Windows Analysis Report
Remittance_Advice 26042024.exe

Overview

General Information

Sample name: Remittance_Advice 26042024.exe
Analysis ID: 1432026
MD5: f78fac7fbb75ddcc67dd7cb5b6b6ea97
SHA1: a9b9c8f3121cb128882d3e59b7ba2b045ce0792f
SHA256: cd3e530bfaf604d4e59e78d8d8761ab63f0d3d57beff38c1f4802993226af6bb
Tags: exe
Infos:

Detection

AgentTesla, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.innomedjsc.com", "Username": "nhung.hth@innomedjsc.com", "Password": "s]~5ai)IFpr-"}
Multi AV Scanner detection for submitted file
Source: Remittance_Advice 26042024.exe ReversingLabs: Detection: 36%
Source: Remittance_Advice 26042024.exe Virustotal: Detection: 47% Perma Link
Machine Learning detection for sample
Source: Remittance_Advice 26042024.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Remittance_Advice 26042024.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Remittance_Advice 26042024.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, type: UNPACKEDPE
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 192.249.117.241 192.249.117.241
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: mail.innomedjsc.com
Source: Remittance_Advice 26042024.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Remittance_Advice 26042024.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Remittance_Advice 26042024.exe, 00000002.00000002.4158316953.00000000032BE000.00000004.00000800.00020000.00000000.sdmp, Remittance_Advice 26042024.exe, 00000002.00000002.4158316953.00000000036E2000.00000004.00000800.00020000.00000000.sdmp, Remittance_Advice 26042024.exe, 00000002.00000002.4158316953.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, Remittance_Advice 26042024.exe, 00000002.00000002.4158316953.0000000003303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://innomedjsc.com
Source: Remittance_Advice 26042024.exe, 00000002.00000002.4158316953.00000000032BE000.00000004.00000800.00020000.00000000.sdmp, Remittance_Advice 26042024.exe, 00000002.00000002.4158316953.00000000036E2000.00000004.00000800.00020000.00000000.sdmp, Remittance_Advice 26042024.exe, 00000002.00000002.4158316953.00000000032A6000.00000004.00000800.00020000.00000000.sdmp, Remittance_Advice 26042024.exe, 00000002.00000002.4158316953.0000000003303000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.innomedjsc.com
Source: Remittance_Advice 26042024.exe String found in binary or memory: http://ocsp.comodoca.com0
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718208991.0000000005B89000.00000004.00000020.00020000.00000000.sdmp, Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718313926.0000000005BC0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.comtr
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1718695353.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1715861724.0000000004D37000.00000004.00000800.00020000.00000000.sdmp, Remittance_Advice 26042024.exe, 00000002.00000002.4155169187.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: Remittance_Advice 26042024.exe String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, cPKWk.cs .Net Code: kmY
Installs a global keyboard hook
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Remittance_Advice 26042024.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.Remittance_Advice 26042024.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_0175D2A4 0_2_0175D2A4
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE23E0 0_2_07AE23E0
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE20C8 0_2_07AE20C8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AEC788 0_2_07AEC788
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE1688 0_2_07AE1688
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE1441 0_2_07AE1441
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE1450 0_2_07AE1450
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE23D1 0_2_07AE23D1
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE0228 0_2_07AE0228
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE0219 0_2_07AE0219
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE20B8 0_2_07AE20B8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE10E0 0_2_07AE10E0
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AEF0F8 0_2_07AEF0F8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE10D1 0_2_07AE10D1
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AED018 0_2_07AED018
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE3060 0_2_07AE3060
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE3070 0_2_07AE3070
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE5F61 0_2_07AE5F61
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE5F70 0_2_07AE5F70
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AECBE0 0_2_07AECBE0
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE4901 0_2_07AE4901
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AE4910 0_2_07AE4910
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AEE820 0_2_07AEE820
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AEE812 0_2_07AEE812
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_01AB4308 2_2_01AB4308
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_01AB94B8 2_2_01AB94B8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_01AB4BD8 2_2_01AB4BD8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_01AB9C70 2_2_01AB9C70
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_01AB3FC0 2_2_01AB3FC0
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_01ABD2B8 2_2_01ABD2B8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068E56F8 2_2_068E56F8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068E3F68 2_2_068E3F68
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068EBD38 2_2_068EBD38
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068EDD48 2_2_068EDD48
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068E2AF8 2_2_068E2AF8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068E8BA8 2_2_068E8BA8
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068E9B08 2_2_068E9B08
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068E0040 2_2_068E0040
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068E3260 2_2_068E3260
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068E5018 2_2_068E5018
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_06A21123 2_2_06A21123
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_06A21128 2_2_06A21128
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_01ABD2B2 2_2_01ABD2B2
PE / OLE file has an invalid certificate
Source: Remittance_Advice 26042024.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1721948790.000000000A920000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Remittance_Advice 26042024.exe
Source: Remittance_Advice 26042024.exe, 00000000.00000000.1680867005.0000000000EDE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamexGm.exeX vs Remittance_Advice 26042024.exe
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1712311280.00000000014DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Remittance_Advice 26042024.exe
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1715861724.0000000004D37000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename76f839bd-d42d-4891-87f7-25bf59a41400.exe4 vs Remittance_Advice 26042024.exe
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1715861724.0000000004D37000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Remittance_Advice 26042024.exe
Source: Remittance_Advice 26042024.exe, 00000000.00000002.1714994810.00000000033B6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename76f839bd-d42d-4891-87f7-25bf59a41400.exe4 vs Remittance_Advice 26042024.exe
Source: Remittance_Advice 26042024.exe, 00000002.00000002.4155921492.00000000014F9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Remittance_Advice 26042024.exe
Source: Remittance_Advice 26042024.exe, 00000002.00000002.4155169187.000000000043E000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilename76f839bd-d42d-4891-87f7-25bf59a41400.exe4 vs Remittance_Advice 26042024.exe
Source: Remittance_Advice 26042024.exe Binary or memory string: OriginalFilenamexGm.exeX vs Remittance_Advice 26042024.exe
Uses 32bit PE files
Source: Remittance_Advice 26042024.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.Remittance_Advice 26042024.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: Remittance_Advice 26042024.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Remittance_Advice 26042024.exe.4349970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Remittance_Advice 26042024.exe.4349970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, cPs8D.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, 72CF8egH.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, G5CXsdn.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, 3uPsILA6U.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, 6oQOw74dfIt.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, aMIWm.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, V6lVDE50ADviJOgt3b.cs Security API names: _0020.SetAccessControl
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, V6lVDE50ADviJOgt3b.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, V6lVDE50ADviJOgt3b.cs Security API names: _0020.AddAccessRule
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, zH2Vy6oCtfE5Jlubgb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, V6lVDE50ADviJOgt3b.cs Security API names: _0020.SetAccessControl
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, V6lVDE50ADviJOgt3b.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, V6lVDE50ADviJOgt3b.cs Security API names: _0020.AddAccessRule
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, zH2Vy6oCtfE5Jlubgb.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Remittance_Advice 26042024.exe.log Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Mutant created: NULL
Source: Remittance_Advice 26042024.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Remittance_Advice 26042024.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Remittance_Advice 26042024.exe ReversingLabs: Detection: 36%
Source: Remittance_Advice 26042024.exe Virustotal: Detection: 47%
Source: unknown Process created: C:\Users\user\Desktop\Remittance_Advice 26042024.exe "C:\Users\user\Desktop\Remittance_Advice 26042024.exe"
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process created: C:\Users\user\Desktop\Remittance_Advice 26042024.exe "C:\Users\user\Desktop\Remittance_Advice 26042024.exe"
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process created: C:\Users\user\Desktop\Remittance_Advice 26042024.exe "C:\Users\user\Desktop\Remittance_Advice 26042024.exe" Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: Remittance_Advice 26042024.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Remittance_Advice 26042024.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.raw.unpack, V4uC3Iifq56IKQcfry.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.Remittance_Advice 26042024.exe.4349970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: Remittance_Advice 26042024.exe, Customer.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, V6lVDE50ADviJOgt3b.cs .Net Code: ckSKiGKpTj System.Reflection.Assembly.Load(byte[])
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, V6lVDE50ADviJOgt3b.cs .Net Code: ckSKiGKpTj System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_0175E920 pushad ; retf 0_2_0175E929
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AEC6C1 push edi; iretd 0_2_07AEC6C2
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 0_2_07AEC187 push edi; iretd 0_2_07AEC188
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_068EEF58 pushad ; retf 2_2_068EEF65
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_06A2822A push es; ret 2_2_06A28244
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Code function: 2_2_06A26D88 pushad ; iretd 2_2_06A26D95
Source: Remittance_Advice 26042024.exe Static PE information: section name: .text entropy: 7.965117649121771
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, QkitiHOXHrjc0ibgLu.cs High entropy of concatenated method names: 'Dispose', 'GHjMcnNv0p', 'CUPYCDejX8', 'Dhq11xhiYH', 'XOeMIiXoFk', 'EWSMzUlr36', 'ProcessDialogKey', 'LVGYLxbeM0', 'MRwYM8ZD5B', 'V0dYYBJwrA'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, VbZjkyg6SHBfsA2a5c.cs High entropy of concatenated method names: 'DJMQjwkUhb', 'jt8QJ4O9oA', 'njtQxtTgqE', 'mPlQN2kNHq', 'JRfQfmWKyd', 'BNfQoNFCam', 'zd7QF5MmLJ', 'BhdQX06Bc9', 'ywrQ0R82c2', 'StwQBgOVK5'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, Vw9LeIcLR10kXhLSce.cs High entropy of concatenated method names: 'ss2NZQcuC4', 'olgNDJBr54', 'MfNxEfbYqk', 'xofxrmPUKu', 'o8mxHsPDwm', 'NONxdaJquF', 'MWWxGWpxTg', 'jqZxgHLE7V', 'Eb6x9gPMnY', 'FmNxP5olO1'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, i4npy5LxrkUhwdY6kiL.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J9Ja6DWk5L', 'ejLa8fB1A7', 'GUKa3qwgg0', 'tOkapjfiWo', 'VB8aTgGfVJ', 'Oq9a4AvGmI', 's4kaSVPF8Z'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, MWmuxlLM4LqRjBiWLuI.cs High entropy of concatenated method names: 'Dfmv2OArlD', 'LYuvlKF2cQ', 'lJkviiP3n6', 'zyyvAJUeIb', 'ugZvZsvpO1', 'wOJvRZI1ic', 'cJKvDhHCDF', 'zEdvsKiICs', 'UNHvnuhcNM', 'VLLv5fkWSR'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, g0RhcB20uws1SX75Nl.cs High entropy of concatenated method names: 'hu2yUjRRL7', 'ExPyIHhPxO', 'x5aQL71ARp', 'e2qQM1Ctpy', 'VepytmTlMS', 'Uu1yV40fKI', 'iPZyeM5OqW', 'bfAy6Dmbfp', 'E28y8Yhp9r', 'YFSy3e0SvW'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, zqHxCdW6rp1yd0aCOD.cs High entropy of concatenated method names: 'wWyo2rkNvw', 'PRPolFdHPU', 'K2koiiU8y3', 'rSUoAbJ1D6', 'F8koZDR6kG', 'UB9oR0kSBQ', 'wnmoDywwLT', 'kMsosZhDNk', 'PERonGoWfX', 'utLo5Zv76s'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, AGjZDmSFkCArB1Lb05.cs High entropy of concatenated method names: 'vXYvMHnV7e', 'N3CvunVrf9', 'fNLvKRCkKh', 'WRFvjfxyWj', 'sNXvJSWNaV', 'T4bvNOWWlb', 'eFVvfCdwnD', 'Rs7QSCqWwS', 'h0hQUmcjlT', 'qiYQcnMJup'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, X5o7pNvGPEXF3LPnHU.cs High entropy of concatenated method names: 'rBNf7KsGS7', 'htSfJdE8qW', 'QgIfN5D3y2', 'cAefogFcWX', 'UyyfFp3InS', 'Md3NTNKaIw', 'n8CN4FuUo9', 'vlgNSLhiR1', 'twtNUYMPvs', 'E8kNceKxun'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, lQeA4VHsyUc9xRw24i.cs High entropy of concatenated method names: 'S3pWPZavnW', 'M2sWVTDyUv', 'TH5W6oCL2V', 'MREW8cEXT8', 'zcuWCNM7ou', 'JM8WE1LICB', 'GQBWrwG6DN', 'g1MWHPbdM4', 'wCDWdbYSMh', 'aa9WGoqgCN'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, iUHPWcN2naQjryAg8E.cs High entropy of concatenated method names: 'UbIMofKYRZ', 'QlwMFNNeqG', 'h9DM0oE285', 'CKmMBdO7vx', 'w41MWxl9pG', 'fJSMhmB3MV', 'V8LJwmlSZcLiZ2rCQu', 'uPrdHwFaWiQwtVZbDg', 'AQBMM2pVa1', 'uqyMuZrqGJ'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, qqHHVe1I74QFHsPjeB.cs High entropy of concatenated method names: 'lQNy0iKE60', 'BwAyBD8n8i', 'ToString', 'TJsyjUX3dN', 'NsvyJo6j69', 'eJiyxubFZu', 'Hj9yNYwBs4', 'qDkyfIkTca', 'iUSyobE6iG', 'pM9yFg0jWS'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, KRFSmBDjaJtSR5MEZy.cs High entropy of concatenated method names: 'OOuqslgTTl', 'Md2qnwqi9I', 'm34qmhXD3p', 'oFlqCW0qgx', 'KkVqrVqA3c', 'WYkqH2blNy', 'JxEqGFcr08', 'GJnqg2EIl3', 'hf5qPgM0MC', 'GVPqteIvJF'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, mOkB4WXILebSK75DL2.cs High entropy of concatenated method names: 't5xxAkZ2Jj', 'X28xRbjgxw', 'vwyxsUtn49', 'BqFxnDoPG4', 'FmCxWtKfKu', 'LgyxhhbtHy', 'MDhxyLe4nx', 'rZKxQYPB18', 'SGYxve7OV5', 'V8dxaueUGy'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, uZdw3kATrPC8URTVCE.cs High entropy of concatenated method names: 'LiWf3s1oZ7', 'OEQfpKJBI0', 'DfwfTo7cXs', 'ToString', 'KKaf4dhQGh', 'loNfScL8G4', 'K6F4Kr7Pw5nMiMIrjuy', 'UD9vbe7LxyoI5CXcFxe', 'etePBA799QV6yLlSph8'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, zH2Vy6oCtfE5Jlubgb.cs High entropy of concatenated method names: 'qI2J6IQdnv', 'l5lJ80Ahrp', 'Np3J35Ri6q', 'LE1JpNH0bu', 'BZqJTmq6rI', 'FHPJ4VkwNK', 'kTPJS0LRGS', 'grAJUvUqUQ', 'QI1JcG2rid', 'w52JI2X4cV'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, V6lVDE50ADviJOgt3b.cs High entropy of concatenated method names: 'RSfu7B2N86', 'IUBuj6xl6G', 'zjduJsgGLo', 'ArwuxkpTp0', 'dqPuNhPx7u', 'RlwufkD8c2', 'FTNuotqwdL', 'EoVuFp0J2H', 'MpRuXdX98U', 'RCMu0XMJll'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, bOU9RUzLRXeP8OITj5.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HqPvqu0987', 'RbLvWZEWIR', 'p4XvhGNnUJ', 'HF0vyDZKuy', 'aTEvQP9Rc9', 'gSqvv88stK', 'gHPva6Lp6D'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, GS0oRx4tMrwT7L8Ydf.cs High entropy of concatenated method names: 'YKviyYDQ0', 'mYPArSh8i', 'xnEROWTNq', 'bKGDd2nko', 'nABnn4ilc', 'EeX5E3Bap', 'WynwAaxuutM58fVBfp', 'Vo64CAocH04C3Hg0L7', 'o8nQZ2cXZ', 'u49aVON49'
Source: 0.2.Remittance_Advice 26042024.exe.a920000.8.raw.unpack, D6OhfCpyAsHYmerWJY.cs High entropy of concatenated method names: 'asCQms4dUv', 'ticQCluVb0', 'YcpQEiVqAj', 'daWQrsQFeT', 'zhgQ6EAFwN', 'bhbQHGT2Y1', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.raw.unpack, V4uC3Iifq56IKQcfry.cs High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.raw.unpack, vpednoN8EZgsJ4TDwx.cs High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 0.2.Remittance_Advice 26042024.exe.4349970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.Remittance_Advice 26042024.exe.4349970.4.raw.unpack, vpednoN8EZgsJ4TDwx.cs High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, QkitiHOXHrjc0ibgLu.cs High entropy of concatenated method names: 'Dispose', 'GHjMcnNv0p', 'CUPYCDejX8', 'Dhq11xhiYH', 'XOeMIiXoFk', 'EWSMzUlr36', 'ProcessDialogKey', 'LVGYLxbeM0', 'MRwYM8ZD5B', 'V0dYYBJwrA'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, VbZjkyg6SHBfsA2a5c.cs High entropy of concatenated method names: 'DJMQjwkUhb', 'jt8QJ4O9oA', 'njtQxtTgqE', 'mPlQN2kNHq', 'JRfQfmWKyd', 'BNfQoNFCam', 'zd7QF5MmLJ', 'BhdQX06Bc9', 'ywrQ0R82c2', 'StwQBgOVK5'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, Vw9LeIcLR10kXhLSce.cs High entropy of concatenated method names: 'ss2NZQcuC4', 'olgNDJBr54', 'MfNxEfbYqk', 'xofxrmPUKu', 'o8mxHsPDwm', 'NONxdaJquF', 'MWWxGWpxTg', 'jqZxgHLE7V', 'Eb6x9gPMnY', 'FmNxP5olO1'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, i4npy5LxrkUhwdY6kiL.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'J9Ja6DWk5L', 'ejLa8fB1A7', 'GUKa3qwgg0', 'tOkapjfiWo', 'VB8aTgGfVJ', 'Oq9a4AvGmI', 's4kaSVPF8Z'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, MWmuxlLM4LqRjBiWLuI.cs High entropy of concatenated method names: 'Dfmv2OArlD', 'LYuvlKF2cQ', 'lJkviiP3n6', 'zyyvAJUeIb', 'ugZvZsvpO1', 'wOJvRZI1ic', 'cJKvDhHCDF', 'zEdvsKiICs', 'UNHvnuhcNM', 'VLLv5fkWSR'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, g0RhcB20uws1SX75Nl.cs High entropy of concatenated method names: 'hu2yUjRRL7', 'ExPyIHhPxO', 'x5aQL71ARp', 'e2qQM1Ctpy', 'VepytmTlMS', 'Uu1yV40fKI', 'iPZyeM5OqW', 'bfAy6Dmbfp', 'E28y8Yhp9r', 'YFSy3e0SvW'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, zqHxCdW6rp1yd0aCOD.cs High entropy of concatenated method names: 'wWyo2rkNvw', 'PRPolFdHPU', 'K2koiiU8y3', 'rSUoAbJ1D6', 'F8koZDR6kG', 'UB9oR0kSBQ', 'wnmoDywwLT', 'kMsosZhDNk', 'PERonGoWfX', 'utLo5Zv76s'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, AGjZDmSFkCArB1Lb05.cs High entropy of concatenated method names: 'vXYvMHnV7e', 'N3CvunVrf9', 'fNLvKRCkKh', 'WRFvjfxyWj', 'sNXvJSWNaV', 'T4bvNOWWlb', 'eFVvfCdwnD', 'Rs7QSCqWwS', 'h0hQUmcjlT', 'qiYQcnMJup'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, X5o7pNvGPEXF3LPnHU.cs High entropy of concatenated method names: 'rBNf7KsGS7', 'htSfJdE8qW', 'QgIfN5D3y2', 'cAefogFcWX', 'UyyfFp3InS', 'Md3NTNKaIw', 'n8CN4FuUo9', 'vlgNSLhiR1', 'twtNUYMPvs', 'E8kNceKxun'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, lQeA4VHsyUc9xRw24i.cs High entropy of concatenated method names: 'S3pWPZavnW', 'M2sWVTDyUv', 'TH5W6oCL2V', 'MREW8cEXT8', 'zcuWCNM7ou', 'JM8WE1LICB', 'GQBWrwG6DN', 'g1MWHPbdM4', 'wCDWdbYSMh', 'aa9WGoqgCN'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, iUHPWcN2naQjryAg8E.cs High entropy of concatenated method names: 'UbIMofKYRZ', 'QlwMFNNeqG', 'h9DM0oE285', 'CKmMBdO7vx', 'w41MWxl9pG', 'fJSMhmB3MV', 'V8LJwmlSZcLiZ2rCQu', 'uPrdHwFaWiQwtVZbDg', 'AQBMM2pVa1', 'uqyMuZrqGJ'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, qqHHVe1I74QFHsPjeB.cs High entropy of concatenated method names: 'lQNy0iKE60', 'BwAyBD8n8i', 'ToString', 'TJsyjUX3dN', 'NsvyJo6j69', 'eJiyxubFZu', 'Hj9yNYwBs4', 'qDkyfIkTca', 'iUSyobE6iG', 'pM9yFg0jWS'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, KRFSmBDjaJtSR5MEZy.cs High entropy of concatenated method names: 'OOuqslgTTl', 'Md2qnwqi9I', 'm34qmhXD3p', 'oFlqCW0qgx', 'KkVqrVqA3c', 'WYkqH2blNy', 'JxEqGFcr08', 'GJnqg2EIl3', 'hf5qPgM0MC', 'GVPqteIvJF'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, mOkB4WXILebSK75DL2.cs High entropy of concatenated method names: 't5xxAkZ2Jj', 'X28xRbjgxw', 'vwyxsUtn49', 'BqFxnDoPG4', 'FmCxWtKfKu', 'LgyxhhbtHy', 'MDhxyLe4nx', 'rZKxQYPB18', 'SGYxve7OV5', 'V8dxaueUGy'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, uZdw3kATrPC8URTVCE.cs High entropy of concatenated method names: 'LiWf3s1oZ7', 'OEQfpKJBI0', 'DfwfTo7cXs', 'ToString', 'KKaf4dhQGh', 'loNfScL8G4', 'K6F4Kr7Pw5nMiMIrjuy', 'UD9vbe7LxyoI5CXcFxe', 'etePBA799QV6yLlSph8'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, zH2Vy6oCtfE5Jlubgb.cs High entropy of concatenated method names: 'qI2J6IQdnv', 'l5lJ80Ahrp', 'Np3J35Ri6q', 'LE1JpNH0bu', 'BZqJTmq6rI', 'FHPJ4VkwNK', 'kTPJS0LRGS', 'grAJUvUqUQ', 'QI1JcG2rid', 'w52JI2X4cV'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, V6lVDE50ADviJOgt3b.cs High entropy of concatenated method names: 'RSfu7B2N86', 'IUBuj6xl6G', 'zjduJsgGLo', 'ArwuxkpTp0', 'dqPuNhPx7u', 'RlwufkD8c2', 'FTNuotqwdL', 'EoVuFp0J2H', 'MpRuXdX98U', 'RCMu0XMJll'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, bOU9RUzLRXeP8OITj5.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HqPvqu0987', 'RbLvWZEWIR', 'p4XvhGNnUJ', 'HF0vyDZKuy', 'aTEvQP9Rc9', 'gSqvv88stK', 'gHPva6Lp6D'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, GS0oRx4tMrwT7L8Ydf.cs High entropy of concatenated method names: 'YKviyYDQ0', 'mYPArSh8i', 'xnEROWTNq', 'bKGDd2nko', 'nABnn4ilc', 'EeX5E3Bap', 'WynwAaxuutM58fVBfp', 'Vo64CAocH04C3Hg0L7', 'o8nQZ2cXZ', 'u49aVON49'
Source: 0.2.Remittance_Advice 26042024.exe.4fbc460.5.raw.unpack, D6OhfCpyAsHYmerWJY.cs High entropy of concatenated method names: 'asCQms4dUv', 'ticQCluVb0', 'YcpQEiVqAj', 'daWQrsQFeT', 'zhgQ6EAFwN', 'bhbQHGT2Y1', 'Next', 'Next', 'Next', 'NextBytes'
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Remittance_Advice 26042024.exe PID: 7264, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 1750000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 3340000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 1920000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 8430000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 7920000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 9430000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: A430000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: A9A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 8430000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 18D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 3250000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: 5250000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199969 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199859 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199750 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199640 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199531 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199420 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199311 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199203 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199085 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198974 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198859 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198750 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198640 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198531 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198422 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198312 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198203 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198093 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197984 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197875 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197765 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197653 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197547 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197437 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Window / User API: threadDelayed 1981 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Window / User API: threadDelayed 7846 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7284 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -24903104499507879s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -99875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -99766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -99657s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -99532s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -99407s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -99282s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -99172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -99063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98938s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98813s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98688s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98563s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98344s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -98000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -97891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -97781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -97672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -97563s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -97438s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -97329s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -97204s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -97079s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199969s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199420s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199311s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1199085s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198974s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1198093s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1197984s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1197875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1197765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1197653s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1197547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe TID: 7516 Thread sleep time: -1197437s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 99875 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 99766 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 99657 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 99532 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 99407 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 99282 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 99172 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 99063 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98938 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98813 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98688 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98563 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98453 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98344 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98219 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98109 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 98000 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 97891 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 97781 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 97672 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 97563 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 97438 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 97329 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 97204 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 97079 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199969 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199859 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199750 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199640 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199531 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199420 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199311 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199203 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1199085 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198974 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198859 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198750 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198640 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198531 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198422 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198312 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198203 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1198093 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197984 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197875 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197765 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197653 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197547 Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Thread delayed: delay time: 1197437 Jump to behavior
Source: Remittance_Advice 26042024.exe, 00000002.00000002.4157565310.0000000001628000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Memory written: C:\Users\user\Desktop\Remittance_Advice 26042024.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Process created: C:\Users\user\Desktop\Remittance_Advice 26042024.exe "C:\Users\user\Desktop\Remittance_Advice 26042024.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Users\user\Desktop\Remittance_Advice 26042024.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Users\user\Desktop\Remittance_Advice 26042024.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Remittance_Advice 26042024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.4158316953.000000000329E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4155169187.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4158316953.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1715861724.0000000004D37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Remittance_Advice 26042024.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Remittance_Advice 26042024.exe PID: 7440, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4349970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4349970.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1715861724.0000000004349000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1718379417.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Remittance_Advice 26042024.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Remittance_Advice 26042024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.4155169187.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4158316953.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1715861724.0000000004D37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Remittance_Advice 26042024.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Remittance_Advice 26042024.exe PID: 7440, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Remittance_Advice 26042024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f7aa60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4f3fa40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.4158316953.000000000329E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4155169187.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.4158316953.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1715861724.0000000004D37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Remittance_Advice 26042024.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Remittance_Advice 26042024.exe PID: 7440, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4349970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.4349970.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Remittance_Advice 26042024.exe.5d00000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1715861724.0000000004349000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1718379417.0000000005D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1432026 Sample: Remittance_Advice 26042024.exe Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 14 mail.innomedjsc.com 2->14 16 innomedjsc.com 2->16 20 Found malware configuration 2->20 22 Malicious sample detected (through community Yara rule) 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 9 other signatures 2->26 7 Remittance_Advice 26042024.exe 3 2->7         started        signatures3 process4 signatures5 28 Injects a PE file into a foreign processes 7->28 10 Remittance_Advice 26042024.exe 2 7->10         started        process6 dnsIp7 18 innomedjsc.com 192.249.117.241, 49737, 49746, 49747 IMH-WESTUS United States 10->18 30 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->30 32 Tries to steal Mail credentials (via file / registry access) 10->32 34 Tries to harvest and steal ftp login credentials 10->34 36 2 other signatures 10->36 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.249.117.241
 innomedjsc.com United States
22611 IMH-WESTUS false

Contacted Domains

Name IP Active
innomedjsc.com 192.249.117.241 true
mail.innomedjsc.com unknown unknown