Edit tour

Windows Analysis Report
Transferencia - BBVA 20250312.pdf(45KB).com.exe

Overview

General Information

Sample name:	Transferencia - BBVA 20250312.pdf(45KB).com.exe
Analysis ID:	1639319
MD5:	4ea000d1cb10be5603ba17b2bf8586b5
SHA1:	0addb4903078927279ea243239781dd6bf85f441
SHA256:	99f7676a797ffaecdc6150d731f1a5093372dc68f132522364cefaddc352ab67
Tags:	BBVAcomexeXWormuser-abuse_ch
Infos:

Detection

DarkTortilla, XWorm

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Transferencia - BBVA 20250312.pdf(45KB).com.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe" MD5: 4EA000D1CB10BE5603BA17B2BF8586B5)

InstallUtil.exe (PID: 7624 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

InstallUtil.exe (PID: 7960 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://cyber.wtf/2025/02/12/unpacking-pyarmor-v8-scripts/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["wqo9.firewall-gateway.de", "rency.ydns.eu", "code1.ydns.eu"], "Port": 59012, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1627114005.0000000005000000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xba9f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xbb3c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbc51:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb881:$cnc4: POST / HTTP/1.1
00000001.00000002.1626181440.0000000003899000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000009.00000002.3686559501.0000000002751000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e1f3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e290:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e3a5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7dfd5:$cnc4: POST / HTTP/1.1
Process Memory Space: Transferencia - BBVA 20250312.pdf(45KB).com.exe PID: 7416	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: Transferencia - BBVA 20250312.pdf(45KB).com.exe PID: 7416	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: Transferencia - BBVA 20250312.pdf(45KB).com.exe PID: 7416	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 7624	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: InstallUtil.exe PID: 7960	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.38bf0e0.1.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
3.2.InstallUtil.exe.1d0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.InstallUtil.exe.1d0000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x9a7a:$str01: $VB$Local_Port 0x9a9e:$str02: $VB$Local_Host 0x83d8:$str03: get_Jpeg 0x897e:$str04: get_ServicePack 0xa729:$str05: Select * from AntivirusProduct 0xb4b7:$str06: PCRestart 0xb4cb:$str07: shutdown.exe /f /r /t 0 0xb57d:$str08: StopReport 0xb553:$str09: StopDDos 0xb649:$str10: sendPlugin 0xb6c9:$str11: OfflineKeylogger Not Enabled 0xb821:$str12: -ExecutionPolicy Bypass -File " 0xbb66:$str13: Content-length: 5235
3.2.InstallUtil.exe.1d0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xbc9f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xbd3c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbe51:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xba81:$cnc4: POST / HTTP/1.1
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.5000000.3.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.38e4c30.2.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.5000000.3.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.38e4c30.2.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x7c7a:$str01: $VB$Local_Port 0x7c9e:$str02: $VB$Local_Host 0x65d8:$str03: get_Jpeg 0x6b7e:$str04: get_ServicePack 0x8929:$str05: Select * from AntivirusProduct 0x96b7:$str06: PCRestart 0x96cb:$str07: shutdown.exe /f /r /t 0 0x977d:$str08: StopReport 0x9753:$str09: StopDDos 0x9849:$str10: sendPlugin 0x98c9:$str11: OfflineKeylogger Not Enabled 0x9a21:$str12: -ExecutionPolicy Bypass -File " 0x9d66:$str13: Content-length: 5235
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x9e9f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9f3c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xa051:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x9c81:$cnc4: POST / HTTP/1.1
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.38bf0e0.1.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x9a7a:$str01: $VB$Local_Port 0x9a9e:$str02: $VB$Local_Host 0x83d8:$str03: get_Jpeg 0x897e:$str04: get_ServicePack 0xa729:$str05: Select * from AntivirusProduct 0xb4b7:$str06: PCRestart 0xb4cb:$str07: shutdown.exe /f /r /t 0 0xb57d:$str08: StopReport 0xb553:$str09: StopDDos 0xb649:$str10: sendPlugin 0xb6c9:$str11: OfflineKeylogger Not Enabled 0xb821:$str12: -ExecutionPolicy Bypass -File " 0xbb66:$str13: Content-length: 5235
1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xbc9f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xbd3c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbe51:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xba81:$cnc4: POST / HTTP/1.1
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ProcessId: 7960, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicroSoft Edges.lnk

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T09:37:02.158256+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:37:11.576724+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:37:21.819162+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:37:32.066725+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:37:32.251421+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:37:42.317131+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:37:52.563291+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:02.171663+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:02.815165+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:07.611606+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:15.036227+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:17.081408+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:20.882116+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:21.029550+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:26.195488+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:26.345117+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:31.459355+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:31.608410+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:32.183395+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:41.765596+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:52.007341+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:52.241393+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:02.193237+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:02.378771+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:04.552930+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:05.208340+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:15.460100+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:22.769829+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:22.920080+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:23.079535+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:32.210971+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:33.399742+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:43.648051+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:43.794985+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:46.708056+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:54.832813+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:54.983716+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:02.237394+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:03.164361+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:04.962385+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:05.392122+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:05.584237+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:10.319571+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:15.769839+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:15.917603+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:17.888312+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:18.829634+0100	2852870	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T09:37:11.594567+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:37:21.821838+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:37:32.069749+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:37:42.321313+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:37:52.565910+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:02.817196+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:07.613320+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:15.037944+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:17.089396+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:20.883874+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:21.030984+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:26.197012+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:26.346841+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:31.460935+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:31.613522+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:41.767355+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:52.009259+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:38:52.243123+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:02.380568+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:04.555041+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:05.211565+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:15.461844+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:22.772200+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:22.922093+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:23.083312+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:23.225962+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:23.230735+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:23.366440+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:33.402066+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:43.650515+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:43.796800+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:46.709914+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:54.834285+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:39:54.985115+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:03.167324+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:04.963965+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:05.396322+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:05.588699+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:10.321517+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:15.771312+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:15.920089+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:18.401706+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP
2025-03-15T09:40:18.830402+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T09:37:02.158256+0100	2852874	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:37:32.251421+0100	2852874	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:02.171663+0100	2852874	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:38:32.183395+0100	2852874	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:02.193237+0100	2852874	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:39:32.210971+0100	2852874	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP
2025-03-15T09:40:02.237394+0100	2852874	1	Malware Command and Control Activity Detected	104.245.240.123	59012	192.168.2.6	49698	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T09:38:31.214924+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.6	49698	104.245.240.123	59012	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Avira: detected

Antivirus detection for URL or domain

Source: code1.ydns.eu

Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["wqo9.firewall-gateway.de", "rency.ydns.eu", "code1.ydns.eu"], "Port": 59012, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for submitted file

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe	Virustotal: Detection: 71%			Perma Link
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe	ReversingLabs: Detection: 66%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wqo9.firewall-gateway.de,rency.ydns.eu,code1.ydns.eu
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 59012
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	String decryptor: <123456789>
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	String decryptor: <Xwormmm>
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	String decryptor: CLITH & KEL
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	String decryptor: USB.exe
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	String decryptor: %AppData%
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp	String decryptor: MicroSoft Edges.exe

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: MicroSoft Edges.exe.9.dr
Source:	Binary string: InstallUtil.pdb source: MicroSoft Edges.exe.9.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 104.245.240.123:59012 -> 192.168.2.6:49698
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 104.245.240.123:59012 -> 192.168.2.6:49698
Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49698 -> 104.245.240.123:59012
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.6:49698 -> 104.245.240.123:59012
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49698 -> 104.245.240.123:59012

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wqo9.firewall-gateway.de
Source: Malware configuration extractor	URLs: rency.ydns.eu
Source: Malware configuration extractor	URLs: code1.ydns.eu

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 104.245.240.123 ports 59012,0,1,2,5,9

Source: global traffic

TCP traffic: 192.168.2.6:49698 -> 104.245.240.123:59012

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: wqo9.firewall-gateway.de
Source: global traffic	DNS traffic detected: DNS query: rency.ydns.eu

Source: InstallUtil.exe, 00000009.00000002.3686559501.0000000002751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe	String found in binary or memory: https://api.openweathermap.org/data/2.5/weather?q=

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.InstallUtil.exe.1d0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.2.InstallUtil.exe.1d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

Code function: 1_2_027935B0 CreateProcessAsUserW,

1_2_027935B0

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_025EC8E0	1_2_025EC8E0
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_025E8D60	1_2_025E8D60
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_025E7F88	1_2_025E7F88
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_025EB280	1_2_025EB280
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_025E5918	1_2_025E5918
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02793B70	1_2_02793B70
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02792368	1_2_02792368
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02790040	1_2_02790040
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02793E68	1_2_02793E68
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02796468	1_2_02796468
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02793B63	1_2_02793B63
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_027903F9	1_2_027903F9
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02798BF8	1_2_02798BF8
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02790007	1_2_02790007
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02791600	1_2_02791600
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_027917DF	1_2_027917DF
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02790408	1_2_02790408
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02791D68	1_2_02791D68
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02791D58	1_2_02791D58
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_02794501	1_2_02794501
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_027915F0	1_2_027915F0
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C56668	1_2_05C56668
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C56658	1_2_05C56658
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C767A0	1_2_05C767A0
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C780A8	1_2_05C780A8
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C78C10	1_2_05C78C10
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C76790	1_2_05C76790
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C707A8	1_2_05C707A8
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C7A180	1_2_05C7A180
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C7A190	1_2_05C7A190
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F5798	1_2_074F5798
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F6648	1_2_074F6648
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F4558	1_2_074F4558
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F8D02	1_2_074F8D02
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F3939	1_2_074F3939
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F4DD1	1_2_074F4DD1
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F28A2	1_2_074F28A2
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F8B58	1_2_074F8B58
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F8B68	1_2_074F8B68
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F8301	1_2_074F8301
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F37D5	1_2_074F37D5
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F0220	1_2_074F0220
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F86A9	1_2_074F86A9
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F86B8	1_2_074F86B8
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F656D	1_2_074F656D
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F7520	1_2_074F7520
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F7530	1_2_074F7530
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F65CD	1_2_074F65CD
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F659D	1_2_074F659D
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074FD460	1_2_074FD460
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F8001	1_2_074F8001
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F8010	1_2_074F8010
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F44D7	1_2_074F44D7
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F88E0	1_2_074F88E0
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F88F0	1_2_074F88F0
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_074F98B2	1_2_074F98B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_025742B8	9_2_025742B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_0257E068	9_2_0257E068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_02571030	9_2_02571030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_025796F0	9_2_025796F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_0257DA40	9_2_0257DA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_02579FC0	9_2_02579FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_02573C68	9_2_02573C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_025793A8	9_2_025793A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_02571610	9_2_02571610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_0257BBE1	9_2_0257BBE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_060823BD	9_2_060823BD

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1627114005.0000000005000000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameFalimotin.dll4 vs Transferencia - BBVA 20250312.pdf(45KB).com.exe
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWindow Session Manager.exe4 vs Transferencia - BBVA 20250312.pdf(45KB).com.exe
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1612015847.000000000091E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Transferencia - BBVA 20250312.pdf(45KB).com.exe
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000000.1206669043.000000000047D000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenameW3E.exeP vs Transferencia - BBVA 20250312.pdf(45KB).com.exe
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1613249448.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWindow Session Manager.exe4 vs Transferencia - BBVA 20250312.pdf(45KB).com.exe
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1629268259.0000000007BF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRP8SH.dll6 vs Transferencia - BBVA 20250312.pdf(45KB).com.exe
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1626181440.0000000003899000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFalimotin.dll4 vs Transferencia - BBVA 20250312.pdf(45KB).com.exe
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe	Binary or memory string: OriginalFilenameW3E.exeP vs Transferencia - BBVA 20250312.pdf(45KB).com.exe

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.InstallUtil.exe.1d0000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.2.InstallUtil.exe.1d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, Fe60ExH.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, 2uSXTzuCbv3dJ70IaPLC5EIiVDP8UpoOEfGYTX5Gx90rGHLQyfChzzGRF.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ibqnpr9a2s9TtsVNFsmzXQ00uVGSBae9C0MnLXVGKR9ZOC8HXNfuthxCZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ibqnpr9a2s9TtsVNFsmzXQ00uVGSBae9C0MnLXVGKR9ZOC8HXNfuthxCZ.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/3@2/2

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Transferencia - BBVA 20250312.pdf(45KB).com.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\UM7rFYAybCy0xVXi

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe	Virustotal: Detection: 71%
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe	ReversingLabs: Detection: 66%

Source: unknown	Process created: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe "C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe"
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: MicroSoft Edges.lnk.9.dr

LNK file: ..\..\..\..\..\MicroSoft Edges.exe

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: MicroSoft Edges.exe.9.dr
Source:	Binary string: InstallUtil.pdb source: MicroSoft Edges.exe.9.dr

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.38bf0e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.5000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.38e4c30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.5000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.38e4c30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.38bf0e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1627114005.0000000005000000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1626181440.0000000003899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Transferencia - BBVA 20250312.pdf(45KB).com.exe PID: 7416, type: MEMORYSTR

.NET source code contains method to dynamically call methods (often used by packers)

Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ej0IqDHp1vhYbpLO8yMfHxWUW.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{tV5PDU1xTjqWr9ynxVsyWsE7V.me7sVpsWjIwzQBQgYxxTx7T1h,tV5PDU1xTjqWr9ynxVsyWsE7V.YaPYILAK9hVPFsUoWuemh65xS,tV5PDU1xTjqWr9ynxVsyWsE7V.iUU1yutvJ6Kb91eyqmwWJpkPL,tV5PDU1xTjqWr9ynxVsyWsE7V._0p3bDpYXuWiI7wVevq5isKV1N,ibqnpr9a2s9TtsVNFsmzXQ00uVGSBae9C0MnLXVGKR9ZOC8HXNfuthxCZ.UZTNEdNpmxlZWoHYhb42C24c8b1jgTwfYWROicvgC0DOy7WeHzNAu9Z9F()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ej0IqDHp1vhYbpLO8yMfHxWUW.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_1rnJD5Ww9yJulmAb0B8uhjSMYa8I0msgVyxdAtIUoI7NcCz9OBMYN5FAX[2],ibqnpr9a2s9TtsVNFsmzXQ00uVGSBae9C0MnLXVGKR9ZOC8HXNfuthxCZ.C5aR8bxgFRdKRdouSFv7gEfY4v8x7JJ6Zgh8Pif9q3El1HhrKhGHetbZy(Convert.FromBase64String(_1rnJD5Ww9yJulmAb0B8uhjSMYa8I0msgVyxdAtIUoI7NcCz9OBMYN5FAX[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ej0IqDHp1vhYbpLO8yMfHxWUW.cs	.Net Code: oTVmyCMiYmqodqDbBrI5pkIhH System.AppDomain.Load(byte[])
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ej0IqDHp1vhYbpLO8yMfHxWUW.cs	.Net Code: w6N1ltaWR3vWnbcAva63m090A System.AppDomain.Load(byte[])
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ej0IqDHp1vhYbpLO8yMfHxWUW.cs	.Net Code: w6N1ltaWR3vWnbcAva63m090A

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C7E1D0 pushad ; ret	1_2_05C7E1E3
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Code function: 1_2_05C7E210 push ecx; ret	1_2_05C7E222
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_0257A700 push eax; retf 0004h	9_2_0257A729
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_02576B97 push es; retf 0004h	9_2_02576BA2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_02576C57 push cs; retf 0004h	9_2_02576C62

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe

Static PE information: section name: .text entropy: 6.92952093328194

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, j6C0LkD.cs	High entropy of concatenated method names: 'Kb8r4FP', 'n2Y5Fxr', 'n6J1Smy', 'Wk5g3A7', 'o6F9Tcx', 'e2X7QgT', 'Xm3q7E6', 'Bx9p8C0', 'd3PMy86', 'a5N4Apm'
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, Re3p9CP.cs	High entropy of concatenated method names: 'p2A7Cdr', 'Dd86RkM', 'Ba35DoL', 'Hr1t6Z5', 'Ky3w2YG', 't5FWn2g', 'x3J0GgZ', 'g7HWc9j', 'Na1s9SY', 'Dw6k2QH'
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, d1X0Zyq.cs	High entropy of concatenated method names: 'Kw0k8TF', 'Ef9m7F6', 'y5FGj19', 'z1E7Ykj', 'Xx18Epd', 'Yi4q8KA', 'Ys4f5G0', 'j8M2Cax', 'c2E4PzC', 'Qq2z6FK'
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, x8SKp3q.cs	High entropy of concatenated method names: 'Wt47TcL', 'MoveNext', 'r9YRq56', 'SetStateMachine', 'Jo1x8HM', 'Wq8s5A9', 'g9K1PeF', 'r8WBi6y', 'w5X0QbK', 'm8NWd9z'
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, Fe60ExH.cs	High entropy of concatenated method names: 'w7QMq5j', 'a8D1ApB', 'Az2g3ZL', 'Wy8b7T2', 'Gd29Scr', 'Aw45Ytr', 'm8TJy70', 'f9S4Jna', 'Kc8f6HX', 'c2QEj5e'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, tV5PDU1xTjqWr9ynxVsyWsE7V.cs	High entropy of concatenated method names: '_0zNMLSQbynhoT4qxQ5a10YclBLCMVz4xGBiUM5CkoV', 'NCMM9mRZDgulAVYFx9asEWynljLTCN6jznwLZfb3Ny', 'gO3qG6YNudSCQDlMQxhDbegLEmZCapWYr2A2DZaBH4', 'RcAv9sgKfdaPk1FG8QVGZANzIXq8LLwg5j18zQV58Z'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, qgT2GvIgsR0Ldp3lGoRqtTdcIkAdkb6mvkZU6gDiof.cs	High entropy of concatenated method names: 'obHVmxqFmJ9WSwsmvTY8dCotv9raYpUgVyaC0HpYuW', 'nLYNtzy4A7T2u81Um4Oyyk8uSH3PvBLOyEvnYwC5pi', '_4PCHFztGkfbsz9JrRmpIWWQUedbul2qM8KDkrA5os4', '_0gzZwhqT40AObIsKt', 'm0B09r5oiDXpxGouI', 'CnGreHbfSvIzKUPyQ', 'WF2b12e8ncXY78psg', 'BpbPJGiaAiPTk19ui', '_53Vjw6mHBLxSBdWt3', 'A5zm5IafBwLXQbpOs'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, aPJyNzsVvfmZPUR3a8yAHN4SR.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'ZVEq8f5vmpxPOMgdAhpKqGIZt5vkWfMOhNpsni5HH7', 'rbO4crb7VaKm9WGLNytEzKxCANdWjIPKzEYa7Ntv6t', 'b9GZuTiQPcklXlACHUcotl8NBxZJL6ynwm6peFr5AL', '_3ioCYZREHE4k9A5HIjaeOd7clRvwCxxZuCcxwxyeeD'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, pFOMVfIpDXpJzgsSQZS2ifrKqH4jMvLGdHFBKACpjQ2yRHuelUouBxs41.cs	High entropy of concatenated method names: 'nHEV8ZkI5TxmtTae1J6dADNyW6RTTNl7np9emHL0n56qYqlzcYgLJXKoj', 'QkYQEbrzNSdVrF1Sn', '_05U3jYi1ocaTX8frd', 'F0Zf6HmArn9L2BFxF', 'hL1p7ewVG6ZruBYEs'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, kIjWI22NiDKj1WY722QeLvRud.cs	High entropy of concatenated method names: 'irdyuEmUyR0J0NG063EsIzGSO', 'buEWmM3mHTD2jjovdPARSKNyh', 'LIgwbJ2VAmUEaTT1nTuTqHy0G', 'VGX5vXC2qbJzsrd6ml7US5IVl', '_6PfYcncqD8rCuajAmLKilk7Jx', 'EBgWapqF9S9rbTi7OqqH9CvXn', '_5RNYfp9ux9klYvNoJuapsTI9S', 'S35ij15hoyL08tOJCUMEHrdOv', 'nR8o01ZxjlnNeVWO1KpyU5pnc', '_3EBd0kflfkhbPioZjPM2NXQFb'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, qFBMebozvEnnFRuNr6afTvuhz.cs	High entropy of concatenated method names: 'w4tI34N7HisbTPmRbNlzNRoW0', 'zFLlNOKN18AKrDqDoA6uB3sah', 'D1zr5HUcR30KJzYKMRfaQ0rMC', 'tLbWlJoAdmc14JlDEP9kHeOK9Wlwjs5R4TdcZ9zBgV', 'sXPzDvJMc2bhQAPLiKiwK1YJb4vqiJaTX0ltVPTfOR', '_3EwgNJvOHQOtvo5YfkmHIj11DCYoSKApPnDFwkUtC8', 'JhF5St1WQNND5PngKkAcJSjNmLa63iDscUpO2Rpt9C', 'jxdiL8OIc6tyCVtVLmSrtqcWTCHwdG7ulI9a4tDLFC', 'SQsMmUYa9Hp6q2dRFwB0f5ToGBSgUGzyHtS7erYeSE', '_8RpAZEN25f9P4jkhZnK0LaV0sxQXqr6dZY00ALpYM7'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ibqnpr9a2s9TtsVNFsmzXQ00uVGSBae9C0MnLXVGKR9ZOC8HXNfuthxCZ.cs	High entropy of concatenated method names: 'fDCH4d2cUQgd7VPb1F9OKPXsrUL6YRyCr6IHkgwsr7Kuszhv10BVbsSUx', 'I2MQHKbpItyLSSwEbdp4DrNzeMH8NPdu98nO8QdOZoNeKiy6LjJHAzyiL', 'YUf4mlI3vXVvW3izrlUIau9vcVmGv3ynm4SnE7H1RDHWdJrw0J0vXACBi', 'w77OwwaiXxt5FqdvaUU7TdlbBX64OMWfeS0U1vLpRPz6rexqoTNgqDKKJ', 'An3J5vDnfUla707ZlAU0NuYvmn4HXCxjywDY0Quv5ibzPILkVquPx9e0B', 'R1dcGjzNR6Z9tJIj5wPmUQs1Kf6xbd7RvYthgI46TxVelxK8F66rRXspX', 'RKpA3quo4ydvCrbggpTUXYanrBwQqQvO9QUGk247HQcWCywtwzDNO9IKi', '_6gCq0kXygFxQiIDALHTMKenCRe4kSzS8RPKoYwf0HTj98FGLFABUIdqzZ', 'otBCMPK5HSWdDSxkY9SoFdbsGLy6oSGvyajvzlj5vjiOJ9GVoYU4MlsH8', 'uS9wfP7Q17vMfiITR7qOOYqV9Fn8mfwyhcHcavN6PVHMVo4ouHs1798VS'
Source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, ej0IqDHp1vhYbpLO8yMfHxWUW.cs	High entropy of concatenated method names: 'KOz2mFUbwIgRytSpQpfgFTzNp', 'oTVmyCMiYmqodqDbBrI5pkIhH', 'SLdpWLKwqX1qkMgjvfvRDrjeB', 'fBmta6IllUG7sOmVfbhDrGtrl', 'noh4qkUK6hYdzQdXH3Gxvisih', '_85ZoE6FFIh7Jo3v14R6J2WQjo', '_9A3B7xqBCEl6JKDodBqmHPdkB', 'GQTnKjOUdVg3sEj7f1LCTieyC', '_4J4EGlTRgESedLcEtt9kEPxdE', 'GlCchviw13BQjWynqiy344s87'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Roaming\MicroSoft Edges.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicroSoft Edges.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicroSoft Edges.lnk

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

File opened: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Transferencia - BBVA 20250312.pdf(45KB).com.exe PID: 7416, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: 25A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: 2830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: 7D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: 8D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: 8F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: 9F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: A2B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: B2B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4750000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 495			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 9339			Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe TID: 7536	Thread sleep time: -67000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe TID: 7556	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe TID: 7620	Thread sleep time: -67000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe TID: 7440	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1020	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5880	Thread sleep count: 495 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5880	Thread sleep count: 9339 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1627114005.0000000005000000.00000004.08000000.00040000.00000000.sdmp, Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1626181440.0000000003899000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxTray
Source: Transferencia - BBVA 20250312.pdf(45KB).com.exe, 00000001.00000002.1626181440.0000000003899000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: sandboxierpcssGSOFTWARE\VMware, Inc.\VMware VGAuth
Source: InstallUtil.exe, 00000009.00000002.3684941369.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1D0000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1D0000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1D0000	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1D2000	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1E0000	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1E2000	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3D3008	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 412000	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 72E008	Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"			Jump to behavior

Source: InstallUtil.exe, 00000009.00000002.3686559501.00000000028D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: InstallUtil.exe, 00000009.00000002.3686559501.00000000028D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0Te
Source: InstallUtil.exe, 00000009.00000002.3686559501.00000000028D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: InstallUtil.exe, 00000009.00000002.3686559501.00000000028D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: InstallUtil.exe, 00000009.00000002.3686559501.00000000028D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert-

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Queries volume information: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Transferencia - BBVA 20250312.pdf(45KB).com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: InstallUtil.exe, 00000009.00000002.3684941369.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 3.2.InstallUtil.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3686559501.0000000002751000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Transferencia - BBVA 20250312.pdf(45KB).com.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7960, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 3.2.InstallUtil.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Transferencia - BBVA 20250312.pdf(45KB).com.exe.28aa554.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1285625116.00000000001D2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3686559501.0000000002751000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1613249448.0000000002838000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Transferencia - BBVA 20250312.pdf(45KB).com.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7960, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	11 Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	1 Masquerading	OS Credential Dumping	131 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Valid Accounts	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	312 Process Injection	1 Access Token Manipulation	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	312 Process Injection	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Deobfuscate/Decode Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Obfuscated Files or Information	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	22 Software Packing	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 DLL Side-Loading	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Transferencia - BBVA 20250312.pdf(45KB).com.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Transferencia - BBVA 20250312.pdf(45KB).com.exe