Edit tour

Windows Analysis Report
Invoice- Trikaya Bio.exe

Overview

General Information

Sample name:	Invoice- Trikaya Bio.exe
Analysis ID:	1631507
MD5:	a862497c8d7259be228a59e3b79e4cb3
SHA1:	8aab6013aaaa09e3931adc366ccc7ec4b80f425a
SHA256:	0f509d4c022c142dd43f6cdf4b3a23196a5ce9eac448a7540e9e8ad709de6ce2
Tags:	exeInvoiceSnakeKeyloggeruser-cocaman
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Binary is likely a compiled AutoIt script file

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Invoice- Trikaya Bio.exe (PID: 5476 cmdline: "C:\Users\user\Desktop\Invoice- Trikaya Bio.exe" MD5: A862497C8D7259BE228A59E3B79E4CB3)

RegSvcs.exe (PID: 6412 cmdline: "C:\Users\user\Desktop\Invoice- Trikaya Bio.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8147359814:AAFqq1spFpNySus2Q92Z7HxFe84oTTR0k6o/sendMessage?chat_id=1166322455", "Token": "8147359814:AAFqq1spFpNySus2Q92Z7HxFe84oTTR0k6o", "Chat_id": "1166322455", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1490b:$a1: get_encryptedPassword 0x14bf7:$a2: get_encryptedUsername 0x14717:$a3: get_timePasswordChanged 0x14812:$a4: get_passwordField 0x14921:$a5: set_encryptedPassword 0x15f88:$a7: get_logins 0x15eeb:$a10: KeyLoggerEventArgs 0x15b56:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19972:$x1: $%SMTPDV$ 0x18298:$x2: $#TheHashHere%& 0x1991a:$x3: %FTPDV$ 0x18238:$x4: $%TelegramDv$ 0x15b56:$x5: KeyLoggerEventArgs 0x15eeb:$x5: KeyLoggerEventArgs 0x1993e:$m2: Clipboard Logs ID 0x19b72:$m2: Screenshot Logs ID 0x19c82:$m2: keystroke Logs ID 0x19f5c:$m3: SnakePW 0x19b4a:$m4: \SnakeKeylogger\
00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b0b:$a1: get_encryptedPassword 0x14df7:$a2: get_encryptedUsername 0x14917:$a3: get_timePasswordChanged 0x14a12:$a4: get_passwordField 0x14b21:$a5: set_encryptedPassword 0x16188:$a7: get_logins 0x160eb:$a10: KeyLoggerEventArgs 0x15d56:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c51e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b750:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb83:$a4: \Orbitum\User Data\Default\Login Data 0x1cbc2:$a5: \Kometa\User Data\Default\Login Data
00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156e6:$s1: UnHook 0x156ed:$s2: SetHook 0x156f5:$s3: CallNextHook 0x15702:$s4: _hook
00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b72:$x1: $%SMTPDV$ 0x18498:$x2: $#TheHashHere%& 0x19b1a:$x3: %FTPDV$ 0x18438:$x4: $%TelegramDv$ 0x15d56:$x5: KeyLoggerEventArgs 0x160eb:$x5: KeyLoggerEventArgs 0x19b3e:$m2: Clipboard Logs ID 0x19d72:$m2: Screenshot Logs ID 0x19e82:$m2: keystroke Logs ID 0x1a15c:$m3: SnakePW 0x19d4a:$m4: \SnakeKeylogger\
00000002.00000002.4648373614.00000000031D8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4648373614.0000000003011000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13c540:$a1: get_encryptedPassword 0x13c822:$a2: get_encryptedUsername 0x13c356:$a3: get_timePasswordChanged 0x13c451:$a4: get_passwordField 0x13c556:$a5: set_encryptedPassword 0x13ea36:$a7: get_logins 0x13e999:$a10: KeyLoggerEventArgs 0x13e604:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x13e604:$x5: KeyLoggerEventArgs 0x13e999:$x5: KeyLoggerEventArgs 0x13f2a0:$x5: KeyLoggerEventArgs 0x13f601:$x5: KeyLoggerEventArgs 0x140c27:$m2: Clipboard Logs ID 0x140d28:$m2: Screenshot Logs ID 0x140d7e:$m2: keystroke Logs ID 0x140eb3:$m3: SnakePW 0x140d14:$m4: \SnakeKeylogger\
Process Memory Space: RegSvcs.exe PID: 6412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6412	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 6412	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1f094:$a1: get_encryptedPassword 0x1f376:$a2: get_encryptedUsername 0x1eeaa:$a3: get_timePasswordChanged 0x1efa5:$a4: get_passwordField 0x1f0aa:$a5: set_encryptedPassword 0x2158a:$a7: get_logins 0x214ed:$a10: KeyLoggerEventArgs 0x21158:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 6412	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x21158:$x5: KeyLoggerEventArgs 0x214ed:$x5: KeyLoggerEventArgs 0x21df4:$x5: KeyLoggerEventArgs 0x22155:$x5: KeyLoggerEventArgs 0x2377b:$m2: Clipboard Logs ID 0x2387c:$m2: Screenshot Logs ID 0x238d2:$m2: keystroke Logs ID 0x23a07:$m3: SnakePW 0x23868:$m4: \SnakeKeylogger\
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b0b:$a1: get_encryptedPassword 0x14df7:$a2: get_encryptedUsername 0x14917:$a3: get_timePasswordChanged 0x14a12:$a4: get_passwordField 0x14b21:$a5: set_encryptedPassword 0x16188:$a7: get_logins 0x160eb:$a10: KeyLoggerEventArgs 0x15d56:$a11: KeyLoggerEventArgsEventHandler
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c51e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b750:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb83:$a4: \Orbitum\User Data\Default\Login Data 0x1cbc2:$a5: \Kometa\User Data\Default\Login Data
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156e6:$s1: UnHook 0x156ed:$s2: SetHook 0x156f5:$s3: CallNextHook 0x15702:$s4: _hook
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b72:$x1: $%SMTPDV$ 0x18498:$x2: $#TheHashHere%& 0x19b1a:$x3: %FTPDV$ 0x18438:$x4: $%TelegramDv$ 0x15d56:$x5: KeyLoggerEventArgs 0x160eb:$x5: KeyLoggerEventArgs 0x19b3e:$m2: Clipboard Logs ID 0x19d72:$m2: Screenshot Logs ID 0x19e82:$m2: keystroke Logs ID 0x1a15c:$m3: SnakePW 0x19d4a:$m4: \SnakeKeylogger\
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12d0b:$a1: get_encryptedPassword 0x12ff7:$a2: get_encryptedUsername 0x12b17:$a3: get_timePasswordChanged 0x12c12:$a4: get_passwordField 0x12d21:$a5: set_encryptedPassword 0x14388:$a7: get_logins 0x142eb:$a10: KeyLoggerEventArgs 0x13f56:$a11: KeyLoggerEventArgsEventHandler
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a71e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19950:$a3: \Google\Chrome\User Data\Default\Login Data 0x19d83:$a4: \Orbitum\User Data\Default\Login Data 0x1adc2:$a5: \Kometa\User Data\Default\Login Data
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x138e6:$s1: UnHook 0x138ed:$s2: SetHook 0x138f5:$s3: CallNextHook 0x13902:$s4: _hook
0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17d72:$x1: $%SMTPDV$ 0x16698:$x2: $#TheHashHere%& 0x17d1a:$x3: %FTPDV$ 0x16638:$x4: $%TelegramDv$ 0x13f56:$x5: KeyLoggerEventArgs 0x142eb:$x5: KeyLoggerEventArgs 0x17d3e:$m2: Clipboard Logs ID 0x17f72:$m2: Screenshot Logs ID 0x18082:$m2: keystroke Logs ID 0x1835c:$m3: SnakePW 0x17f4a:$m4: \SnakeKeylogger\
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b0b:$a1: get_encryptedPassword 0x14df7:$a2: get_encryptedUsername 0x14917:$a3: get_timePasswordChanged 0x14a12:$a4: get_passwordField 0x14b21:$a5: set_encryptedPassword 0x16188:$a7: get_logins 0x160eb:$a10: KeyLoggerEventArgs 0x15d56:$a11: KeyLoggerEventArgsEventHandler
2.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c51e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b750:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bb83:$a4: \Orbitum\User Data\Default\Login Data 0x1cbc2:$a5: \Kometa\User Data\Default\Login Data
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156e6:$s1: UnHook 0x156ed:$s2: SetHook 0x156f5:$s3: CallNextHook 0x15702:$s4: _hook
2.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19b72:$x1: $%SMTPDV$ 0x18498:$x2: $#TheHashHere%& 0x19b1a:$x3: %FTPDV$ 0x18438:$x4: $%TelegramDv$ 0x15d56:$x5: KeyLoggerEventArgs 0x160eb:$x5: KeyLoggerEventArgs 0x19b3e:$m2: Clipboard Logs ID 0x19d72:$m2: Screenshot Logs ID 0x19e82:$m2: keystroke Logs ID 0x1a15c:$m3: SnakePW 0x19d4a:$m4: \SnakeKeylogger\
Click to see the 13 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T09:28:26.724046+0100	2803305	3	Unknown Traffic	192.168.2.6	49720	104.21.32.1	443	TCP
2025-03-07T09:28:29.828964+0100	2803305	3	Unknown Traffic	192.168.2.6	49727	104.21.32.1	443	TCP
2025-03-07T09:28:35.996792+0100	2803305	3	Unknown Traffic	192.168.2.6	49747	104.21.32.1	443	TCP
2025-03-07T09:28:39.178301+0100	2803305	3	Unknown Traffic	192.168.2.6	49755	104.21.32.1	443	TCP
2025-03-07T09:28:45.590472+0100	2803305	3	Unknown Traffic	192.168.2.6	62207	104.21.32.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T09:28:21.519740+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49713	132.226.8.169	80	TCP
2025-03-07T09:28:24.472926+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49713	132.226.8.169	80	TCP
2025-03-07T09:28:27.597904+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49726	132.226.8.169	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Invoice- Trikaya Bio.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8147359814:AAFqq1spFpNySus2Q92Z7HxFe84oTTR0k6o/sendMessage?chat_id=1166322455", "Token": "8147359814:AAFqq1spFpNySus2Q92Z7HxFe84oTTR0k6o", "Chat_id": "1166322455", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: Invoice- Trikaya Bio.exe	Virustotal: Detection: 47%			Perma Link
Source: Invoice- Trikaya Bio.exe	ReversingLabs: Detection: 62%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	String decryptor: info@bondamit.shop
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	String decryptor: payment1759
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	String decryptor: bondamit.shop
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	String decryptor: 143
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	String decryptor:
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	String decryptor: 8147359814:AAFqq1spFpNySus2Q92Z7HxFe84oTTR0k6o
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack	String decryptor: 1166322455

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Invoice- Trikaya Bio.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49714 version: TLS 1.0

Source:	Binary string: wntdll.pdbUGP source: Invoice- Trikaya Bio.exe, 00000000.00000003.2187449726.0000000003C80000.00000004.00001000.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2189220374.0000000003E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Invoice- Trikaya Bio.exe, 00000000.00000003.2187449726.0000000003C80000.00000004.00001000.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2189220374.0000000003E20000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B0445A
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0C6D1 FindFirstFileW,FindClose,	0_2_00B0C6D1
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B0C75C
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B0EF95
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B0F0F2
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B0F3F3
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B037EF
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B03B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B03B12
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B0BCBC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 016AF1F6h	2_2_016AF007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 016AFB80h	2_2_016AF007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_016AE528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_016AEB5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_016AED3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC8945h	2_2_05AC8608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC0FF1h	2_2_05AC0D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC8001h	2_2_05AC7D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC7751h	2_2_05AC74A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC0741h	2_2_05AC0498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC6A21h	2_2_05AC6778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC6171h	2_2_05AC5EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC58C1h	2_2_05AC5618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC8459h	2_2_05AC81B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC5441h	2_2_05AC5198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC7BA9h	2_2_05AC7900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC0B99h	2_2_05AC08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC02E9h	2_2_05AC0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC72FAh	2_2_05AC7050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_05AC33A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_05AC33B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC6E79h	2_2_05AC6BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC65C9h	2_2_05AC6320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05AC5D19h	2_2_05AC5A70

Source: global traffic

TCP traffic: 192.168.2.6:62192 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49726 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49713 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49755 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49747 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49720 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:62207 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49727 -> 104.21.32.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49714 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B122EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00B122EE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: RegSvcs.exe, 00000002.00000002.4648373614.00000000031BB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.000000000318E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003180000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003172000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003165000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000030D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000002.00000002.4648373614.0000000003115000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000031BB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.000000000318E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003180000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003172000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003165000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000030D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000002.00000002.4648373614.0000000003011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Invoice- Trikaya Bio.exe, 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000002.00000002.4648373614.00000000031BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgP
Source: RegSvcs.exe, 00000002.00000002.4648373614.00000000031BB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.000000000318E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003180000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003172000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003165000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000030EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000002.00000002.4648373614.0000000003011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.4648373614.0000000003115000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000031BB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.000000000318E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003180000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003172000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003165000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000030D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Invoice- Trikaya Bio.exe, 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000030D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000002.00000002.4648373614.00000000030D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: RegSvcs.exe, 00000002.00000002.4648373614.0000000003115000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000031BB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.000000000318E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003180000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003172000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003165000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.00000000031CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62199
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B14164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B14164

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B14164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B14164

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B13F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B13F66

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B0001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00B0001C

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B2CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00B2CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00AA3B3A
Source: Invoice- Trikaya Bio.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Invoice- Trikaya Bio.exe, 00000000.00000000.2175785594.0000000000B54000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d5610ac9-c
Source: Invoice- Trikaya Bio.exe, 00000000.00000000.2175785594.0000000000B54000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_a99728d3-5
Source: Invoice- Trikaya Bio.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d7a74392-4
Source: Invoice- Trikaya Bio.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_224ac0a2-9

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Invoice- Trikaya Bio.exe

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B0A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00B0A1EF

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AF8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00AF8310

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B051BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00B051BD

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AAE6A0	0_2_00AAE6A0
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00ACD975	0_2_00ACD975
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AAFCE0	0_2_00AAFCE0
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AC21C5	0_2_00AC21C5
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AD62D2	0_2_00AD62D2
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B203DA	0_2_00B203DA
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AD242E	0_2_00AD242E
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AC25FA	0_2_00AC25FA
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AB66E1	0_2_00AB66E1
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AFE616	0_2_00AFE616
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AD878F	0_2_00AD878F
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B08889	0_2_00B08889
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AB8808	0_2_00AB8808
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B20857	0_2_00B20857
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AD6844	0_2_00AD6844
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00ACCB21	0_2_00ACCB21
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AD6DB6	0_2_00AD6DB6
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AB6F9E	0_2_00AB6F9E
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AB3030	0_2_00AB3030
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AC3187	0_2_00AC3187
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00ACF1D9	0_2_00ACF1D9
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AA1287	0_2_00AA1287
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AC1484	0_2_00AC1484
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AB5520	0_2_00AB5520
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AC7696	0_2_00AC7696
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AB5760	0_2_00AB5760
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AC1978	0_2_00AC1978
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AD9AB5	0_2_00AD9AB5
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00ACBDA6	0_2_00ACBDA6
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AC1D90	0_2_00AC1D90
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B27DDB	0_2_00B27DDB
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AB3FE0	0_2_00AB3FE0
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AADF00	0_2_00AADF00
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_01265800	0_2_01265800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A6108	2_2_016A6108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016AC190	2_2_016AC190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016AF007	2_2_016AF007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016AB328	2_2_016AB328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016AC470	2_2_016AC470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016AC751	2_2_016AC751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A9858	2_2_016A9858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A6880	2_2_016A6880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016ABBD2	2_2_016ABBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016ACA31	2_2_016ACA31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A4AD9	2_2_016A4AD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016ABEB0	2_2_016ABEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A3570	2_2_016A3570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016AE528	2_2_016AE528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016AE517	2_2_016AE517
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016AB4F2	2_2_016AB4F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACBD38	2_2_05ACBD38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACA408	2_2_05ACA408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACB6E8	2_2_05ACB6E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC8608	2_2_05AC8608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACD670	2_2_05ACD670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACC9D8	2_2_05ACC9D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACB0A0	2_2_05ACB0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACD028	2_2_05ACD028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACC388	2_2_05ACC388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC8B58	2_2_05AC8B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACAA58	2_2_05ACAA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC85FC	2_2_05AC85FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACBD28	2_2_05ACBD28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC0D39	2_2_05AC0D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC0D48	2_2_05AC0D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC7D48	2_2_05AC7D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC7D58	2_2_05AC7D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC74A8	2_2_05AC74A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC0488	2_2_05AC0488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC0498	2_2_05AC0498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC7497	2_2_05AC7497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC4430	2_2_05AC4430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC3730	2_2_05AC3730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC676A	2_2_05AC676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC6778	2_2_05AC6778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC5EB8	2_2_05AC5EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC5EC8	2_2_05AC5EC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACB6D9	2_2_05ACB6D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC560A	2_2_05AC560A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC5618	2_2_05AC5618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACD662	2_2_05ACD662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC11A0	2_2_05AC11A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC81A0	2_2_05AC81A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC81B0	2_2_05AC81B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC518A	2_2_05AC518A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC5198	2_2_05AC5198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC1191	2_2_05AC1191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACC9C8	2_2_05ACC9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC7900	2_2_05AC7900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACB08F	2_2_05ACB08F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC08E0	2_2_05AC08E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC08F0	2_2_05AC08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC78F0	2_2_05AC78F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC0006	2_2_05AC0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC2807	2_2_05AC2807
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC2818	2_2_05AC2818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACD018	2_2_05ACD018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC0040	2_2_05AC0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC7040	2_2_05AC7040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC7050	2_2_05AC7050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC33A8	2_2_05AC33A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC33B8	2_2_05AC33B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACA3F8	2_2_05ACA3F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC6BC1	2_2_05AC6BC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC6BD0	2_2_05AC6BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC6320	2_2_05AC6320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC6312	2_2_05AC6312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACC378	2_2_05ACC378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC5A60	2_2_05AC5A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05AC5A70	2_2_05AC5A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05ACAA4F	2_2_05ACAA4F

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: String function: 00AC0AE3 appears 70 times
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: String function: 00AA7DE1 appears 36 times
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: String function: 00AC8900 appears 42 times

Source: Invoice- Trikaya Bio.exe, 00000000.00000003.2190056002.0000000003F4D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Invoice- Trikaya Bio.exe
Source: Invoice- Trikaya Bio.exe, 00000000.00000003.2187959158.0000000003DA3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Invoice- Trikaya Bio.exe
Source: Invoice- Trikaya Bio.exe, 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Invoice- Trikaya Bio.exe

Source: Invoice- Trikaya Bio.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, ---.cs

Base64 encoded string: 'XgJjNCsN/UoYT5WGlZ0X0S/BBm0+QtZsfrzTD/i5uw5Pt87U09b7Gzi9hGVQno7Q'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B0A06A GetLastError,FormatMessageW,

0_2_00B0A06A

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AF81CB AdjustTokenPrivileges,CloseHandle,		0_2_00AF81CB
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AF87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00AF87E1

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B0B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00B0B3FB

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B1EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B1EE0D

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B183BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00B183BB

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AA4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00AA4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

File created: C:\Users\user\AppData\Local\Temp\autB98F.tmp

Jump to behavior

Source: Invoice- Trikaya Bio.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4648373614.000000000323F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003285000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.000000000325D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.000000000324F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4649734311.0000000004099000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4648373614.0000000003291000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Invoice- Trikaya Bio.exe	Virustotal: Detection: 47%
Source: Invoice- Trikaya Bio.exe	ReversingLabs: Detection: 62%

Source: unknown	Process created: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe "C:\Users\user\Desktop\Invoice- Trikaya Bio.exe"
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Invoice- Trikaya Bio.exe"
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Invoice- Trikaya Bio.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Invoice- Trikaya Bio.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Invoice- Trikaya Bio.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Invoice- Trikaya Bio.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Invoice- Trikaya Bio.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Invoice- Trikaya Bio.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Invoice- Trikaya Bio.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Invoice- Trikaya Bio.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Invoice- Trikaya Bio.exe, 00000000.00000003.2187449726.0000000003C80000.00000004.00001000.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2189220374.0000000003E20000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Invoice- Trikaya Bio.exe, 00000000.00000003.2187449726.0000000003C80000.00000004.00001000.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2189220374.0000000003E20000.00000004.00001000.00020000.00000000.sdmp

Source: Invoice- Trikaya Bio.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Invoice- Trikaya Bio.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Invoice- Trikaya Bio.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Invoice- Trikaya Bio.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Invoice- Trikaya Bio.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AA4B37 LoadLibraryA,GetProcAddress,

0_2_00AA4B37

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AC8945 push ecx; ret	0_2_00AC8958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A3146 push 00000001h; retf	2_2_016A3190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A3192 push 00000001h; retf	2_2_016A31DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A3062 push 00000001h; retf	2_2_016A30AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A304A push 00000001h; retf	2_2_016A3060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A300F push 00000001h; retf	2_2_016A30AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A30AE push 00000001h; retf	2_2_016A30F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A30AE push 00000001h; retf	2_2_016A3144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A3276 push 00000001h; retf	2_2_016A32C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A322A push 00000001h; retf	2_2_016A3274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A3212 push 00000001h; retf	2_2_016A3228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A32C2 push 00000001h; retf	2_2_016A330C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_016A24B9 push 8BFFFFFFh; retf	2_2_016A24BF

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00AA48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00AA48D7
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B25376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00B25376

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AC3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00AC3187

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

API/Special instruction interceptor: Address: 1265424

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Invoice- Trikaya Bio.exe, 00000000.00000003.2177333381.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2180845631.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2180416186.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2177701181.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2181120893.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000003.2177258450.0000000001277000.00000004.00000020.00020000.00000000.sdmp, Invoice- Trikaya Bio.exe, 00000000.00000002.2199312496.00000000012A5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCMON.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599400	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599294	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595208	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593954	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1889			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7917			Jump to behavior

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-106215

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

API coverage: 4.5 %

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B0445A
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0C6D1 FindFirstFileW,FindClose,	0_2_00B0C6D1
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B0C75C
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B0EF95
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B0F0F2
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B0F3F3
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B037EF
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B03B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B03B12
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B0BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B0BCBC

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AA49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AA49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599400	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599294	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595208	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593954	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4647330732.00000000012F7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

API call chain: ExitProcess graph end node

graph_0-104626

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B13F09 BlockInput,

0_2_00B13F09

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AA3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AA3B3A

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AD5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00AD5A7C

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AA4B37 LoadLibraryA,GetProcAddress,

0_2_00AA4B37

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_01264010 mov eax, dword ptr fs:[00000030h]	0_2_01264010
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_01265690 mov eax, dword ptr fs:[00000030h]	0_2_01265690
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_012656F0 mov eax, dword ptr fs:[00000030h]	0_2_012656F0

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AF80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00AF80A9

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00ACA124 SetUnhandledExceptionFilter,		0_2_00ACA124
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00ACA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00ACA155

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: F61008

Jump to behavior

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AF87B1 LogonUserW,

0_2_00AF87B1

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AA3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AA3B3A

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AA48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00AA48D7

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00B04C27 mouse_event,

0_2_00B04C27

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Invoice- Trikaya Bio.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AF7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00AF7CAF

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AF874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00AF874B

Source: Invoice- Trikaya Bio.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Invoice- Trikaya Bio.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AC862B cpuid

0_2_00AC862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AD4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00AD4E87

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AE1E06 GetUserNameW,

0_2_00AE1E06

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AD3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00AD3F3A

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe

Code function: 0_2_00AA49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AA49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Binary or memory string: procmon.exe

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4648373614.00000000031D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4648373614.0000000003011000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Invoice- Trikaya Bio.exe	Binary or memory string: WIN_81
Source: Invoice- Trikaya Bio.exe	Binary or memory string: WIN_XP
Source: Invoice- Trikaya Bio.exe	Binary or memory string: WIN_XPe
Source: Invoice- Trikaya Bio.exe	Binary or memory string: WIN_VISTA
Source: Invoice- Trikaya Bio.exe	Binary or memory string: WIN_7
Source: Invoice- Trikaya Bio.exe	Binary or memory string: WIN_8
Source: Invoice- Trikaya Bio.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice- Trikaya Bio.exe.1ef0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4646941144.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2199589335.0000000001EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4648373614.00000000031D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4648373614.0000000003011000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Invoice- Trikaya Bio.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR

Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B16283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00B16283
Source: C:\Users\user\Desktop\Invoice- Trikaya Bio.exe	Code function: 0_2_00B16747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00B16747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	31 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice- Trikaya Bio.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Invoice- Trikaya Bio.exe