Loading ...

Play interactive tourEdit tour

Windows Analysis Report Payment_Swift,png.exe

Overview

General Information

Sample Name:Payment_Swift,png.exe
Analysis ID:502638
MD5:f589816b35976438b88a621266d7d071
SHA1:1a845d22e5378b8771536806bb312f6ded7b1046
SHA256:e4c466fd6fb96b2ffc5682a75154df8501c8edb5234b14349ba5c01afc717b12
Tags:agentteslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Detected unpacking (overwrites its own PE header)
Yara detected AgentTesla
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Executable has a suspicious name (potential lure to open the executable)
Moves itself to temp directory
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Yara detected Credential Stealer
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Drops PE files
Contains functionality to read the PEB
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • Payment_Swift,png.exe (PID: 5908 cmdline: 'C:\Users\user\Desktop\Payment_Swift,png.exe' MD5: F589816B35976438B88A621266D7D071)
    • Payment_Swift,png.exe (PID: 5944 cmdline: 'C:\Users\user\Desktop\Payment_Swift,png.exe' MD5: F589816B35976438B88A621266D7D071)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "info@alishair.rs", "Password": "qR8JmTXtlKf0", "Host": "mail.alishair.rs"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.919115676.0000000004992000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000001.00000002.919115676.0000000004992000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000001.00000002.919064429.0000000004950000.00000004.00020000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000001.00000002.919064429.0000000004950000.00000004.00020000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000001.00000001.657206121.0000000000400000.00000040.00020000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 14 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.1.Payment_Swift,png.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.1.Payment_Swift,png.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                0.2.Payment_Swift,png.exe.f001458.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  0.2.Payment_Swift,png.exe.f001458.2.raw.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    1.2.Payment_Swift,png.exe.4990000.5.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 33 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 1.2.Payment_Swift,png.exe.400000.1.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "info@alishair.rs", "Password": "qR8JmTXtlKf0", "Host": "mail.alishair.rs"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Payment_Swift,png.exeVirustotal: Detection: 29%Perma Link
                      Machine Learning detection for sampleShow sources
                      Source: Payment_Swift,png.exeJoe Sandbox ML: detected
                      Source: 1.2.Payment_Swift,png.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.1.Payment_Swift,png.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.2.Payment_Swift,png.exe.4990000.5.unpackAvira: Label: TR/Spy.Gen8

                      Compliance:

                      barindex
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeUnpacked PE file: 1.2.Payment_Swift,png.exe.400000.1.unpack
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeUnpacked PE file: 1.2.Payment_Swift,png.exe.4990000.5.unpack
                      Source: Payment_Swift,png.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: Binary string: wntdll.pdbUGP source: Payment_Swift,png.exe, 00000000.00000003.656745520.000000000F040000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Payment_Swift,png.exe, 00000000.00000003.656745520.000000000F040000.00000004.00000001.sdmp
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_00405E93 FindFirstFileA,FindClose,0_2_00405E93
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,0_2_004054BD
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_00402671 FindFirstFileA,0_2_00402671
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00404A29 FindFirstFileExW,1_2_00404A29

                      Networking:

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49851 -> 78.46.56.160:587
                      Source: Joe Sandbox ViewASN Name: HETZNER-ASDE HETZNER-ASDE
                      Source: global trafficTCP traffic: 192.168.2.4:49851 -> 78.46.56.160:587
                      Source: global trafficTCP traffic: 192.168.2.4:49851 -> 78.46.56.160:587
                      Source: Payment_Swift,png.exe, 00000001.00000002.918296009.0000000002471000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Payment_Swift,png.exe, 00000001.00000002.918296009.0000000002471000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Payment_Swift,png.exe, 00000001.00000002.918296009.0000000002471000.00000004.00000001.sdmpString found in binary or memory: http://RoaIUm.com
                      Source: Payment_Swift,png.exe, 00000001.00000002.918750136.00000000027C8000.00000004.00000001.sdmpString found in binary or memory: http://alishair.rs
                      Source: Payment_Swift,png.exe, 00000001.00000002.918705683.000000000277C000.00000004.00000001.sdmp, Payment_Swift,png.exe, 00000001.00000002.918766104.00000000027D5000.00000004.00000001.sdmp, Payment_Swift,png.exe, 00000001.00000003.868543412.00000000005D4000.00000004.00000001.sdmpString found in binary or memory: http://kTKI1CRL4jwK4qEe.org
                      Source: Payment_Swift,png.exe, 00000001.00000002.918750136.00000000027C8000.00000004.00000001.sdmpString found in binary or memory: http://mail.alishair.rs
                      Source: Payment_Swift,png.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
                      Source: Payment_Swift,png.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                      Source: Payment_Swift,png.exe, 00000001.00000002.918296009.0000000002471000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%$
                      Source: Payment_Swift,png.exe, 00000001.00000002.918296009.0000000002471000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: Payment_Swift,png.exeString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Payment_Swift,png.exe, 00000001.00000002.918296009.0000000002471000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: unknownDNS traffic detected: queries for: mail.alishair.rs
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00404FC2

                      System Summary:

                      barindex
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Payment_Swift,png.exe
                      .NET source code contains very large array initializationsShow sources
                      Source: 1.2.Payment_Swift,png.exe.4990000.5.unpack, u003cPrivateImplementationDetailsu003eu007bECFDFD74u002d3329u002d4626u002dA3C8u002dE4302F1A4829u007d/D3F97F87u002d022Eu002d4672u002dAC2Eu002d7174979C741F.csLarge array initialization: .cctor: array initializer size 11970
                      Executable has a suspicious name (potential lure to open the executable)Show sources
                      Source: Payment_Swift,png.exeStatic file information: Suspicious name
                      Source: Payment_Swift,png.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,0_2_004030FB
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_004047D30_2_004047D3
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_004061D40_2_004061D4
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_729B6A330_2_729B6A33
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_729B6A240_2_729B6A24
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0040A2A51_2_0040A2A5
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0057EA181_2_0057EA18
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0057D3581_2_0057D358
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_005727601_2_00572760
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00571FE01_2_00571FE0
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0094BD281_2_0094BD28
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00946E481_2_00946E48
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0095C1A81_2_0095C1A8
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00954AE81_2_00954AE8
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00956DB81_2_00956DB8
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_009516201_2_00951620
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00953F201_2_00953F20
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0095F8B81_2_0095F8B8
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_009594D01_2_009594D0
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00951F981_2_00951F98
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_022747A01_2_022747A0
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_022746B01_2_022746B0
                      Source: Payment_Swift,png.exe, 00000000.00000003.652988324.000000000F2EF000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Payment_Swift,png.exe
                      Source: Payment_Swift,png.exe, 00000000.00000002.659733412.000000000EFF0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamedLRvAUZAIMwHAIjyyqmOVnMDGEqKXZyRqf.exe4 vs Payment_Swift,png.exe
                      Source: Payment_Swift,png.exeBinary or memory string: OriginalFilename vs Payment_Swift,png.exe
                      Source: Payment_Swift,png.exe, 00000001.00000002.919115676.0000000004992000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamedLRvAUZAIMwHAIjyyqmOVnMDGEqKXZyRqf.exe4 vs Payment_Swift,png.exe
                      Source: Payment_Swift,png.exe, 00000001.00000002.917122493.0000000000199000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Payment_Swift,png.exe
                      Source: Payment_Swift,png.exeVirustotal: Detection: 29%
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeFile read: C:\Users\user\Desktop\Payment_Swift,png.exeJump to behavior
                      Source: Payment_Swift,png.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Payment_Swift,png.exe 'C:\Users\user\Desktop\Payment_Swift,png.exe'
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess created: C:\Users\user\Desktop\Payment_Swift,png.exe 'C:\Users\user\Desktop\Payment_Swift,png.exe'
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess created: C:\Users\user\Desktop\Payment_Swift,png.exe 'C:\Users\user\Desktop\Payment_Swift,png.exe' Jump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeFile created: C:\Users\user\AppData\Local\Temp\nspB567.tmpJump to behavior
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/2@2/1
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_00402053 CoCreateInstance,MultiByteToWideChar,0_2_00402053
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_00404292
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,1_2_00401489
                      Source: 1.2.Payment_Swift,png.exe.4990000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.2.Payment_Swift,png.exe.4990000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: Binary string: wntdll.pdbUGP source: Payment_Swift,png.exe, 00000000.00000003.656745520.000000000F040000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Payment_Swift,png.exe, 00000000.00000003.656745520.000000000F040000.00000004.00000001.sdmp

                      Data Obfuscation:

                      barindex
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeUnpacked PE file: 1.2.Payment_Swift,png.exe.400000.1.unpack
                      Detected unpacking (changes PE section rights)Show sources
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeUnpacked PE file: 1.2.Payment_Swift,png.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;
                      Detected unpacking (creates a PE file in dynamic memory)Show sources
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeUnpacked PE file: 1.2.Payment_Swift,png.exe.4990000.5.unpack
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_729B1080 push eax; ret 0_2_729B10AE
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00401F16 push ecx; ret 1_2_00401F29
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00954AE8 push edx; retf 1_2_00955311
                      Source: qxtkzfqfq.dll.0.drStatic PE information: real checksum: 0x10bc8 should be: 0x15201
                      Source: Payment_Swift,png.exeStatic PE information: real checksum: 0x0 should be: 0x4ea22
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeFile created: C:\Users\user\AppData\Local\Temp\nskB597.tmp\qxtkzfqfq.dllJump to dropped file

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Moves itself to temp directoryShow sources
                      Source: c:\users\user\desktop\payment_swift,png.exeFile moved: C:\Users\user\AppData\Local\Temp\tmpG130.tmpJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exe TID: 6812Thread sleep time: -11990383647911201s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exe TID: 7004Thread sleep count: 369 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exe TID: 7004Thread sleep count: 9485 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeWindow / User API: threadDelayed 369Jump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeWindow / User API: threadDelayed 9485Jump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_00405E93 FindFirstFileA,FindClose,0_2_00405E93
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,0_2_004054BD
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_00402671 FindFirstFileA,0_2_00402671
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00404A29 FindFirstFileExW,1_2_00404A29
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0040446F
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_004067FE GetProcessHeap,1_2_004067FE
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_729B6402 mov eax, dword ptr fs:[00000030h]0_2_729B6402
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_729B66C7 mov eax, dword ptr fs:[00000030h]0_2_729B66C7
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_729B6616 mov eax, dword ptr fs:[00000030h]0_2_729B6616
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_729B6706 mov eax, dword ptr fs:[00000030h]0_2_729B6706
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_729B6744 mov eax, dword ptr fs:[00000030h]0_2_729B6744
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_004035F1 mov eax, dword ptr fs:[00000030h]1_2_004035F1
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0057DEE8 LdrInitializeThunk,1_2_0057DEE8
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeMemory allocated: page read and write | page guardJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00401E1D SetUnhandledExceptionFilter,1_2_00401E1D
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0040446F
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00401C88
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00401F30

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeMemory written: C:\Users\user\Desktop\Payment_Swift,png.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeProcess created: C:\Users\user\Desktop\Payment_Swift,png.exe 'C:\Users\user\Desktop\Payment_Swift,png.exe' Jump to behavior
                      Source: Payment_Swift,png.exe, 00000001.00000002.918027987.0000000000E60000.00000002.00020000.sdmpBinary or memory string: Program Manager
                      Source: Payment_Swift,png.exe, 00000001.00000002.918027987.0000000000E60000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Payment_Swift,png.exe, 00000001.00000002.918027987.0000000000E60000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: Payment_Swift,png.exe, 00000001.00000002.918027987.0000000000E60000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeQueries volume information: unknown VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_0040208D cpuid 1_2_0040208D
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 1_2_00401B74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,1_2_00401B74
                      Source: C:\Users\user\Desktop\Payment_Swift,png.exeCode function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,0_2_004030FB

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources