Edit tour

Windows Analysis Report
Payment Summary 2025 11 2.exe

Overview

General Information

Sample name:	Payment Summary 2025 11 2.exe
Analysis ID:	1619000
MD5:	6b654cb879dd6171a27f49ede0640dd0
SHA1:	f3b604c42287475b70a3372ac271b083bf47d617
SHA256:	4c4b1980eed21f43c792e2d1727b36c9a6cf04b7732250d4559ca4a2f341dda8
Tags:	exeuser-TeamDreier
Infos:

Detection

GuLoader

Score:	96
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected GuLoader

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected Costura Assembly Loader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Payment Summary 2025 11 2.exe (PID: 2128 cmdline: "C:\Users\user\Desktop\Payment Summary 2025 11 2.exe" MD5: 6B654CB879DD6171A27F49EDE0640DD0)

Payment Summary 2025 11 2.exe (PID: 5532 cmdline: "C:\Users\user\Desktop\Payment Summary 2025 11 2.exe" MD5: 6B654CB879DD6171A27F49EDE0640DD0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.4011728377.0000000039D30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.3224497520.000000000597E000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Payment Summary 2025 11 2.exe PID: 5532	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Payment Summary 2025 11 2.exe PID: 5532	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.Payment Summary 2025 11 2.exe.39d30000.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
10.2.Payment Summary 2025 11 2.exe.38d35570.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.29.10.35, DestinationIsIpv6: false, DestinationPort: 2525, EventID: 3, Image: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe, Initiated: true, ProcessId: 5532, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49990

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T13:03:43.718563+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49988	142.250.184.206	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Payment Summary 2025 11 2.exe	Virustotal: Detection: 35%			Perma Link
Source: Payment Summary 2025 11 2.exe	ReversingLabs: Detection: 24%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: Payment Summary 2025 11 2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.184.206:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.6:49989 version: TLS 1.2

Source: Payment Summary 2025 11 2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038DD5000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4012096705.0000000039FF0000.00000004.08000000.00040000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038DD5000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4012096705.0000000039FF0000.00000004.08000000.00040000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_004065C7 FindFirstFileW,FindClose,	0_2_004065C7
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405996
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_00402868 FindFirstFileW,	10_2_00402868
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_004065C7 FindFirstFileW,FindClose,	10_2_004065C7
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_00405996 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	10_2_00405996

Source: global traffic

TCP traffic: 192.168.2.6:49990 -> 185.29.10.35:2525

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49988 -> 142.250.184.206:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sj HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sj&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sj HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sj&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: Payment Summary 2025 11 2.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3309488355.00000000076CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.torproject.org/tor-package-archive/torbrowser/13.0.9/tor-expert-bundle-windows-i686-
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.3986652777.0000000007658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.3986652777.0000000007694000.00000004.00000020.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.3988743151.0000000009160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sj
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.3986652777.0000000007694000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sjm
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3353328108.00000000076CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3309488355.00000000076CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sj&export=download
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.3986652777.00000000076B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sj&export=downloada
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.3986652777.00000000076B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1yib4SG1oMrk31TRhSrZqC1b5h2AZQ3sj&export=downloade
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038DD5000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4012096705.0000000039FF0000.00000004.08000000.00040000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038DD5000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4012096705.0000000039FF0000.00000004.08000000.00040000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038DD5000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4012096705.0000000039FF0000.00000004.08000000.00040000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3309488355.00000000076CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038DD5000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4012096705.0000000039FF0000.00000004.08000000.00040000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038DD5000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp, Payment Summary 2025 11 2.exe, 0000000A.00000002.4012096705.0000000039FF0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3309488355.00000000076CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3309488355.00000000076CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3309488355.00000000076CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3309488355.00000000076CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 142.250.184.206:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.6:49989 version: TLS 1.2

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe

Code function: 0_2_0040542B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040542B

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment Summary 2025 11 2.exe

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403359
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_00403359

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	File created: C:\Windows\superaccomplished	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	File created: C:\Windows\besvres	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	File created: C:\Windows\resources\0809	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	File created: C:\Windows\resources\0809\sonnetization	Jump to behavior

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_00404C68	0_2_00404C68
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_0040698E	0_2_0040698E
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_738B1B63	0_2_738B1B63
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_00404C68	10_2_00404C68
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_0040698E	10_2_0040698E
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_07439718	10_2_07439718
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_07431108	10_2_07431108
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_07431118	10_2_07431118
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_37D10740	10_2_37D10740
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_37D117E8	10_2_37D117E8
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_37D10A77	10_2_37D10A77
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D612D8	10_2_39D612D8
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D848B0	10_2_39D848B0
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D894C8	10_2_39D894C8
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D89C13	10_2_39D89C13
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D848A3	10_2_39D848A3
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D88D1F	10_2_39D88D1F
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D88D20	10_2_39D88D20
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D88CF1	10_2_39D88CF1
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D894BF	10_2_39D894BF
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D8D45E	10_2_39D8D45E
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D89702	10_2_39D89702
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D8961F	10_2_39D8961F

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe

Code function: String function: 00402C41 appears 51 times

Source: Payment Summary 2025 11 2.exe, 00000000.00000000.2108734301.000000000046A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekijev gitanos.exeL vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038E6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXxpwmhfkeb.dll" vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038F83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXxpwmhfkeb.dll" vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3356281062.0000000039DBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038DD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3356326196.0000000039DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4012018767.0000000039EB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameXxpwmhfkeb.dll" vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000000.3214191175.000000000046A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekijev gitanos.exeL vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000003.3356343401.0000000039DD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4012096705.0000000039FF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037D31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXxpwmhfkeb.dll" vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclrjit.dllT vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Payment Summary 2025 11 2.exe
Source: Payment Summary 2025 11 2.exe	Binary or memory string: OriginalFilenamekijev gitanos.exeL vs Payment Summary 2025 11 2.exe

Source: Payment Summary 2025 11 2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 10.2.Payment Summary 2025 11 2.exe.38ec5ed0.2.raw.unpack, YlMelZl4hpIy77SlH5C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.Payment Summary 2025 11 2.exe.38ec5ed0.2.raw.unpack, YlMelZl4hpIy77SlH5C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.Payment Summary 2025 11 2.exe.38ec5ed0.2.raw.unpack, YlMelZl4hpIy77SlH5C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, YlMelZl4hpIy77SlH5C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, YlMelZl4hpIy77SlH5C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, YlMelZl4hpIy77SlH5C.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, MPDTZm31hDcORmv6RpR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, MPDTZm31hDcORmv6RpR.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal96.troj.evad.winEXE@3/19@2/3

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403359
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_00403359 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		10_2_00403359

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe

Code function: 0_2_004046EC GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046EC

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe

File created: C:\Program Files (x86)\lineamentation

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Mutant created: \Sessions\1\BaseNamedObjects\19cf617f23b5914f

Source: unknown	Process created: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe "C:\Users\user\Desktop\Payment Summary 2025 11 2.exe"
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process created: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe "C:\Users\user\Desktop\Payment Summary 2025 11 2.exe"
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process created: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe "C:\Users\user\Desktop\Payment Summary 2025 11 2.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Section loaded: userenv.dll	Jump to behavior

Source: 10.2.Payment Summary 2025 11 2.exe.38ec5ed0.2.raw.unpack, YlMelZl4hpIy77SlH5C.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, YlMelZl4hpIy77SlH5C.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, AssemblyLoader.cs	.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, NMK5lsyDpALGS9Gdbt.cs	.Net Code: QNZ72Oppq System.AppDomain.Load(byte[])
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, WAOD5gcCEpDhSbJShGL.cs	.Net Code: wVTsj2WE2F
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, WAOD5gcCEpDhSbJShGL.cs	.Net Code: KvaEEs6b1g
Source: 10.2.Payment Summary 2025 11 2.exe.38d857b0.6.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 10.2.Payment Summary 2025 11 2.exe.38d857b0.6.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 10.2.Payment Summary 2025 11 2.exe.38d857b0.6.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 10.2.Payment Summary 2025 11 2.exe.38d857b0.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 10.2.Payment Summary 2025 11 2.exe.38d857b0.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 10.2.Payment Summary 2025 11 2.exe.39ff0000.10.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 10.2.Payment Summary 2025 11 2.exe.39ff0000.10.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 10.2.Payment Summary 2025 11 2.exe.39ff0000.10.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 10.2.Payment Summary 2025 11 2.exe.39ff0000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 10.2.Payment Summary 2025 11 2.exe.39ff0000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 10.2.Payment Summary 2025 11 2.exe.38dd57d0.7.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 10.2.Payment Summary 2025 11 2.exe.38dd57d0.7.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 10.2.Payment Summary 2025 11 2.exe.38dd57d0.7.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 10.2.Payment Summary 2025 11 2.exe.38dd57d0.7.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 10.2.Payment Summary 2025 11 2.exe.38dd57d0.7.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Source: Yara match	File source: 10.2.Payment Summary 2025 11 2.exe.39d30000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Payment Summary 2025 11 2.exe.38d35570.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.4011728377.0000000039D30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4011438294.0000000038D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Summary 2025 11 2.exe PID: 5532, type: MEMORYSTR

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 0_2_738B2FD0 push eax; ret	0_2_738B2FFE
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_07434C5E push eax; retf	10_2_07434C6D
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_37CB066C push es; retf	10_2_37CB0676
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_37D1B1CB push eax; iretd	10_2_37D1B1D1
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_37D1D0B0 pushad ; iretd	10_2_37D1D0B1
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_37D1D02C pushad ; iretd	10_2_37D1D02E
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D88838 push eax; iretw	10_2_39D88839
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D84030 push 6C37CF3Bh; retf	10_2_39D8403D
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D8D3F7 push edx; retf	10_2_39D8D403
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D87DF1 pushad ; iretd	10_2_39D87DF2
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D87DE9 pushad ; iretd	10_2_39D87DEA
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D845E0 pushfd ; iretd	10_2_39D845E1
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D84580 pushad ; iretd	10_2_39D84581
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D88453 push eax; iretd	10_2_39D88459
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D87E13 pushad ; iretd	10_2_39D87E1A
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D8C63E push BEFFFFFFh; ret	10_2_39D8C643
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D87E30 pushad ; iretd	10_2_39D87E3A
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_39D88633 push esp; iretd	10_2_39D88639
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_3A3128F2 pushfd ; ret	10_2_3A3128F3
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_3A313D13 push edi; ret	10_2_3A313D16
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_3A313519 push eax; retf	10_2_3A31351F
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Code function: 10_2_3A31594D push edi; ret	10_2_3A315953

Source: 10.2.Payment Summary 2025 11 2.exe.38ec5ed0.2.raw.unpack, eA78HTcp9I7VPlGhCB8.cs	High entropy of concatenated method names: 'pQGcEVTOaP', 'tsScakt6W0', 'OPXciRItPs', 'YimcRp3ke3', 'FivcBOeijo', 'rkmcyTPMmW', 'UjgcMxLQ72', 'mLic8YMicJ', 'skxckO5PeH', 'bsec7YOUXu'
Source: 10.2.Payment Summary 2025 11 2.exe.38ec5ed0.2.raw.unpack, YlMelZl4hpIy77SlH5C.cs	High entropy of concatenated method names: 'N0k2yOLaLPA5MTuEUj8', 'vePWayLiHd2xMRuyZlv', 'Divb0dY418', 'vh0ry9Sq2v', 'UUPb608reO', 'fZxbTr2RYJ', 'OPnb1AtiII', 'f0xbrCsNMU', 'lXYDapXZhX', 'QVLllpnHkY'
Source: 10.2.Payment Summary 2025 11 2.exe.38ec5ed0.2.raw.unpack, NMK5lsyDpALGS9Gdbt.cs	High entropy of concatenated method names: 'ASBefbdYd', 'wW1DHm1p5', 'bU0Fa8A2X', 'LARHe956f', 'P9i8Nl6tX', 'RkAkBU2KG', 'QNZ72Oppq', 'XWWC8vQOp', 'kjwLwBDe5', 'R8j9rXCXx'
Source: 10.2.Payment Summary 2025 11 2.exe.38ec5ed0.2.raw.unpack, WAOD5gcCEpDhSbJShGL.cs	High entropy of concatenated method names: 'Kk9iakD0KY', 'RJyiinokS2', 'rbIiRNEDy2', 'hmwiBjgZ99', 'syLiy0WEaJ', 'YNviM9q7qE', 'cnui8M98Uv', 'cRlcrhhUvQ', 'YQFik2ODV2', 'OyKi7LvFWo'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, eA78HTcp9I7VPlGhCB8.cs	High entropy of concatenated method names: 'pQGcEVTOaP', 'tsScakt6W0', 'OPXciRItPs', 'YimcRp3ke3', 'FivcBOeijo', 'rkmcyTPMmW', 'UjgcMxLQ72', 'mLic8YMicJ', 'skxckO5PeH', 'bsec7YOUXu'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, YlMelZl4hpIy77SlH5C.cs	High entropy of concatenated method names: 'N0k2yOLaLPA5MTuEUj8', 'vePWayLiHd2xMRuyZlv', 'Divb0dY418', 'vh0ry9Sq2v', 'UUPb608reO', 'fZxbTr2RYJ', 'OPnb1AtiII', 'f0xbrCsNMU', 'lXYDapXZhX', 'QVLllpnHkY'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, CX8wTjQuFyOvYcYMmB5.cs	High entropy of concatenated method names: 'cublGMdY4I', 'BJS6EyLuxPkhW5TuwWI', 'wQE0KhLqCexGsUAZ4qr', 'xnPQ4gfpeR', 'NfeQ3ocsN0', 'HEQQlGOAHY', 'QZLQbhxN6t', 'cyKQcTO9cj', 'DvRQ5jIm9E', 'ATJcMj7kEULMluyJR1j'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, NMK5lsyDpALGS9Gdbt.cs	High entropy of concatenated method names: 'ASBefbdYd', 'wW1DHm1p5', 'bU0Fa8A2X', 'LARHe956f', 'P9i8Nl6tX', 'RkAkBU2KG', 'QNZ72Oppq', 'XWWC8vQOp', 'kjwLwBDe5', 'R8j9rXCXx'
Source: 10.2.Payment Summary 2025 11 2.exe.39eb0000.9.raw.unpack, WAOD5gcCEpDhSbJShGL.cs	High entropy of concatenated method names: 'Kk9iakD0KY', 'RJyiinokS2', 'rbIiRNEDy2', 'hmwiBjgZ99', 'syLiy0WEaJ', 'YNviM9q7qE', 'cnui8M98Uv', 'cRlcrhhUvQ', 'YQFik2ODV2', 'OyKi7LvFWo'

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	API/Special instruction interceptor: Address: 620F9B6
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	API/Special instruction interceptor: Address: 488F9B6

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	RDTSC instruction interceptor: First address: 61CDD4B second address: 61CDD4B instructions: 0x00000000 rdtsc 0x00000002 cmp dl, cl 0x00000004 test bl, cl 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F26DCB54199h 0x0000000a cmp ecx, edx 0x0000000c test edx, eax 0x0000000e inc ebp 0x0000000f cmp ecx, 3D413367h 0x00000015 inc ebx 0x00000016 cmp ah, FFFFFFE3h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	RDTSC instruction interceptor: First address: 484DD4B second address: 484DD4B instructions: 0x00000000 rdtsc 0x00000002 cmp dl, cl 0x00000004 test bl, cl 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F26DC4F6E79h 0x0000000a cmp ecx, edx 0x0000000c test edx, eax 0x0000000e inc ebp 0x0000000f cmp ecx, 3D413367h 0x00000015 inc ebx 0x00000016 cmp ah, FFFFFFE3h 0x00000019 rdtsc

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Memory allocated: 73F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Memory allocated: 37D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Memory allocated: 378E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe TID: 1208	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe TID: 1208	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe TID: 2644	Thread sleep count: 199 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe TID: 1208	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	Thread delayed: delay time: 35000	Jump to behavior

Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0VMware\|VIRTUAL\|A M I\|Xen4win32_process.handle='{0}'
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.3986652777.0000000007694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnQ
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.3986652777.00000000076B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dllDselect * from Win32_ComputerSystem
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.4009738029.0000000037DE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: Payment Summary 2025 11 2.exe, 0000000A.00000002.3986652777.0000000007658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	API call chain: ExitProcess graph end node			graph_0-4908
Source: C:\Users\user\Desktop\Payment Summary 2025 11 2.exe	API call chain: ExitProcess graph end node			graph_0-4911

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	31 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	214 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Deobfuscate/Decode Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Summary 2025 11 2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Payment Summary 2025 11 2.exe