Edit tour

Windows Analysis Report
Payment Advice.exe

Overview

General Information

Sample name:	Payment Advice.exe
Analysis ID:	1630045
MD5:	78ec5a1e11ee68c95a5e339fd492c90e
SHA1:	8423eca2ecf74c50f6f688d0555adf9b0a5ace2b
SHA256:	eb43ef748d41451eb6cbbf8ca967116280e754d24122b2961472f90c8c00aa9a
Tags:	exeuser-threatcat_ch
Infos:

Detection

MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Payment Advice.exe (PID: 2708 cmdline: "C:\Users\user\Desktop\Payment Advice.exe" MD5: 78EC5A1E11EE68C95A5E339FD492C90E)

powershell.exe (PID: 2852 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Payment Advice.exe (PID: 3320 cmdline: "C:\Users\user\Desktop\Payment Advice.exe" MD5: 78EC5A1E11EE68C95A5E339FD492C90E)

Payment Advice.exe (PID: 5216 cmdline: "C:\Users\user\Desktop\Payment Advice.exe" MD5: 78EC5A1E11EE68C95A5E339FD492C90E)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7678702526:AAFF62U3olv_d14DtUBN4vurBh3ZPT14VQ8", "Telegram Chatid": "6440213344"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefdf:$a1: get_encryptedPassword 0xf307:$a2: get_encryptedUsername 0xed7a:$a3: get_timePasswordChanged 0xee9b:$a4: get_passwordField 0xeff5:$a5: set_encryptedPassword 0x10951:$a7: get_logins 0x10602:$a8: GetOutlookPasswords 0x103f4:$a9: StartKeylogger 0x108a1:$a10: KeyLoggerEventArgs 0x10451:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27577:$a1: get_encryptedPassword 0x2789f:$a2: get_encryptedUsername 0x27312:$a3: get_timePasswordChanged 0x27433:$a4: get_passwordField 0x2758d:$a5: set_encryptedPassword 0x28ee9:$a7: get_logins 0x28b9a:$a8: GetOutlookPasswords 0x2898c:$a9: StartKeylogger 0x28e39:$a10: KeyLoggerEventArgs 0x289e9:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.2996681350.0000000003523000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x72587:$a1: get_encryptedPassword 0x891a7:$a1: get_encryptedPassword 0x728af:$a2: get_encryptedUsername 0x894cf:$a2: get_encryptedUsername 0x72322:$a3: get_timePasswordChanged 0x88f42:$a3: get_timePasswordChanged 0x72443:$a4: get_passwordField 0x89063:$a4: get_passwordField 0x7259d:$a5: set_encryptedPassword 0x891bd:$a5: set_encryptedPassword 0x73ef9:$a7: get_logins 0x8ab19:$a7: get_logins 0x73baa:$a8: GetOutlookPasswords 0x8a7ca:$a8: GetOutlookPasswords 0x7399c:$a9: StartKeylogger 0x8a5bc:$a9: StartKeylogger 0x73e49:$a10: KeyLoggerEventArgs 0x8aa69:$a10: KeyLoggerEventArgs 0x739f9:$a11: KeyLoggerEventArgsEventHandler 0x8a619:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Payment Advice.exe PID: 2708	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Payment Advice.exe PID: 2708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment Advice.exe PID: 2708	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Payment Advice.exe PID: 2708	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: Payment Advice.exe PID: 2708	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Payment Advice.exe PID: 2708	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x24161:$a1: get_encryptedPassword 0x84384:$a1: get_encryptedPassword 0x2447a:$a2: get_encryptedUsername 0x8469d:$a2: get_encryptedUsername 0x23f10:$a3: get_timePasswordChanged 0x84133:$a3: get_timePasswordChanged 0x24031:$a4: get_passwordField 0x84254:$a4: get_passwordField 0x24177:$a5: set_encryptedPassword 0x8439a:$a5: set_encryptedPassword 0x25a7a:$a7: get_logins 0x85c9d:$a7: get_logins 0x2572b:$a8: GetOutlookPasswords 0x8594e:$a8: GetOutlookPasswords 0x2551d:$a9: StartKeylogger 0x85740:$a9: StartKeylogger 0x259ca:$a10: KeyLoggerEventArgs 0x85bed:$a10: KeyLoggerEventArgs 0x2557a:$a11: KeyLoggerEventArgsEventHandler 0x8579d:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Payment Advice.exe PID: 5216	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Payment Advice.exe PID: 5216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payment Advice.exe PID: 5216	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: Payment Advice.exe PID: 5216	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Payment Advice.exe PID: 5216	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5d05:$a1: get_encryptedPassword 0x601e:$a2: get_encryptedUsername 0x5ab4:$a3: get_timePasswordChanged 0x5bd5:$a4: get_passwordField 0x5d1b:$a5: set_encryptedPassword 0x761e:$a7: get_logins 0x72cf:$a8: GetOutlookPasswords 0x70c1:$a9: StartKeylogger 0x756e:$a10: KeyLoggerEventArgs 0x711e:$a11: KeyLoggerEventArgsEventHandler
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Payment Advice.exe.3db1398.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Payment Advice.exe.3db1398.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice.exe.3db1398.2.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.Payment Advice.exe.3db1398.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Payment Advice.exe.3db1398.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
0.2.Payment Advice.exe.3db1398.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data
0.2.Payment Advice.exe.3e343a8.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Payment Advice.exe.3e343a8.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice.exe.3e343a8.5.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.Payment Advice.exe.3e343a8.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Payment Advice.exe.3e343a8.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
0.2.Payment Advice.exe.3e343a8.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1238b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11889:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b97:$a4: \Orbitum\User Data\Default\Login Data 0x1298f:$a5: \Kometa\User Data\Default\Login Data
5.2.Payment Advice.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
5.2.Payment Advice.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.Payment Advice.exe.400000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
5.2.Payment Advice.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.Payment Advice.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
5.2.Payment Advice.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data
0.2.Payment Advice.exe.3db1398.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Payment Advice.exe.3db1398.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice.exe.3db1398.2.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.Payment Advice.exe.3db1398.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Payment Advice.exe.3db1398.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
0.2.Payment Advice.exe.3db1398.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1238b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11889:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b97:$a4: \Orbitum\User Data\Default\Login Data 0x1298f:$a5: \Kometa\User Data\Default\Login Data
0.2.Payment Advice.exe.3e343a8.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Payment Advice.exe.3e343a8.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payment Advice.exe.3e343a8.5.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.Payment Advice.exe.3e343a8.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Payment Advice.exe.3e343a8.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0x25dff:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0x26127:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0x25b9a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0x25cbb:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x25e15:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x27771:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x27422:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x27214:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x276c1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler 0x27271:$a11: KeyLoggerEventArgsEventHandler
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ParentImage: C:\Users\user\Desktop\Payment Advice.exe, ParentProcessId: 2708, ParentProcessName: Payment Advice.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", ProcessId: 2852, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment Advice.exe", ParentImage: C:\Users\user\Desktop\Payment Advice.exe, ParentProcessId: 2708, ParentProcessName: Payment Advice.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe", ProcessId: 2852, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T13:08:21.158505+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7678702526:AAFF62U3olv_d14DtUBN4vurBh3ZPT14VQ8", "Telegram Chatid": "6440213344"}

Multi AV Scanner detection for submitted file

Source: Payment Advice.exe

Virustotal: Detection: 34%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Payment Advice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49735 version: TLS 1.0

Source: Payment Advice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: iAbl.pdbSHA256j~^ source: Payment Advice.exe
Source:	Binary string: iAbl.pdb source: Payment Advice.exe

Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 4x nop then jmp 0796B8FFh	0_2_0796B20A
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 4x nop then jmp 01875782h	5_2_01875367
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 4x nop then jmp 018751B9h	5_2_01874F08
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 4x nop then jmp 01875782h	5_2_018756AF

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 132.226.247.73:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49735 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000346C000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Payment Advice.exe, 00000005.00000002.2996681350.0000000003401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: Payment Advice.exe, 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000349C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000349C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: Payment Advice.exe, 00000000.00000002.1762503668.000000000308E000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2996681350.0000000003401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Payment Advice.exe, 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Payment Advice.exe, 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payment Advice.exe

Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_0110DE94	0_2_0110DE94
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_079636B2	0_2_079636B2
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_07966790	0_2_07966790
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_0796675A	0_2_0796675A
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_07968398	0_2_07968398
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_07968388	0_2_07968388
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_07967000	0_2_07967000
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_07966FF1	0_2_07966FF1
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_07968DD0	0_2_07968DD0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_07966BC8	0_2_07966BC8
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_0187C168	5_2_0187C168
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_018727B9	5_2_018727B9
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_0187A7E1	5_2_0187A7E1
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_0187CA58	5_2_0187CA58
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_01872DD1	5_2_01872DD1
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_01874F08	5_2_01874F08
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_01877E68	5_2_01877E68
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_0187B9D0	5_2_0187B9D0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_0187B9E0	5_2_0187B9E0
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_01874EF8	5_2_01874EF8
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_01877E67	5_2_01877E67

Source: Payment Advice.exe, 00000000.00000002.1761916348.000000000114E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1762503668.0000000002DCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1766331923.0000000005F90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000000.1742483100.0000000000AB4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiAbl.exe0 vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1767293510.00000000078F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Payment Advice.exe
Source: Payment Advice.exe, 00000000.00000002.1762503668.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs Payment Advice.exe
Source: Payment Advice.exe, 00000005.00000002.2994910866.000000000041A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs Payment Advice.exe
Source: Payment Advice.exe, 00000005.00000002.2995068041.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Payment Advice.exe
Source: Payment Advice.exe	Binary or memory string: OriginalFilenameiAbl.exe0 vs Payment Advice.exe

Source: Payment Advice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Payment Advice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, V0od1GpONNlKZ74lAd.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, V0od1GpONNlKZ74lAd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, V0od1GpONNlKZ74lAd.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, V0od1GpONNlKZ74lAd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, V0od1GpONNlKZ74lAd.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, V0od1GpONNlKZ74lAd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/6@2/2

Source: C:\Users\user\Desktop\Payment Advice.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Advice.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1720:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjtn34di.qcx.ps1

Jump to behavior

Source: Payment Advice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Payment Advice.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Payment Advice.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Payment Advice.exe, 00000005.00000002.2996681350.00000000034EE000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2996681350.00000000034DE000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2996681350.00000000034FC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Payment Advice.exe

Virustotal: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Payment Advice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Payment Advice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Payment Advice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Payment Advice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: iAbl.pdbSHA256j~^ source: Payment Advice.exe
Source:	Binary string: iAbl.pdb source: Payment Advice.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	.Net Code: bAAWV5gLEV System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice.exe.2eddbfc.0.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	.Net Code: bAAWV5gLEV System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	.Net Code: bAAWV5gLEV System.Reflection.Assembly.Load(byte[])
Source: 0.2.Payment Advice.exe.5f90000.6.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: Payment Advice.exe

Static PE information: 0xD22D0139 [Sat Sep 27 02:13:13 2081 UTC]

Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_0796DE05 push FFFFFF8Bh; iretd	0_2_0796DE07
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_0796DCEF push dword ptr [ebx+ebp-75h]; iretd	0_2_0796DD15
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 0_2_07968A64 pushfd ; ret	0_2_07968A65
Source: C:\Users\user\Desktop\Payment Advice.exe	Code function: 5_2_0187F273 push ebp; retf	5_2_0187F281

Source: Payment Advice.exe

Static PE information: section name: .text entropy: 7.6054071879897105

Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, u24XxM8uRIoTpav9E2.cs	High entropy of concatenated method names: 'Ios4oGXpVE', 'JaS43scBeL', 'TBt4IZVdnL', 'Nnk4EH0nCN', 'u77xs4dgjMve3awyxvI', 'O3tkUMdP1ohbgdHMHYI', 'nJx62sdojb8rgr5eyNK', 'QBh6ypdfVqfP5J2x7Rr'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, V0od1GpONNlKZ74lAd.cs	High entropy of concatenated method names: 'oS3tLhb6ui', 'wnSt81ZogZ', 'niytc7xIW5', 'PkZt5RaBEy', 'pW7tA9Ks8u', 'r5OtOeiP7L', 'i67toF6ibk', 'VhVt3sAdi3', 'lp2tI0WnR1', 'r4ltEeq9p8'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, cLBVf8vxft4stwplCk.cs	High entropy of concatenated method names: 'uElDYUnniX', 'qogD1XJsBH', 'tioDVn8w2Y', 'FH4D2lL56N', 'JJqDBE6415', 't9YDlYQY0r', 'FJTDb9UAn3', 'CVHDpbkaFi', 'JBVDqG6yfg', 'CjYDdZpFKD'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, V1TjnGssHvunMsGa5Eb.cs	High entropy of concatenated method names: 'F76iEa8fgP', 'ceFizyETVh', 'A3RMwjioeJ', 'YwyMsUdBrI', 'sF0MgwYuOY', 'YQUMKETxmp', 'Xb9MWXh4Hh', 'pHwMTEuCc3', 'lFRMuSQhnO', 'BmMMtN1dst'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, Tmqavsg8mMuu42rPYF.cs	High entropy of concatenated method names: 'gBEVYjiLK', 'vDp21M1HV', 'PPll7Bbmq', 'sfGbUrCKj', 'nw5qNo1PP', 'FE8dG5wEe', 'qikmx7lMJdk2CscBwb', 'DcWTOK2vGElA0VANfu', 'C2djIZ4UW', 'Nu4irNR9L'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, e0GJdvoX7FLALSqXBB.cs	High entropy of concatenated method names: 'Dd9G4GrfyS', 'N1QGUR1VYv', 'VEbGGPruDn', 'qSCGMqqJoK', 'jOFGPSBcJ7', 'HyvGrEnRVI', 'Dispose', 'VFtjuhdk7F', 'm37jtMfqL6', 'YDyj7SNKlk'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, D7kjX5E8wnBR9dmFol.cs	High entropy of concatenated method names: 'vRBi7GLes8', 'tCPiFW8OMc', 'aeuiyIphdE', 'FhOiDjfv2O', 'gmQiGTJa1Z', 'iDDi9Wkdwk', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, mLmW3OCpnpqE18nJXc.cs	High entropy of concatenated method names: 'TdlXpRo1yS', 'LKnXqqTky2', 'fmMXhJjOi7', 'xekXedIG9D', 'xahXnZt4yI', 'zp9XQ7URUX', 'J2UXxc0chi', 'yALXNNAHme', 'DVAXSfVHR9', 'CbpXmZN84s'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, D9fIhtzgI70fuFLfL8.cs	High entropy of concatenated method names: 'UJ4ilxbfNo', 'v6YipWwTKI', 'dIqiqGfbf5', 'IvMihj75aU', 'W1Bie6rgXs', 'HmSin84mgV', 'f9AiQxweq4', 'vIVirkAcEW', 'aijiYE8CSP', 'AWvi1XRxQR'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, JqfdkMd0ddEo7nCNGc.cs	High entropy of concatenated method names: 'ReLFBZWsIW', 'kjNFbN0ZCu', 'tRK76TZni3', 'Ifs7nVV66h', 'r4G7QGvEvO', 'HjA7HUKq2H', 'TAa7xeXT8Z', 'RZR7N4ud5F', 'yaR7vlAPDT', 'F117SIj26y'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, Xcvjh2qGxiEDr0S8vo.cs	High entropy of concatenated method names: 'IUW72xd9Uj', 'ivM7lRxutY', 'CZh7ph1X4N', 'i6f7qAiFxv', 'vnQ746FYok', 'Q0f7f8wLRh', 'lFX7U5fsXr', 'kKX7jpNWnQ', 'hcG7GvbnWa', 'Mft7i9ZnF9'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, oWqsALsW1iwXN1h3kju.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HluZG81wAQ', 'JfZZi2UUTl', 'JLdZMxFH25', 'ma7ZZKOKso', 'OeqZPp96Is', 'PsgZ0JNqOQ', 'gWvZrPjGiW'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, DxAo2jOv4eQMN8950u.cs	High entropy of concatenated method names: 'LvEU3jvRfy', 'I9SUEXdxYO', 'QVajwrf9Un', 'EDkjsEQR77', 't4mUmPLAiL', 'nKjURPxkPk', 'jcoUCZ2SPU', 'S5tULm2Dmn', 'Q8nU8kiD3s', 'bD0UcpPVCI'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, cHCrHP7pHPpQHmwNll.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Q6egI7qio2', 'DDOgEujtMV', 'f3IgzkK6LJ', 'hSMKw0hvRj', 'kMuKsuc6xh', 'd9XKgevibc', 'pcvKKLLZrA', 'y4SL4pNJUfERROE0Eso'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, c7HHP8tld33bUMM6HI.cs	High entropy of concatenated method names: 'Dispose', 'iLAsILSqXB', 'b51gepU8RB', 'cJu7pLcNv6', 'AiBsEu7P8r', 'f4MszrhBZd', 'ProcessDialogKey', 'tungwH4ota', 'WRlgsJOKv3', 'VO2ggb7kjX'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, IH4otaIoRlJOKv3OO2.cs	High entropy of concatenated method names: 'bqbGhCxYpb', 'R9VGeyFgsu', 'FDJG63dPBj', 'DZ7Gn35pUt', 'ByOGQ8X2Zk', 'nOnGHuKcsh', 'mo9Gx6X1FD', 'IuaGNdvpc8', 'KoXGvOawAf', 'LJ8GSpjOSv'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, LRRNOAswi6QDbTcFmFG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'C2xim88VxS', 'ysaiRk0X2d', 'yPxiCoZss2', 'lHEiLXgVUW', 'K4Pi8GHaj2', 'MuZick8hyl', 'nV6i5FV1JX'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, UwINc6WPeWx2cQLcGX.cs	High entropy of concatenated method names: 'dMosD0od1G', 'VNNs9lKZ74', 'AGxskiEDr0', 'N8vsJoQqfd', 'ICNs4Gclkn', 'yMQsfr7NFD', 'QvbD4e3XQGZ0dY5MS2', 'MCiZxFHodbeJNdcgrb', 'ROqssdWaPj', 'IWbsKfgnL9'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, PlaOlGx5mN833C3ruy.cs	High entropy of concatenated method names: 'uMDDuLugr7', 'NJqD7lgHvf', 'rVJDyxEtS8', 'uRtyEwoDOC', 'wj5yzo1nXP', 'zO8Dwpgsu3', 'sMeDsLTTD5', 'H6sDgsVx9q', 'ck0DKq40dS', 'kBiDWOVwWb'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, nXdkee5FZdtlC42u5A.cs	High entropy of concatenated method names: 'EcvUk3ICZA', 'AbkUJ4vcr5', 'ToString', 'zI7UuslB3N', 'oJAUtRQYLC', 'GFlU7Decus', 'UU7UFIw4Gr', 'TWFUyUQRwC', 'mMjUDXDZb7', 'PR9U9NVo96'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, GivQ3LLx62vMKmY2FE.cs	High entropy of concatenated method names: 'DjW4SiQV8q', 'Cfh4Raqkcf', 'tYV4LIDIQU', 'DXX48V9o4O', 'qEQ4e9edCo', 'dJc46DY3eE', 'yrF4noh3cj', 'nL34QwlLou', 'oQP4HAmSlJ', 'coy4x1BTZa'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	High entropy of concatenated method names: 'PWjKTrSW51', 'lbaKus9gkL', 'BsdKtFlqL5', 'zwOK7oIOPC', 'yNFKFXmyxs', 'YC8KyTj51L', 'owKKDVVuiO', 'vc9K91KvRO', 'Pi3KaIKjor', 'ExVKk1YByn'
Source: 0.2.Payment Advice.exe.3fa9c98.4.raw.unpack, Bkn1MQhr7NFDffWBKY.cs	High entropy of concatenated method names: 'yyXyTmQdfj', 'CHUytQZZ6F', 'gRvyFBmVIs', 'PmPyDbsAG5', 's2Fy9At8Ur', 'Xu6FAhSNk7', 'UavFOTXZ57', 'tRlFowAO3D', 'IXOF3iphBM', 'T13FIGyYik'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, u24XxM8uRIoTpav9E2.cs	High entropy of concatenated method names: 'Ios4oGXpVE', 'JaS43scBeL', 'TBt4IZVdnL', 'Nnk4EH0nCN', 'u77xs4dgjMve3awyxvI', 'O3tkUMdP1ohbgdHMHYI', 'nJx62sdojb8rgr5eyNK', 'QBh6ypdfVqfP5J2x7Rr'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, V0od1GpONNlKZ74lAd.cs	High entropy of concatenated method names: 'oS3tLhb6ui', 'wnSt81ZogZ', 'niytc7xIW5', 'PkZt5RaBEy', 'pW7tA9Ks8u', 'r5OtOeiP7L', 'i67toF6ibk', 'VhVt3sAdi3', 'lp2tI0WnR1', 'r4ltEeq9p8'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, cLBVf8vxft4stwplCk.cs	High entropy of concatenated method names: 'uElDYUnniX', 'qogD1XJsBH', 'tioDVn8w2Y', 'FH4D2lL56N', 'JJqDBE6415', 't9YDlYQY0r', 'FJTDb9UAn3', 'CVHDpbkaFi', 'JBVDqG6yfg', 'CjYDdZpFKD'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, V1TjnGssHvunMsGa5Eb.cs	High entropy of concatenated method names: 'F76iEa8fgP', 'ceFizyETVh', 'A3RMwjioeJ', 'YwyMsUdBrI', 'sF0MgwYuOY', 'YQUMKETxmp', 'Xb9MWXh4Hh', 'pHwMTEuCc3', 'lFRMuSQhnO', 'BmMMtN1dst'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, Tmqavsg8mMuu42rPYF.cs	High entropy of concatenated method names: 'gBEVYjiLK', 'vDp21M1HV', 'PPll7Bbmq', 'sfGbUrCKj', 'nw5qNo1PP', 'FE8dG5wEe', 'qikmx7lMJdk2CscBwb', 'DcWTOK2vGElA0VANfu', 'C2djIZ4UW', 'Nu4irNR9L'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, e0GJdvoX7FLALSqXBB.cs	High entropy of concatenated method names: 'Dd9G4GrfyS', 'N1QGUR1VYv', 'VEbGGPruDn', 'qSCGMqqJoK', 'jOFGPSBcJ7', 'HyvGrEnRVI', 'Dispose', 'VFtjuhdk7F', 'm37jtMfqL6', 'YDyj7SNKlk'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, D7kjX5E8wnBR9dmFol.cs	High entropy of concatenated method names: 'vRBi7GLes8', 'tCPiFW8OMc', 'aeuiyIphdE', 'FhOiDjfv2O', 'gmQiGTJa1Z', 'iDDi9Wkdwk', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, mLmW3OCpnpqE18nJXc.cs	High entropy of concatenated method names: 'TdlXpRo1yS', 'LKnXqqTky2', 'fmMXhJjOi7', 'xekXedIG9D', 'xahXnZt4yI', 'zp9XQ7URUX', 'J2UXxc0chi', 'yALXNNAHme', 'DVAXSfVHR9', 'CbpXmZN84s'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, D9fIhtzgI70fuFLfL8.cs	High entropy of concatenated method names: 'UJ4ilxbfNo', 'v6YipWwTKI', 'dIqiqGfbf5', 'IvMihj75aU', 'W1Bie6rgXs', 'HmSin84mgV', 'f9AiQxweq4', 'vIVirkAcEW', 'aijiYE8CSP', 'AWvi1XRxQR'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, JqfdkMd0ddEo7nCNGc.cs	High entropy of concatenated method names: 'ReLFBZWsIW', 'kjNFbN0ZCu', 'tRK76TZni3', 'Ifs7nVV66h', 'r4G7QGvEvO', 'HjA7HUKq2H', 'TAa7xeXT8Z', 'RZR7N4ud5F', 'yaR7vlAPDT', 'F117SIj26y'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, Xcvjh2qGxiEDr0S8vo.cs	High entropy of concatenated method names: 'IUW72xd9Uj', 'ivM7lRxutY', 'CZh7ph1X4N', 'i6f7qAiFxv', 'vnQ746FYok', 'Q0f7f8wLRh', 'lFX7U5fsXr', 'kKX7jpNWnQ', 'hcG7GvbnWa', 'Mft7i9ZnF9'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, oWqsALsW1iwXN1h3kju.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HluZG81wAQ', 'JfZZi2UUTl', 'JLdZMxFH25', 'ma7ZZKOKso', 'OeqZPp96Is', 'PsgZ0JNqOQ', 'gWvZrPjGiW'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, DxAo2jOv4eQMN8950u.cs	High entropy of concatenated method names: 'LvEU3jvRfy', 'I9SUEXdxYO', 'QVajwrf9Un', 'EDkjsEQR77', 't4mUmPLAiL', 'nKjURPxkPk', 'jcoUCZ2SPU', 'S5tULm2Dmn', 'Q8nU8kiD3s', 'bD0UcpPVCI'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, cHCrHP7pHPpQHmwNll.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Q6egI7qio2', 'DDOgEujtMV', 'f3IgzkK6LJ', 'hSMKw0hvRj', 'kMuKsuc6xh', 'd9XKgevibc', 'pcvKKLLZrA', 'y4SL4pNJUfERROE0Eso'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, c7HHP8tld33bUMM6HI.cs	High entropy of concatenated method names: 'Dispose', 'iLAsILSqXB', 'b51gepU8RB', 'cJu7pLcNv6', 'AiBsEu7P8r', 'f4MszrhBZd', 'ProcessDialogKey', 'tungwH4ota', 'WRlgsJOKv3', 'VO2ggb7kjX'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, IH4otaIoRlJOKv3OO2.cs	High entropy of concatenated method names: 'bqbGhCxYpb', 'R9VGeyFgsu', 'FDJG63dPBj', 'DZ7Gn35pUt', 'ByOGQ8X2Zk', 'nOnGHuKcsh', 'mo9Gx6X1FD', 'IuaGNdvpc8', 'KoXGvOawAf', 'LJ8GSpjOSv'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, LRRNOAswi6QDbTcFmFG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'C2xim88VxS', 'ysaiRk0X2d', 'yPxiCoZss2', 'lHEiLXgVUW', 'K4Pi8GHaj2', 'MuZick8hyl', 'nV6i5FV1JX'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, UwINc6WPeWx2cQLcGX.cs	High entropy of concatenated method names: 'dMosD0od1G', 'VNNs9lKZ74', 'AGxskiEDr0', 'N8vsJoQqfd', 'ICNs4Gclkn', 'yMQsfr7NFD', 'QvbD4e3XQGZ0dY5MS2', 'MCiZxFHodbeJNdcgrb', 'ROqssdWaPj', 'IWbsKfgnL9'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, PlaOlGx5mN833C3ruy.cs	High entropy of concatenated method names: 'uMDDuLugr7', 'NJqD7lgHvf', 'rVJDyxEtS8', 'uRtyEwoDOC', 'wj5yzo1nXP', 'zO8Dwpgsu3', 'sMeDsLTTD5', 'H6sDgsVx9q', 'ck0DKq40dS', 'kBiDWOVwWb'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, nXdkee5FZdtlC42u5A.cs	High entropy of concatenated method names: 'EcvUk3ICZA', 'AbkUJ4vcr5', 'ToString', 'zI7UuslB3N', 'oJAUtRQYLC', 'GFlU7Decus', 'UU7UFIw4Gr', 'TWFUyUQRwC', 'mMjUDXDZb7', 'PR9U9NVo96'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, GivQ3LLx62vMKmY2FE.cs	High entropy of concatenated method names: 'DjW4SiQV8q', 'Cfh4Raqkcf', 'tYV4LIDIQU', 'DXX48V9o4O', 'qEQ4e9edCo', 'dJc46DY3eE', 'yrF4noh3cj', 'nL34QwlLou', 'oQP4HAmSlJ', 'coy4x1BTZa'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	High entropy of concatenated method names: 'PWjKTrSW51', 'lbaKus9gkL', 'BsdKtFlqL5', 'zwOK7oIOPC', 'yNFKFXmyxs', 'YC8KyTj51L', 'owKKDVVuiO', 'vc9K91KvRO', 'Pi3KaIKjor', 'ExVKk1YByn'
Source: 0.2.Payment Advice.exe.78f0000.7.raw.unpack, Bkn1MQhr7NFDffWBKY.cs	High entropy of concatenated method names: 'yyXyTmQdfj', 'CHUytQZZ6F', 'gRvyFBmVIs', 'PmPyDbsAG5', 's2Fy9At8Ur', 'Xu6FAhSNk7', 'UavFOTXZ57', 'tRlFowAO3D', 'IXOF3iphBM', 'T13FIGyYik'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, u24XxM8uRIoTpav9E2.cs	High entropy of concatenated method names: 'Ios4oGXpVE', 'JaS43scBeL', 'TBt4IZVdnL', 'Nnk4EH0nCN', 'u77xs4dgjMve3awyxvI', 'O3tkUMdP1ohbgdHMHYI', 'nJx62sdojb8rgr5eyNK', 'QBh6ypdfVqfP5J2x7Rr'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, V0od1GpONNlKZ74lAd.cs	High entropy of concatenated method names: 'oS3tLhb6ui', 'wnSt81ZogZ', 'niytc7xIW5', 'PkZt5RaBEy', 'pW7tA9Ks8u', 'r5OtOeiP7L', 'i67toF6ibk', 'VhVt3sAdi3', 'lp2tI0WnR1', 'r4ltEeq9p8'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, cLBVf8vxft4stwplCk.cs	High entropy of concatenated method names: 'uElDYUnniX', 'qogD1XJsBH', 'tioDVn8w2Y', 'FH4D2lL56N', 'JJqDBE6415', 't9YDlYQY0r', 'FJTDb9UAn3', 'CVHDpbkaFi', 'JBVDqG6yfg', 'CjYDdZpFKD'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, V1TjnGssHvunMsGa5Eb.cs	High entropy of concatenated method names: 'F76iEa8fgP', 'ceFizyETVh', 'A3RMwjioeJ', 'YwyMsUdBrI', 'sF0MgwYuOY', 'YQUMKETxmp', 'Xb9MWXh4Hh', 'pHwMTEuCc3', 'lFRMuSQhnO', 'BmMMtN1dst'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, Tmqavsg8mMuu42rPYF.cs	High entropy of concatenated method names: 'gBEVYjiLK', 'vDp21M1HV', 'PPll7Bbmq', 'sfGbUrCKj', 'nw5qNo1PP', 'FE8dG5wEe', 'qikmx7lMJdk2CscBwb', 'DcWTOK2vGElA0VANfu', 'C2djIZ4UW', 'Nu4irNR9L'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, e0GJdvoX7FLALSqXBB.cs	High entropy of concatenated method names: 'Dd9G4GrfyS', 'N1QGUR1VYv', 'VEbGGPruDn', 'qSCGMqqJoK', 'jOFGPSBcJ7', 'HyvGrEnRVI', 'Dispose', 'VFtjuhdk7F', 'm37jtMfqL6', 'YDyj7SNKlk'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, D7kjX5E8wnBR9dmFol.cs	High entropy of concatenated method names: 'vRBi7GLes8', 'tCPiFW8OMc', 'aeuiyIphdE', 'FhOiDjfv2O', 'gmQiGTJa1Z', 'iDDi9Wkdwk', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, mLmW3OCpnpqE18nJXc.cs	High entropy of concatenated method names: 'TdlXpRo1yS', 'LKnXqqTky2', 'fmMXhJjOi7', 'xekXedIG9D', 'xahXnZt4yI', 'zp9XQ7URUX', 'J2UXxc0chi', 'yALXNNAHme', 'DVAXSfVHR9', 'CbpXmZN84s'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, D9fIhtzgI70fuFLfL8.cs	High entropy of concatenated method names: 'UJ4ilxbfNo', 'v6YipWwTKI', 'dIqiqGfbf5', 'IvMihj75aU', 'W1Bie6rgXs', 'HmSin84mgV', 'f9AiQxweq4', 'vIVirkAcEW', 'aijiYE8CSP', 'AWvi1XRxQR'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, JqfdkMd0ddEo7nCNGc.cs	High entropy of concatenated method names: 'ReLFBZWsIW', 'kjNFbN0ZCu', 'tRK76TZni3', 'Ifs7nVV66h', 'r4G7QGvEvO', 'HjA7HUKq2H', 'TAa7xeXT8Z', 'RZR7N4ud5F', 'yaR7vlAPDT', 'F117SIj26y'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, Xcvjh2qGxiEDr0S8vo.cs	High entropy of concatenated method names: 'IUW72xd9Uj', 'ivM7lRxutY', 'CZh7ph1X4N', 'i6f7qAiFxv', 'vnQ746FYok', 'Q0f7f8wLRh', 'lFX7U5fsXr', 'kKX7jpNWnQ', 'hcG7GvbnWa', 'Mft7i9ZnF9'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, oWqsALsW1iwXN1h3kju.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HluZG81wAQ', 'JfZZi2UUTl', 'JLdZMxFH25', 'ma7ZZKOKso', 'OeqZPp96Is', 'PsgZ0JNqOQ', 'gWvZrPjGiW'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, DxAo2jOv4eQMN8950u.cs	High entropy of concatenated method names: 'LvEU3jvRfy', 'I9SUEXdxYO', 'QVajwrf9Un', 'EDkjsEQR77', 't4mUmPLAiL', 'nKjURPxkPk', 'jcoUCZ2SPU', 'S5tULm2Dmn', 'Q8nU8kiD3s', 'bD0UcpPVCI'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, cHCrHP7pHPpQHmwNll.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Q6egI7qio2', 'DDOgEujtMV', 'f3IgzkK6LJ', 'hSMKw0hvRj', 'kMuKsuc6xh', 'd9XKgevibc', 'pcvKKLLZrA', 'y4SL4pNJUfERROE0Eso'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, c7HHP8tld33bUMM6HI.cs	High entropy of concatenated method names: 'Dispose', 'iLAsILSqXB', 'b51gepU8RB', 'cJu7pLcNv6', 'AiBsEu7P8r', 'f4MszrhBZd', 'ProcessDialogKey', 'tungwH4ota', 'WRlgsJOKv3', 'VO2ggb7kjX'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, IH4otaIoRlJOKv3OO2.cs	High entropy of concatenated method names: 'bqbGhCxYpb', 'R9VGeyFgsu', 'FDJG63dPBj', 'DZ7Gn35pUt', 'ByOGQ8X2Zk', 'nOnGHuKcsh', 'mo9Gx6X1FD', 'IuaGNdvpc8', 'KoXGvOawAf', 'LJ8GSpjOSv'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, LRRNOAswi6QDbTcFmFG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'C2xim88VxS', 'ysaiRk0X2d', 'yPxiCoZss2', 'lHEiLXgVUW', 'K4Pi8GHaj2', 'MuZick8hyl', 'nV6i5FV1JX'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, UwINc6WPeWx2cQLcGX.cs	High entropy of concatenated method names: 'dMosD0od1G', 'VNNs9lKZ74', 'AGxskiEDr0', 'N8vsJoQqfd', 'ICNs4Gclkn', 'yMQsfr7NFD', 'QvbD4e3XQGZ0dY5MS2', 'MCiZxFHodbeJNdcgrb', 'ROqssdWaPj', 'IWbsKfgnL9'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, PlaOlGx5mN833C3ruy.cs	High entropy of concatenated method names: 'uMDDuLugr7', 'NJqD7lgHvf', 'rVJDyxEtS8', 'uRtyEwoDOC', 'wj5yzo1nXP', 'zO8Dwpgsu3', 'sMeDsLTTD5', 'H6sDgsVx9q', 'ck0DKq40dS', 'kBiDWOVwWb'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, nXdkee5FZdtlC42u5A.cs	High entropy of concatenated method names: 'EcvUk3ICZA', 'AbkUJ4vcr5', 'ToString', 'zI7UuslB3N', 'oJAUtRQYLC', 'GFlU7Decus', 'UU7UFIw4Gr', 'TWFUyUQRwC', 'mMjUDXDZb7', 'PR9U9NVo96'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, GivQ3LLx62vMKmY2FE.cs	High entropy of concatenated method names: 'DjW4SiQV8q', 'Cfh4Raqkcf', 'tYV4LIDIQU', 'DXX48V9o4O', 'qEQ4e9edCo', 'dJc46DY3eE', 'yrF4noh3cj', 'nL34QwlLou', 'oQP4HAmSlJ', 'coy4x1BTZa'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, wnc5bH9fX7sv7Za8LK.cs	High entropy of concatenated method names: 'PWjKTrSW51', 'lbaKus9gkL', 'BsdKtFlqL5', 'zwOK7oIOPC', 'yNFKFXmyxs', 'YC8KyTj51L', 'owKKDVVuiO', 'vc9K91KvRO', 'Pi3KaIKjor', 'ExVKk1YByn'
Source: 0.2.Payment Advice.exe.3f4e878.3.raw.unpack, Bkn1MQhr7NFDffWBKY.cs	High entropy of concatenated method names: 'yyXyTmQdfj', 'CHUytQZZ6F', 'gRvyFBmVIs', 'PmPyDbsAG5', 's2Fy9At8Ur', 'Xu6FAhSNk7', 'UavFOTXZ57', 'tRlFowAO3D', 'IXOF3iphBM', 'T13FIGyYik'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR

Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 4D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 9100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: A100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: A310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: B310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 1870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 3400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5271			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4524			Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe TID: 6312	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5296	Thread sleep time: -3689348814741908s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Payment Advice.exe, 00000000.00000002.1761916348.00000000011B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\H
Source: Payment Advice.exe, 00000005.00000002.2995203152.000000000162F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA

Source: C:\Users\user\Desktop\Payment Advice.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Code function: 5_2_0187C168 LdrInitializeThunk,LdrInitializeThunk,

5_2_0187C168

Source: C:\Users\user\Desktop\Payment Advice.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Payment Advice.exe

Memory written: C:\Users\user\Desktop\Payment Advice.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Process created: C:\Users\user\Desktop\Payment Advice.exe "C:\Users\user\Desktop\Payment Advice.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Users\user\Desktop\Payment Advice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Users\user\Desktop\Payment Advice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payment Advice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Payment Advice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Payment Advice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Payment Advice.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2996681350.0000000003523000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Payment Advice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3db1398.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payment Advice.exe.3e343a8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 2708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Payment Advice.exe PID: 5216, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Security Software Discovery	Distributed Component Object Model	1 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment Advice.exe	35%	Virustotal		Browse

Source	Detection	Scanner	Label
http://www.fontbureau.com/designersG	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/?	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers?	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/frere-user.html	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers8	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	Avira URL Cloud	safe
http://www.fonts.com	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.80.1	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://reallyfreegeoip.orgd	Payment Advice.exe, 00000005.00000002.2996681350.000000000349C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	Payment Advice.exe, 00000005.00000002.2996681350.000000000346C000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.189l	Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.comd	Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	Payment Advice.exe, 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.189d	Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	Payment Advice.exe, 00000005.00000002.2996681350.000000000349C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.com	Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/d	Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Payment Advice.exe, 00000000.00000002.1762503668.000000000308E000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2996681350.0000000003401000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Payment Advice.exe, 00000000.00000002.1766484792.0000000007002000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot-/sendDocument?chat_id=	Payment Advice.exe, 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	Payment Advice.exe, 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Payment Advice.exe, 00000005.00000002.2996681350.000000000347E000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.80.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States		16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1630045
Start date and time:	2025-03-05 13:07:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment Advice.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 38 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 4.245.163.56, 13.107.246.60
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:08:17	API Interceptor	1x Sleep call for process: Payment Advice.exe modified
07:08:19	API Interceptor	10x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.80.1	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	Marzec 2025-faktura.pdf.exe	Get hash	malicious	FormBook	Browse	www.oldpay.online/u023/?lneDc=2js00DxFGjY6gHlVOW1q9a10L3HzPIs7WpRmaT2A/LnakQk0VzYAjcxSKMUcEwKHsPPKaiHoQA==&NvExnX=FrapFFYPB
	z1companyProfileandproducts.exe	Get hash	malicious	FormBook	Browse	www.dd87558.vip/uoki/
	http://7a.ithuupvudv.ru	Get hash	malicious	Unknown	Browse	7a.ithuupvudv.ru/favicon.ico
	PRI_VTK250419A.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/scc1/five/fre.php
	dfiCWCanbj.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	laser (2).ps1	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	laser.ps1	Get hash	malicious	FormBook	Browse	www.tumbetgirislinki.fit/k566/
	QUOTATION REQUEST.exe	Get hash	malicious	FormBook	Browse	www.shlomi.app/t3l4/
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.askvtwv8.top/uztg/
132.226.247.73	50% deposit's payment advice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rPurchaseOrder-25-1201.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase Order # 8MJA15.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	akXjj2a58b.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	r59e5aba5-e690-44bf-a397-997e3c24c602.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.PWSX-gen.10368.23675.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	BOOOKING -872872928229JK.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.SuspectCrc.5906.14432.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	rt94UFPUzw1WEsSM.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Payment details.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	20250301_173245__P20250301_173245__P.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	MARCH SHIPMENT PLAN DOCS.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	Purchase-New Order PO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	SNKO05B250200012 SNKO05B250200023.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Payment Advice.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	rarrivalnotice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	50% deposit's payment advice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	FACTURAS PENDIENTES.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
reallyfreegeoip.org	Payment details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	20250301_173245__P20250301_173245__P.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	MARCH SHIPMENT PLAN DOCS.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	Purchase-New Order PO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	SNKO05B250200012 SNKO05B250200023.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	Payment Advice.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	rarrivalnotice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	50% deposit's payment advice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	FACTURAS PENDIENTES.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	cbr.arm.elf	Get hash	malicious	Mirai	Browse	1.4.15.178
	output.cmd	Get hash	malicious	AgentTesla, Batch Injector, Discord Token Stealer	Browse	172.67.74.152
	https://docs.google.com/document/d/17J2L1eKLH0J5nHUzrjiF9IlkurD9afurJAGyfUFNVFI/edit?usp=sharing_eip&ts=67c8321f	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.17.25.14
	https://x3g.tcyoopxg.ru/eNDiSHVinaTEN/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
	https://stats.sender.net/link_click/eXzzr5-gpoZqzG-1uv25A/28201475b69bbc587107f3682383db16	Get hash	malicious	HTMLPhisher	Browse	172.67.27.94
	https://www.sendfilessecurely.com/getfile.aspx?id=pARB9my33Z7n44YKB9idRena3352du3vrZOK	Get hash	malicious	Unknown	Browse	104.21.92.56
	https://activatemicrostfacctCGMcpsDaBY.mxylqif.ru/xZj1Kc/#aW5mb0B1cmxhdWItbHVuei5hdA==	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.17.25.14
	TagManager.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	Message.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	TagManager.exe	Get hash	malicious	Unknown	Browse	104.18.3.52
UTMEMUS	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	rarrivalnotice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	50% deposit's payment advice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	zooHQzUhh0xIDWC.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	rPurchaseOrder-25-1201.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Purchase Order # 8MJA15.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	akXjj2a58b.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	r59e5aba5-e690-44bf-a397-997e3c24c602.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	JUSTIFICANTE DE TRANSFERENCIA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	BUSDGH202412201.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Payment details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	20250301_173245__P20250301_173245__P.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	Irdff95nUE.exe	Get hash	malicious	MoDiRAT	Browse	104.21.80.1
	Irdff95nUE.exe	Get hash	malicious	MoDiRAT	Browse	104.21.80.1
	MARCH SHIPMENT PLAN DOCS.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	DHL Shipping Details Ref ID 446331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	Purchase-New Order PO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	SNKO05B250200012 SNKO05B250200023.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Payment Advice.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	rarrivalnotice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1

Process:	C:\Users\user\Desktop\Payment Advice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhg84qXKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3ogvitHo6hAHKzea
MD5:	E193AFF55D4BDD9951CB4287A7D79653
SHA1:	F94AD920B9E0EB43B5005D74552AB84EAA38E985
SHA-256:	08DD5825B4EDCC256AEB08525DCBCDA342252A9C9746BE23FBC70A801F5A596E
SHA-512:	86F6ECDB47C1A7FFA460F3BC6038ACAFC9D4DED4D1E8D1FB7B8FE9145D9D384AB4EE7A7C3BE959A25B265AFEDB8FD31BA10073EC116B65BFE3326EF2C53394E6
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.354777075714867
Encrypted:	false
SSDEEP:	24:3gWSKco4KmZjKbmOIKod6emN1s4RPQoU99t7J0gt/NKIl9iagu:QWSU4xympjms4RIoU99tK8NDv
MD5:	F614CCA1D985910D63FFFF70966F53F5
SHA1:	A9BD00A65E13088BD96A2420E289487CD07D9D4C
SHA-256:	3714147C391F57DCDB11C8D0E7076367B3BD1D628A5FB73E2BEE67B99F034157
SHA-512:	AE362137DA68C2853EB39BC2EC5A6AD2361689225F28337F0738617D6DB986E4BCF985FE12E910405E621CE407B4E6AF3308ADDDE4F9D81E02F2ED8E27831CAE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ojpepf2.tek.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jq0uy5ld.c52.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wj5ucvta.h41.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjtn34di.qcx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.595447541256849
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Payment Advice.exe
File size:	594'432 bytes
MD5:	78ec5a1e11ee68c95a5e339fd492c90e
SHA1:	8423eca2ecf74c50f6f688d0555adf9b0a5ace2b
SHA256:	eb43ef748d41451eb6cbbf8ca967116280e754d24122b2961472f90c8c00aa9a
SHA512:	9b0fb8dc857f108d7a0c86d6b63bbf6ce99ee4cbde73bb0c31c6b0f1a09f970893f3daa841a26d491b55be300c62baa3232b5a5a5e3ae2c7935f815fea7bb769
SSDEEP:	12288:ejz9Mpm+gvyDcOE4R2629epTtir94JDGFlxPT:4z9LwoyKkpTc5MDGF
TLSH:	7BC4E0642269EB17D97A5BF80931E17453F92DED7811C21A8FEE6CEFB862F044D10263
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.-...............0.............J'... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x49274a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD22D0139 [Sat Sep 27 02:13:13 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x926f8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x94000	0x594	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x96000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x901ac	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x90750	0x90800	9af9b9438525b451e9bd0face3a4b7ef	False	0.8557289413927336	data	7.6054071879897105	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x94000	0x594	0x600	5e8f4a7d671839c1200501dab763f371	False	0.4114583333333333	data	4.034211927375768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x96000	0xc	0x200	29246f52fc0c2a7a7ecad4dedeb2aed2	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x94090	0x304	data			0.42875647668393785
RT_MANIFEST	0x943a4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription	Project
FileVersion	1.0.0.0
InternalName	iAbl.exe
LegalCopyright	Copyright 2023
LegalTrademarks
OriginalFilename	iAbl.exe
ProductName	Project
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-05T13:08:21.158505+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	132.226.247.73	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 5, 2025 13:08:20.185101986 CET	49733	80	192.168.2.4	132.226.247.73
Mar 5, 2025 13:08:20.190089941 CET	80	49733	132.226.247.73	192.168.2.4
Mar 5, 2025 13:08:20.190160990 CET	49733	80	192.168.2.4	132.226.247.73
Mar 5, 2025 13:08:20.190440893 CET	49733	80	192.168.2.4	132.226.247.73
Mar 5, 2025 13:08:20.195385933 CET	80	49733	132.226.247.73	192.168.2.4
Mar 5, 2025 13:08:20.889595032 CET	80	49733	132.226.247.73	192.168.2.4
Mar 5, 2025 13:08:20.892961979 CET	49733	80	192.168.2.4	132.226.247.73
Mar 5, 2025 13:08:20.899674892 CET	80	49733	132.226.247.73	192.168.2.4
Mar 5, 2025 13:08:21.109308958 CET	80	49733	132.226.247.73	192.168.2.4
Mar 5, 2025 13:08:21.158504963 CET	49733	80	192.168.2.4	132.226.247.73
Mar 5, 2025 13:08:21.931694031 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:08:21.931736946 CET	443	49735	104.21.80.1	192.168.2.4
Mar 5, 2025 13:08:21.931801081 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:08:21.939937115 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:08:21.939970016 CET	443	49735	104.21.80.1	192.168.2.4
Mar 5, 2025 13:08:22.422580004 CET	443	49735	104.21.80.1	192.168.2.4
Mar 5, 2025 13:08:22.422652960 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:08:22.427970886 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:08:22.428006887 CET	443	49735	104.21.80.1	192.168.2.4
Mar 5, 2025 13:08:22.428672075 CET	443	49735	104.21.80.1	192.168.2.4
Mar 5, 2025 13:08:22.471060991 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:08:22.473603964 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:08:22.516323090 CET	443	49735	104.21.80.1	192.168.2.4
Mar 5, 2025 13:08:22.606746912 CET	443	49735	104.21.80.1	192.168.2.4
Mar 5, 2025 13:08:22.606807947 CET	443	49735	104.21.80.1	192.168.2.4
Mar 5, 2025 13:08:22.606889009 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:08:22.612032890 CET	49735	443	192.168.2.4	104.21.80.1
Mar 5, 2025 13:09:26.109618902 CET	80	49733	132.226.247.73	192.168.2.4
Mar 5, 2025 13:09:26.109908104 CET	49733	80	192.168.2.4	132.226.247.73
Mar 5, 2025 13:10:01.112371922 CET	49733	80	192.168.2.4	132.226.247.73
Mar 5, 2025 13:10:01.119728088 CET	80	49733	132.226.247.73	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 5, 2025 13:08:20.168857098 CET	51492	53	192.168.2.4	1.1.1.1
Mar 5, 2025 13:08:20.175993919 CET	53	51492	1.1.1.1	192.168.2.4
Mar 5, 2025 13:08:21.110563993 CET	57818	53	192.168.2.4	1.1.1.1
Mar 5, 2025 13:08:21.931046963 CET	53	57818	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 5, 2025 13:08:20.168857098 CET	192.168.2.4	1.1.1.1	0xc714	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:21.110563993 CET	192.168.2.4	1.1.1.1	0xb9ae	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 5, 2025 13:08:20.175993919 CET	1.1.1.1	192.168.2.4	0xc714	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 5, 2025 13:08:20.175993919 CET	1.1.1.1	192.168.2.4	0xc714	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:20.175993919 CET	1.1.1.1	192.168.2.4	0xc714	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:20.175993919 CET	1.1.1.1	192.168.2.4	0xc714	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:20.175993919 CET	1.1.1.1	192.168.2.4	0xc714	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:20.175993919 CET	1.1.1.1	192.168.2.4	0xc714	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:21.931046963 CET	1.1.1.1	192.168.2.4	0xb9ae	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:21.931046963 CET	1.1.1.1	192.168.2.4	0xb9ae	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:21.931046963 CET	1.1.1.1	192.168.2.4	0xb9ae	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:21.931046963 CET	1.1.1.1	192.168.2.4	0xb9ae	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:21.931046963 CET	1.1.1.1	192.168.2.4	0xb9ae	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:21.931046963 CET	1.1.1.1	192.168.2.4	0xb9ae	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 5, 2025 13:08:21.931046963 CET	1.1.1.1	192.168.2.4	0xb9ae	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	132.226.247.73	80	5216	C:\Users\user\Desktop\Payment Advice.exe

Timestamp	Bytes transferred	Direction	Data
Mar 5, 2025 13:08:20.190440893 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 5, 2025 13:08:20.889595032 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 05 Mar 2025 12:08:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 5, 2025 13:08:20.892961979 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 5, 2025 13:08:21.109308958 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 05 Mar 2025 12:08:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.21.80.1	443	5216	C:\Users\user\Desktop\Payment Advice.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-05 12:08:22 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-05 12:08:22 UTC	854	IN	HTTP/1.1 200 OK Date: Wed, 05 Mar 2025 12:08:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cf-Ray: 91b97f94c9cf42d2-EWR Server: cloudflare Age: 262245 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Sun, 02 Mar 2025 11:17:37 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lD1DVdJpPxYKq6MDQyvyJjZH7LcYmvy4iOuqJlLHbYu9rr0%2F0wEmqO1SyVrQSY2i8n8LWpBdX%2FghvMcBRqWBJLW%2BhI8ZdOYPzBuC5kOCibbjsGmJuRD559ZBpeZUbBwQfoHzWYsC"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1544&min_rtt=1535&rtt_var=594&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1815920&cwnd=168&unsent_bytes=0&cid=be32be1beeeffcaa&ts=201&x=0"
2025-03-05 12:08:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	07:08:16
Start date:	05/03/2025
Path:	C:\Users\user\Desktop\Payment Advice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment Advice.exe"
Imagebase:	0xa20000
File size:	594'432 bytes
MD5 hash:	78EC5A1E11EE68C95A5E339FD492C90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1764232871.0000000003D99000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1764232871.0000000003DD1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:08:18
Start date:	05/03/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice.exe"
Imagebase:	0x890000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:08:18
Start date:	05/03/2025
Path:	C:\Users\user\Desktop\Payment Advice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Payment Advice.exe"
Imagebase:	0x270000
File size:	594'432 bytes
MD5 hash:	78EC5A1E11EE68C95A5E339FD492C90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:08:18
Start date:	05/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:08:18
Start date:	05/03/2025
Path:	C:\Users\user\Desktop\Payment Advice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payment Advice.exe"
Imagebase:	0xe60000
File size:	594'432 bytes
MD5 hash:	78EC5A1E11EE68C95A5E339FD492C90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.2994910866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2996681350.0000000003523000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	221
Total number of Limit Nodes:	12

Executed Functions

Function 079636B2 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767590838.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Payment Advice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053ef30d94b00caddd73067feefae5fd4202875ed15a0c25d8f7b1453d56a9f7
Instruction ID: 61766a9a84888898b1b152078e78b81eaeeeedd0aefda74238dafdb52af124f3
Opcode Fuzzy Hash: 053ef30d94b00caddd73067feefae5fd4202875ed15a0c25d8f7b1453d56a9f7
Instruction Fuzzy Hash: CA213AB1E0561A8BDB18CF67C9056EEFFFBAFCA300F04D17AD409A6664DB7405468A90

Function 0110D350 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0110D3DE
GetCurrentThread.KERNEL32 ref: 0110D41B
GetCurrentProcess.KERNEL32 ref: 0110D458
GetCurrentThreadId.KERNEL32 ref: 0110D4B1

Memory Dump Source

Source File: 00000000.00000002.1761719665.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Payment Advice.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 797919f943004a8b39242b229f0df97fe892c4a2866eccc7ccdc4ed12ae591e3
Instruction ID: 0c72a41247eca3107931b6d98ea41c83f3b9def7df503a8021f3d403d7985196
Opcode Fuzzy Hash: 797919f943004a8b39242b229f0df97fe892c4a2866eccc7ccdc4ed12ae591e3
Instruction Fuzzy Hash: 5A5166B09012498FDB18CFAAD948BEEBFF1EF88314F248459E409A7390DB746940CF65

Function 0110D360 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0110D3DE
GetCurrentThread.KERNEL32 ref: 0110D41B
GetCurrentProcess.KERNEL32 ref: 0110D458
GetCurrentThreadId.KERNEL32 ref: 0110D4B1

Memory Dump Source

Source File: 00000000.00000002.1761719665.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Payment Advice.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ac311e0f50c8221b859abd56f3fbfa9f4ab79a8a95607b2c476b3cedb83c884b
Instruction ID: 06e103be6d275585430db852616f7079a153a2db81c474096b7446a0c903b31c
Opcode Fuzzy Hash: ac311e0f50c8221b859abd56f3fbfa9f4ab79a8a95607b2c476b3cedb83c884b
Instruction Fuzzy Hash: 4B5154B0D012498FDB18CFAAD948BEEBFF1EF88314F248459E409A7390DB746844CB61

Function 07969546 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07969786

Memory Dump Source

Source File: 00000000.00000002.1767590838.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Payment Advice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1bb8f596afef2736e0fa96eda9e0a98ed27d88ec0902ace18492dbbd0ef33415
Instruction ID: 86fff997d5e167c486af87c8fe4cc7ea99b9142a2ad30284786fb4cb064b91ca
Opcode Fuzzy Hash: 1bb8f596afef2736e0fa96eda9e0a98ed27d88ec0902ace18492dbbd0ef33415
Instruction Fuzzy Hash: ABA15CB1D0075ADFDB24CF69C845BEDBBB6BF48324F048269D809A7240DB74A985CF91

Function 07969550 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07969786

Memory Dump Source

Source File: 00000000.00000002.1767590838.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Payment Advice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 98fd82b64b17a3d4cdf484f9e68341b11c1bc7739e72729fd4ce9c003d1f29e2
Instruction ID: 45bdb92fcf1ab66fffb0cfdd1b330ab763a47255df7da9fe8630f45bdc5cf808
Opcode Fuzzy Hash: 98fd82b64b17a3d4cdf484f9e68341b11c1bc7739e72729fd4ce9c003d1f29e2
Instruction Fuzzy Hash: B8915CB1D0075ACFDF24CF69C845BEDBAB6BF48324F048269D809A7240DB74A985CF91

Function 0110B0C8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Advice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Advice.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ojpepf2.tek.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jq0uy5ld.c52.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wj5ucvta.h41.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjtn34di.qcx.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Payment Advice.exe

Function 0110D350 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 0110D360 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 07969546 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Function 07969550 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0110B0C8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON