Edit tour

Windows Analysis Report
Payment Receipt 0002994040595069600079000079700000.exe

Overview

General Information

Sample name:	Payment Receipt 0002994040595069600079000079700000.exe
Analysis ID:	1608136
MD5:	4ab27fd8abf2cb87f1e79900e01f69f6
SHA1:	aeaab1bf04a8161f12cf9ef6b8a53b52213dee82
SHA256:	5b72ed928f8a9e98082f9d22d1966a0bfea8222c51041311a6ab5b1339c8f95c
Tags:	exeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample has a suspicious name (potential lure to open the executable)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Payment Receipt 0002994040595069600079000079700000.exe (PID: 7000 cmdline: "C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe" MD5: 4AB27FD8ABF2CB87F1E79900E01F69F6)

Payment Receipt 0002994040595069600079000079700000.exe (PID: 7156 cmdline: "C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe" MD5: 4AB27FD8ABF2CB87F1E79900E01F69F6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.4149136349.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4149136349.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4149136349.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4147852130.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4147852130.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1673052878.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1673052878.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1673052878.00000000038E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1673052878.00000000038E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payment Receipt 000299404059506960007900007 PID: 7000	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment Receipt 000299404059506960007900007 PID: 7000	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payment Receipt 0002994040595069600079000079700000.exe PID: 7156	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment Receipt 0002994040595069600079000079700000.exe PID: 7156	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bf9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30e3d:$s2: GetPrivateProfileString 0x30540:$s3: get_OSFullName 0x31c11:$s5: remove_Key 0x31dd9:$s5: remove_Key 0x32d01:$s6: FtpWebRequest 0x33adf:$s7: logins 0x34051:$s7: logins 0x36d62:$s7: logins 0x36e14:$s7: logins 0x38766:$s7: logins 0x379ae:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31df9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f03d:$s2: GetPrivateProfileString 0x2e740:$s3: get_OSFullName 0x2fe11:$s5: remove_Key 0x2ffd9:$s5: remove_Key 0x30f01:$s6: FtpWebRequest 0x31cdf:$s7: logins 0x32251:$s7: logins 0x34f62:$s7: logins 0x35014:$s7: logins 0x36966:$s7: logins 0x35bae:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bf9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30e3d:$s2: GetPrivateProfileString 0x30540:$s3: get_OSFullName 0x31c11:$s5: remove_Key 0x31dd9:$s5: remove_Key 0x32d01:$s6: FtpWebRequest 0x33adf:$s7: logins 0x34051:$s7: logins 0x36d62:$s7: logins 0x36e14:$s7: logins 0x38766:$s7: logins 0x379ae:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 7 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Payment Receipt 0002994040595069600079000079700000.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://concaribe.com	Avira URL Cloud: Label: malware
Source: http://ftp.concaribe.com	Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Multi AV Scanner detection for submitted file

Source: Payment Receipt 0002994040595069600079000079700000.exe	Virustotal: Detection: 45%			Perma Link
Source: Payment Receipt 0002994040595069600079000079700000.exe	ReversingLabs: Detection: 39%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Payment Receipt 0002994040595069600079000079700000.exe

Joe Sandbox ML: detected

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Runpe\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\Piver.pdb source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672848237.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672977456.00000000028E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Nova\source\repos\watchman\watchman\obj\Debug\watchman.pdb source: Payment Receipt 0002994040595069600079000079700000.exe
Source:	Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Runpe\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\Piver.pdb_JyJ kJ_CorDllMainmscoree.dll source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672848237.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672977456.00000000028E1000.00000004.00000800.00020000.00000000.sdmp

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 192.185.13.234 192.185.13.234

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.concaribe.com

Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4149136349.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://concaribe.com
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4149136349.00000000032FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.concaribe.com
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4149136349.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1673052878.00000000038E1000.00000004.00000800.00020000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1673052878.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4147852130.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1673052878.00000000038E1000.00000004.00000800.00020000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1673052878.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4147852130.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4149136349.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4149136349.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4149136349.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, cPKWk.cs

.Net Code: ojpIFBdoe

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment Receipt 0002994040595069600079000079700000.exe

Sample has a suspicious name (potential lure to open the executable)

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static file information: Suspicious name

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 0_2_00F747E8	0_2_00F747E8
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_0173A228	1_2_0173A228
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_0173E770	1_2_0173E770
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_01734A58	1_2_01734A58
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_0173AAB0	1_2_0173AAB0
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_01733E40	1_2_01733E40
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_01734188	1_2_01734188
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D3A8B4	1_2_06D3A8B4
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D3A598	1_2_06D3A598
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D3BDF0	1_2_06D3BDF0
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D3DBF0	1_2_06D3DBF0
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D566C0	1_2_06D566C0
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D556A0	1_2_06D556A0
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D5C240	1_2_06D5C240
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D52380	1_2_06D52380
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D5B300	1_2_06D5B300
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D57E40	1_2_06D57E40
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D57760	1_2_06D57760
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D5E468	1_2_06D5E468
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D50040	1_2_06D50040
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D55DC8	1_2_06D55DC8
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D50006	1_2_06D50006

Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672848237.00000000028CC000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePiver.dllH vs Payment Receipt 0002994040595069600079000079700000.exe
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672357283.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment Receipt 0002994040595069600079000079700000.exe
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1673052878.00000000038E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs Payment Receipt 0002994040595069600079000079700000.exe
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672977456.0000000002932000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePiver.dllH vs Payment Receipt 0002994040595069600079000079700000.exe
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672977456.0000000002932000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs Payment Receipt 0002994040595069600079000079700000.exe
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000000.1669713984.0000000000572000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewatchman.exe2 vs Payment Receipt 0002994040595069600079000079700000.exe
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4147950407.00000000010F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Payment Receipt 0002994040595069600079000079700000.exe
Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4147852130.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs Payment Receipt 0002994040595069600079000079700000.exe
Source: Payment Receipt 0002994040595069600079000079700000.exe	Binary or memory string: OriginalFilenamewatchman.exe2 vs Payment Receipt 0002994040595069600079000079700000.exe

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: Payment Receipt 0002994040595069600079000079700000.exe, Meantime.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Receipt 0002994040595069600079000079700000.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Mutant created: NULL

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Payment Receipt 0002994040595069600079000079700000.exe	Virustotal: Detection: 45%
Source: Payment Receipt 0002994040595069600079000079700000.exe	ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe "C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe"
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process created: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe "C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe"
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process created: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe "C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Runpe\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\Piver.pdb source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672848237.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672977456.00000000028E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Nova\source\repos\watchman\watchman\obj\Debug\watchman.pdb source: Payment Receipt 0002994040595069600079000079700000.exe
Source:	Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Runpe\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\Piver.pdb_JyJ kJ_CorDllMainmscoree.dll source: Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672848237.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, Payment Receipt 0002994040595069600079000079700000.exe, 00000000.00000002.1672977456.00000000028E1000.00000004.00000800.00020000.00000000.sdmp

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: 0xAA9B0FA3 [Mon Sep 13 08:13:23 2060 UTC]

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_01730C55 push edi; retf		1_2_01730C7A
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Code function: 1_2_06D33FCF push 2406E3DAh; retf		1_2_06D33FD5

Source: Payment Receipt 0002994040595069600079000079700000.exe

Static PE information: section name: .text entropy: 7.811913370148884

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Memory allocated: F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Memory allocated: 28E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Memory allocated: 48E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Memory allocated: 16F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Memory allocated: 3280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599828	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599717	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599609	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599498	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599171	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599062	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597402	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597184	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597037	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595693	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594660	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594421	Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Window / User API: threadDelayed 1543			Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Window / User API: threadDelayed 8312			Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 7072	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 5780	Thread sleep count: 1543 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -599828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 5780	Thread sleep count: 8312 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -599717s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -599609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -599498s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -599390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -599281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -599171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -599062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597402s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597184s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -597037s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595693s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -594660s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe TID: 1740	Thread sleep time: -594421s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599828	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599717	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599609	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599498	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599171	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 599062	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597402	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597184	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 597037	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595693	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594660	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Thread delayed: delay time: 594421	Jump to behavior

Source: Payment Receipt 0002994040595069600079000079700000.exe, 00000001.00000002.4148117723.00000000014CD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.28c0000.0.raw.unpack, Nive.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.28c0000.0.raw.unpack, Nive.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, Ljq6xD21ACX.cs	Reference to suspicious API methods: OZkujShDCVG.OpenProcess(aPNZ30.DuplicateHandle, bInheritHandle: true, (uint)snUp2.ProcessID)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Memory written: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Process created: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe "C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4149136349.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4149136349.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4147852130.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673052878.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673052878.00000000038E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Receipt 000299404059506960007900007 PID: 7000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Receipt 0002994040595069600079000079700000.exe PID: 7156, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Payment Receipt 0002994040595069600079000079700000.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4149136349.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4147852130.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673052878.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673052878.00000000038E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Receipt 000299404059506960007900007 PID: 7000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Receipt 0002994040595069600079000079700000.exe PID: 7156, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.Payment Receipt 0002994040595069600079000079700000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Receipt 0002994040595069600079000079700000.exe.3a0c638.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4149136349.00000000032FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4149136349.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4147852130.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673052878.0000000003A4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673052878.00000000038E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Receipt 000299404059506960007900007 PID: 7000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Receipt 0002994040595069600079000079700000.exe PID: 7156, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Payment Receipt 0002994040595069600079000079700000.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Receipt 0002994040595069600079000079700000.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Payment Receipt 0002994040595069600079000079700000.exe