforma Invoice - Well Ergon.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Proforma Invoice - Well Ergon.exe PID: 7716, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3d23540.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.2ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.Proforma Invoice - Well Ergon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Invoice - Well Ergon.exe.3ce8b10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.3858276820.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3860396547.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1434279786.0000000002AD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.3860396547.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1434565759.0000000003B74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Proforma Invoice - Well Ergon.exe PID: 7384, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Proforma Invoice - Well Ergon.exe PID: 7716, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1426559 Sample: Proforma Invoice - Well Ergon.exe Startdate: 16/04/2024 Architecture: WINDOWS Score: 100 27 mail.iaa-airferight.com 2->27 29 api.ipify.org 2->29 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Antivirus / Scanner detection for submitted sample 2->39 41 8 other signatures 2->41 8 Proforma Invoice - Well Ergon.exe 2 2->8         started        signatures3 process4 signatures5 43 Injects a PE file into a foreign processes 8->43 11 Proforma Invoice - Well Ergon.exe 15 2 8->11         started        15 Proforma Invoice - Well Ergon.exe 8->15         started        17 Proforma Invoice - Well Ergon.exe 8->17         started        19 Proforma Invoice - Well Ergon.exe 8->19         started        process6 dnsIp7 31 mail.iaa-airferight.com 46.175.148.58, 25 ASLAGIDKOM-NETUA Ukraine 11->31 33 api.ipify.org 172.67.74.152, 443, 49705 CLOUDFLARENETUS United States 11->33 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file / registry access) 11->47 49 Tries to harvest and steal browser information (history, passwords, etc) 11->49 51 Installs a global keyboard hook 11->51 21 WerFault.exe 2 15->21         started        23 WerFault.exe 2 17->23         started        25 WerFault.exe 2 19->25         started        signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
46.175.148.58
 mail.iaa-airferight.com Ukraine
56394 ASLAGIDKOM-NETUA true
172.67.74.152
 api.ipify.org United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
mail.iaa-airferight.com 46.175.148.58 true
api.ipify.org 172.67.74.152 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
    		high