Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SWIFT TRANSFER.exe

Overview

General Information

Sample Name:SWIFT TRANSFER.exe
Analysis ID:680490
MD5:735ee862055fcbcc574b73b1695af599
SHA1:a4438d8649da60b9ed19aa5d98962dc1de1efa3a
SHA256:b496205d5045c9c9f9407bfca6a4c9088218560c2884fd737c8efe76352ae3ca
Tags:agentteslaexe
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Snort IDS alert for network traffic
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • SWIFT TRANSFER.exe (PID: 5952 cmdline: "C:\Users\user\Desktop\SWIFT TRANSFER.exe" MD5: 735EE862055FCBCC574B73B1695AF599)
    • SWIFT TRANSFER.exe (PID: 5752 cmdline: C:\Users\user\Desktop\SWIFT TRANSFER.exe MD5: 735EE862055FCBCC574B73B1695AF599)
      • WerFault.exe (PID: 1228 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "marketing9@activandalucia.com", "Password": "iyke123456789@$", "Host": "mail.activandalucia.com"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
        00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_AgentTesla_d3ac2b2funknownunknown
        • 0x304fe:$a13: get_DnsResolver
        • 0x2ecef:$a20: get_LastAccessed
        • 0x30e7c:$a27: set_InternalServerPort
        • 0x311a1:$a30: set_GuidMasterKey
        • 0x2edf6:$a33: get_Clipboard
        • 0x2ee04:$a34: get_Keyboard
        • 0x30119:$a35: get_ShiftKeyDown
        • 0x3012a:$a36: get_AltKeyDown
        • 0x2ee11:$a37: get_Password
        • 0x2f8b5:$a38: get_PasswordHash
        • 0x308fe:$a39: get_DefaultCredentials
        00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          Click to see the 11 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          4.0.SWIFT TRANSFER.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            4.0.SWIFT TRANSFER.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
              4.0.SWIFT TRANSFER.exe.400000.0.unpackMALWARE_Win_AgentTeslaV3AgentTeslaV3 infostealer payloadditekSHen
              • 0x32fce:$s10: logins
              • 0x32a35:$s11: credential
              • 0x2eff6:$g1: get_Clipboard
              • 0x2f004:$g2: get_Keyboard
              • 0x2f011:$g3: get_Password
              • 0x30309:$g4: get_CtrlKeyDown
              • 0x30319:$g5: get_ShiftKeyDown
              • 0x3032a:$g6: get_AltKeyDown
              4.0.SWIFT TRANSFER.exe.400000.0.unpackWindows_Trojan_AgentTesla_d3ac2b2funknownunknown
              • 0x306fe:$a13: get_DnsResolver
              • 0x2eeef:$a20: get_LastAccessed
              • 0x3107c:$a27: set_InternalServerPort
              • 0x313a1:$a30: set_GuidMasterKey
              • 0x2eff6:$a33: get_Clipboard
              • 0x2f004:$a34: get_Keyboard
              • 0x30319:$a35: get_ShiftKeyDown
              • 0x3032a:$a36: get_AltKeyDown
              • 0x2f011:$a37: get_Password
              • 0x2fab5:$a38: get_PasswordHash
              • 0x30afe:$a39: get_DefaultCredentials
              0.2.SWIFT TRANSFER.exe.3a04e80.6.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                Click to see the 22 entries

                Sigma Signatures

                ⊘No Sigma rule has matched

                Snort Signatures

                Timestamp:192.168.2.3185.162.171.75497445872851779 08/08/22-17:36:37.122597
                SID:2851779
                Source Port:49744
                Destination Port:587
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.3185.162.171.75497445872030171 08/08/22-17:36:37.122505
                SID:2030171
                Source Port:49744
                Destination Port:587
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.3185.162.171.75497445872840032 08/08/22-17:36:37.122597
                SID:2840032
                Source Port:49744
                Destination Port:587
                Protocol:TCP
                Classtype:A Network Trojan was detected

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: SWIFT TRANSFER.exeReversingLabs: Detection: 37%
                Machine Learning detection for sample
                Source: SWIFT TRANSFER.exeJoe Sandbox ML: detected
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "marketing9@activandalucia.com", "Password": "iyke123456789@$", "Host": "mail.activandalucia.com"}
                Source: SWIFT TRANSFER.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: SWIFT TRANSFER.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: System.Core.ni.pdbRSDSD source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb( source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Xml.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.pdb|M source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Management.pdb8 source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: i,C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: C:\Users\user\Desktop\SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: System.Configuration.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: .pdb) source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.pdbE source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Configuration.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000002.329259032.0000000001280000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.310573186.0000000001280000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Xml.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: CustomMarshalers.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: Microsoft.VisualBasic.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Users\user\Desktop\SWIFT TRANSFER.PDBay- source: SWIFT TRANSFER.exe, 00000004.00000000.303998535.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000002.329297686.0000000001297000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Windows.Forms.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\dll\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Management.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.pdb| source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: CustomMarshalers.pdbCA source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Xml.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.ni.pdb source: WERBDDB.tmp.dmp.15.dr

                Networking

                barindex
                Snort IDS alert for network traffic
                Source: TrafficSnort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49744 -> 185.162.171.75:587
                Source: TrafficSnort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49744 -> 185.162.171.75:587
                Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49744 -> 185.162.171.75:587
                Source: Joe Sandbox ViewASN Name: ASN-XTUDIONETES ASN-XTUDIONETES
                Source: Joe Sandbox ViewIP Address: 185.162.171.75 185.162.171.75
                Source: global trafficTCP traffic: 192.168.2.3:49744 -> 185.162.171.75:587
                Source: global trafficTCP traffic: 192.168.2.3:49744 -> 185.162.171.75:587
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://DynDns.comDynDNSnamejidPsi/Psi
                Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.307429408.00000000031D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://TWzBs3cIiDHX5nVtjxF.com
                Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://activandalucia.com
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247217501.00000000057B6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://en.w
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
                Source: SWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.activandalucia.com
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ohMkNy.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com6
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comFN
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comFc
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coma
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comalsa
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comalsd
                Source: SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comd
                Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.come.com
                Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.268803149.00000000057B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coml1
                Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.como
                Source: SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.como$
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cF
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248581922.00000000057B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cncro
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cns-e
                Source: SWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnz
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: SWIFT TRANSFER.exe, 00000000.00000003.255063791.00000000057E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/U
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/$
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp//$
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/6
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/=
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/N
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/P
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/c
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/j
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/G
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/u
                Source: SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/u
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247410435.00000000057CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com#
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.come
                Source: SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comt
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org%
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org%facebooktwittergmailinstagrammovieskypepornhackwhatsappdiscordemailpassword%st
                Source: SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
                Source: unknownDNS traffic detected: queries for: mail.activandalucia.com
                Source: SWIFT TRANSFER.exe, 00000000.00000002.269297304.0000000000C8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                Spam, unwanted Advertisements and Ransom Demands

                barindex
                Modifies the hosts file
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
                Source: SWIFT TRANSFER.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                Source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTRMatched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_04CFCD04
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_04CFF0D0
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_05299BB0
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_05299B9F
                Source: SWIFT TRANSFER.exe, 00000000.00000002.285789862.00000000070B0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDoncepre.dll@ vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000000.243752092.00000000004E2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameSoapParameterAttrib.exeB vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDoncepre.dll@ vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270431587.000000000293B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWebName.dll4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000003.259589583.0000000000D19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameKeysNormalize.dll4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.269297304.0000000000C8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.285119359.0000000006EE0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameKeysNormalize.dll4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000000.00000002.285393726.0000000006F40000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameWebName.dll4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000004.00000000.303386378.00000000011FA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exe, 00000004.00000000.267496263.0000000000438000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenamereaJZGgUbbSPEfasvVHwwYdgRFCEEO.exe4 vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exeBinary or memory string: OriginalFilenameSoapParameterAttrib.exeB vs SWIFT TRANSFER.exe
                Source: SWIFT TRANSFER.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: SWIFT TRANSFER.exeReversingLabs: Detection: 37%
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile read: C:\Users\user\Desktop\SWIFT TRANSFER.exeJump to behavior
                Source: SWIFT TRANSFER.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                Source: unknownProcess created: C:\Users\user\Desktop\SWIFT TRANSFER.exe "C:\Users\user\Desktop\SWIFT TRANSFER.exe"
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exe
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exe
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT TRANSFER.exe.logJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDDB.tmpJump to behavior
                Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.winEXE@4/6@2/1
                Source: SWIFT TRANSFER.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Windows\SysWOW64\WerFault.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Windows\SysWOW64\WerFault.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5752
                Source: SWIFT TRANSFER.exe, ProcExpGUI/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: 0.0.SWIFT TRANSFER.exe.4e0000.0.unpack, ProcExpGUI/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                Source: SWIFT TRANSFER.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: SWIFT TRANSFER.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: System.Core.ni.pdbRSDSD source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb( source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Xml.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.pdb|M source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Management.pdb8 source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: i,C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: C:\Users\user\Desktop\SWIFT TRANSFER.PDB source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: System.Configuration.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: .pdb) source: SWIFT TRANSFER.exe, 00000004.00000000.303243098.0000000000F58000.00000004.00000010.00020000.00000000.sdmp
                Source: Binary string: \??\C:\Windows\dll\System.pdbE source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Configuration.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000002.329259032.0000000001280000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.310573186.0000000001280000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Xml.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: CustomMarshalers.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.304259363.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: Microsoft.VisualBasic.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Users\user\Desktop\SWIFT TRANSFER.PDBay- source: SWIFT TRANSFER.exe, 00000004.00000000.303998535.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000002.329297686.0000000001297000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Windows.Forms.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\dll\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Management.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: SWIFT TRANSFER.exe, 00000004.00000000.303480655.0000000001225000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mscorlib.ni.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.pdb| source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Core.pdb source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Configuration.ni.pdbRSDSO* source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: CustomMarshalers.pdbCA source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.Xml.ni.pdbRSDS source: WERBDDB.tmp.dmp.15.dr
                Source: Binary string: System.ni.pdb source: WERBDDB.tmp.dmp.15.dr

                Data Obfuscation

                barindex
                .NET source code contains potential unpacker
                Source: SWIFT TRANSFER.exe, ProcExpGUI/Form1.cs.Net Code: WaitHandle System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                Source: 0.0.SWIFT TRANSFER.exe.4e0000.0.unpack, ProcExpGUI/Form1.cs.Net Code: WaitHandle System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_0529AC38 push eax; ret
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeCode function: 0_2_0529AC90 pushfd ; ret
                Source: initial sampleStatic PE information: section name: .text entropy: 7.792812997909333
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM3
                Source: Yara matchFile source: 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: SWIFT TRANSFER.exe, 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                Source: SWIFT TRANSFER.exe, 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 6028Thread sleep time: -45877s >= -30000s
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 5888Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 5364Thread sleep time: -3689348814741908s >= -30000s
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exe TID: 1008Thread sleep count: 9589 > 30
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWindow / User API: threadDelayed 9589
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess information queried: ProcessInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 45877
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeThread delayed: delay time: 922337203685477
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                Source: SWIFT TRANSFER.exe, 00000004.00000000.304103446.000000000129B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: SWIFT TRANSFER.exe, 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess queried: DebugPort
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess queried: DebugPort
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeMemory allocated: page read and write | page guard

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Modifies the hosts file
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeMemory written: C:\Users\user\Desktop\SWIFT TRANSFER.exe base: 400000 value starts with: 4D5A
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeProcess created: C:\Users\user\Desktop\SWIFT TRANSFER.exe C:\Users\user\Desktop\SWIFT TRANSFER.exe
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Users\user\Desktop\SWIFT TRANSFER.exe VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Users\user\Desktop\SWIFT TRANSFER.exe VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                Lowering of HIPS / PFW / Operating System Security Settings

                barindex
                Modifies the hosts file
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected AgentTesla
                Source: Yara matchFile source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                Tries to harvest and steal ftp login credentials
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                Source: C:\Users\user\Desktop\SWIFT TRANSFER.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                Source: Yara matchFile source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Yara detected AgentTesla
                Source: Yara matchFile source: 4.0.SWIFT TRANSFER.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.39d0260.5.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3a04e80.6.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.39d0260.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0.2.SWIFT TRANSFER.exe.3999840.7.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5952, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: SWIFT TRANSFER.exe PID: 5752, type: MEMORYSTR

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid Accounts211
                Windows Management Instrumentation                		Path Interception111
                Process Injection                		1
                Masquerading                		2
                OS Credential Dumping                		221
                Security Software Discovery                		Remote Services1
                Email Collection                		Exfiltration Over Other Network Medium1
                Encrypted Channel                		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
                File and Directory Permissions Modification                		1
                Input Capture                		1
                Process Discovery                		Remote Desktop Protocol1
                Input Capture                		Exfiltration Over Bluetooth1
                Non-Standard Port                		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
                Disable or Modify Tools                		1
                Credentials in Registry                		141
                Virtualization/Sandbox Evasion                		SMB/Windows Admin Shares11
                Archive Collected Data                		Automated Exfiltration1
                Non-Application Layer Protocol                		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)141
                Virtualization/Sandbox Evasion                		NTDS1
                Application Window Discovery                		Distributed Component Object Model2
                Data from Local System                		Scheduled Transfer11
                Application Layer Protocol                		SIM Card SwapCarrier Billing Fraud
                Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script111
                Process Injection                		LSA Secrets1
                Remote System Discovery                		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                Replication Through Removable MediaLaunchdRc.commonRc.common1
                Deobfuscate/Decode Files or Information                		Cached Domain Credentials114
                System Information Discovery                		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                External Remote ServicesScheduled TaskStartup ItemsStartup Items2
                Obfuscated Files or Information                		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job12
                Software Packing                		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                SWIFT TRANSFER.exe38%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
                SWIFT TRANSFER.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                SourceDetectionScannerLabelLinkDownload
                4.0.SWIFT TRANSFER.exe.400000.0.unpack100%AviraHEUR/AGEN.1203035Download File

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.fontbureau.comalsa0%URL Reputationsafe
                http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.founder.com.cn/cncro0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/jp/G0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.founder.com.cF0%Avira URL Cloudsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.fontbureau.comFN0%Avira URL Cloudsafe
                http://www.fontbureau.coml10%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/60%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.fontbureau.com60%Avira URL Cloudsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/$0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.sajatypeworks.come0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                https://api.ipify.org%0%URL Reputationsafe
                http://www.fontbureau.comalsd0%URL Reputationsafe
                http://www.sajatypeworks.comt0%URL Reputationsafe
                http://www.galapagosdesign.com/U0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/P0%URL Reputationsafe
                http://www.fontbureau.como$0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/N0%URL Reputationsafe
                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www0%URL Reputationsafe
                http://mail.activandalucia.com0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp//$0%Avira URL Cloudsafe
                http://www.founder.com.cn/cnz0%URL Reputationsafe
                http://TWzBs3cIiDHX5nVtjxF.com0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/jp/u0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                http://www.fontbureau.coma0%URL Reputationsafe
                http://www.fontbureau.comd0%URL Reputationsafe
                http://www.fontbureau.come.com0%URL Reputationsafe
                http://en.w0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/=0%URL Reputationsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://activandalucia.com0%Avira URL Cloudsafe
                http://www.founder.com.cn/cn0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/u0%URL Reputationsafe
                http://DynDns.comDynDNSnamejidPsi/Psi0%Avira URL Cloudsafe
                http://ohMkNy.com0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                http://www.fontbureau.como0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/j0%URL Reputationsafe
                http://www.fontbureau.comFc0%Avira URL Cloudsafe
                http://www.jiyu-kobo.co.jp/c0%URL Reputationsafe
                http://www.sajatypeworks.com#0%Avira URL Cloudsafe
                https://api.ipify.org%facebooktwittergmailinstagrammovieskypepornhackwhatsappdiscordemailpassword%st0%Avira URL Cloudsafe
                http://www.founder.com.cn/cns-e0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                activandalucia.com
                		185.162.171.75
                		truetrue
                  		unknown
                  mail.activandalucia.com
                  		unknown
                  		unknowntrue
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://www.fontbureau.comalsaSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://127.0.0.1:HTTP/1.1SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		low
                    http://www.fontbureau.com/designersGSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://www.fontbureau.com/designers/?SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.founder.com.cn/cn/bTheSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.founder.com.cn/cncroSWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.jiyu-kobo.co.jp/jp/GSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers?SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.tiro.comSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cFSWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designersSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.goodfont.co.krSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.comFNSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.coml1SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.268803149.00000000057B0000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comSWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.typography.netDSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.founder.com.cn/cn/cTheSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.galapagosdesign.com/staff/dennis.htmSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://fontfabrik.comSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/6SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.galapagosdesign.com/DPleaseSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com6SWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fonts.comSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.sandoll.co.krSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.urwpp.deDPleaseSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/$SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.zhongyicts.com.cnSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.sajatypeworks.comeSWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.sakkal.comSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://api.ipify.org%SWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		low
                              http://www.fontbureau.comalsdSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.apache.org/licenses/LICENSE-2.0SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.fontbureau.comSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.sajatypeworks.comtSWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247035784.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247060632.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.galapagosdesign.com/USWIFT TRANSFER.exe, 00000000.00000003.255063791.00000000057E8000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/PSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.como$SWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  http://www.jiyu-kobo.co.jp/NSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://wwwSWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://mail.activandalucia.comSWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp//$SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.founder.com.cn/cnzSWIFT TRANSFER.exe, 00000000.00000003.248500769.00000000057B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://TWzBs3cIiDHX5nVtjxF.comSWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000004.00000000.307429408.00000000031D7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/jp/uSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/jp/SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.comaSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.comdSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.come.comSWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://en.wSWIFT TRANSFER.exe, 00000000.00000003.247217501.00000000057B6000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/=SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.carterandcone.comlSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://activandalucia.comSWIFT TRANSFER.exe, 00000004.00000000.307405307.00000000031CA000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.com/designers/cabarga.htmlNSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.founder.com.cn/cnSWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248581922.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers/frere-jones.htmlSWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.jiyu-kobo.co.jp/uSWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://DynDns.comDynDNSnamejidPsi/PsiSWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://ohMkNy.comSWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.jiyu-kobo.co.jp/SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.comoSWIFT TRANSFER.exe, 00000000.00000003.257295199.00000000057BA000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers8SWIFT TRANSFER.exe, 00000000.00000002.283513984.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.jiyu-kobo.co.jp/jSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.comFcSWIFT TRANSFER.exe, 00000000.00000003.253917347.00000000057B7000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.254122853.00000000057B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.jiyu-kobo.co.jp/cSWIFT TRANSFER.exe, 00000000.00000003.250668134.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250582444.00000000057BB000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.sajatypeworks.com#SWIFT TRANSFER.exe, 00000000.00000003.247148499.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247768317.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249183528.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247719338.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247113059.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248747408.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247087736.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.250081839.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248557469.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249647219.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249350396.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249593958.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248948890.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247811179.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247225943.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249378726.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.248205329.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247253094.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247669947.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.249845353.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, SWIFT TRANSFER.exe, 00000000.00000003.247410435.00000000057CB000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://api.ipify.org%facebooktwittergmailinstagrammovieskypepornhackwhatsappdiscordemailpassword%stSWIFT TRANSFER.exe, 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		low
                                        http://www.founder.com.cn/cns-eSWIFT TRANSFER.exe, 00000000.00000003.248660470.00000000057B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown

                                        World Map of Contacted IPs

                                        • No. of IPs < 25%
                                        • 25% < No. of IPs < 50%
                                        • 50% < No. of IPs < 75%
                                        • 75% < No. of IPs

                                        Public IPs

                                        IPDomainCountryFlagASNASN NameMalicious
                                        185.162.171.75
                                        		activandalucia.comSpain
                                        		60458ASN-XTUDIONETEStrue

                                        General Information

                                        Joe Sandbox Version:35.0.0 Citrine
                                        Analysis ID:680490
                                        Start date and time: 08/08/202217:35:082022-08-08 17:35:08 +02:00
                                        Joe Sandbox Product:CloudBasic
                                        Overall analysis duration:0h 6m 59s
                                        Hypervisor based Inspection enabled:false
                                        Report type:light
                                        Sample file name:SWIFT TRANSFER.exe
                                        Cookbook file name:default.jbs
                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                        Number of analysed new started processes analysed:29
                                        Number of new started drivers analysed:0
                                        Number of existing processes analysed:0
                                        Number of existing drivers analysed:0
                                        Number of injected processes analysed:0
                                        Technologies:
                                        • HCA enabled
                                        • EGA enabled
                                        • HDC enabled
                                        • AMSI enabled
                                        Analysis Mode:default
                                        Analysis stop reason:Timeout
                                        Detection:MAL
                                        Classification:mal100.troj.adwa.spyw.evad.winEXE@4/6@2/1
                                        EGA Information:
                                        • Successful, ratio: 100%
                                        HDC Information:Failed
                                        HCA Information:
                                        • Successful, ratio: 100%
                                        • Number of executed functions: 0
                                        • Number of non-executed functions: 0
                                        Cookbook Comments:
                                        • Found application associated with file extension: .exe
                                        • Adjust boot time
                                        • Enable AMSI

                                        Warnings

                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
                                        • Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.189.173.21
                                        • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com
                                        • Not all processes where analyzed, report is missing behavior information
                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                        • VT rate limit hit for: SWIFT TRANSFER.exe

                                        Simulations

                                        Behavior and APIs

                                        TimeTypeDescription
                                        17:36:18API Interceptor126x Sleep call for process: SWIFT TRANSFER.exe modified
                                        17:36:49API Interceptor1x Sleep call for process: WerFault.exe modified

                                        Joe Sandbox View / Context

                                        IPs

                                        ⊘No context

                                        Domains

                                        ⊘No context

                                        ASNs

                                        ⊘No context

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        ⊘No context

                                        Created / dropped Files

                                        C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SWIFT TRANSFER.e_e02ad048c9bab2cfb5fa7c41a51938c2ea97c964_73dd571f_0481d645\Report.wer

                                        Download File
                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                        File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):65536
                                        Entropy (8bit):1.1717842007123833
                                        Encrypted:false
                                        SSDEEP:192:WD12vRB2dHBUZMX6aPXUAaEIr/u7smS274ItdAh:xvRBMBUZMX6apnIr/u7smX4ItdA
                                        MD5:9BBCEF06BC366DB22F394811ECC2E6D7
                                        SHA1:B3AFE3A62915A9E74FC9296F1A61E52749304B2F
                                        SHA-256:444FB5FC85085539A24AB252CB41EFF89D9E7C83044F10EF9E9AF3E23E771A5D
                                        SHA-512:3C530FF658B9A2F39F0596E6C0905E64F7C75E3F08A00EFEDEB2A39B815CB3EF13BF50D6155F4B95A6CB05B8B096EA9140AAE4F6ED93C37C4A567A75304B5888
                                        Malicious:false
                                        Reputation:low
                                        Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.4.4.7.9.0.0.2.9.5.9.6.6.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.0.4.4.7.9.0.0.7.8.6.5.9.0.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.3.4.6.c.3.e.-.9.0.5.0.-.4.7.c.c.-.9.e.e.f.-.c.9.2.1.5.5.b.6.0.7.d.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.a.6.6.d.c.1.6.-.5.9.1.c.-.4.a.7.6.-.8.a.8.1.-.9.f.7.5.8.6.2.b.8.5.7.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.W.I.F.T. .T.R.A.N.S.F.E.R...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.o.a.p.P.a.r.a.m.e.t.e.r.A.t.t.r.i.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.7.8.-.0.0.0.1.-.0.0.1.d.-.b.d.e.e.-.0.4.0.b.8.8.a.b.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.5.5.d.4.c.3.1.c.d.a.d.5.c.b.8.7.1.1.7.0.7.4.1.7.8.f.a.b.6.3.0.0.0.0.0.0.0.0.!.0.0.0.0.a.4.4.3.8.d.8.6.4.9.d.a.6.0.b.9.e.d.1.9.a.

                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDDB.tmp.dmp

                                        Download File
                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                        File Type:Mini DuMP crash report, 15 streams, Tue Aug 9 00:36:46 2022, 0x1205a4 type
                                        Category:dropped
                                        Size (bytes):331284
                                        Entropy (8bit):3.465530901495165
                                        Encrypted:false
                                        SSDEEP:3072:tTYDLKiKrjd+pmpXCguOy9gIOgF5+R0UUCgU0YGjYemWSM31oCRuX1d0/F:qKopKq9RpD+9Tj0pSGncFd0d
                                        MD5:F3D587948F8CAD181F73774BF2FA79A3
                                        SHA1:381A1CBD15ABB78F2CFBE480631B2D1CD86207CE
                                        SHA-256:E4F59323D84504378AD9A7F73E7B5496332C677436DF9C3E8ADED197902839BB
                                        SHA-512:476ED7D44792AA64251B4B29185E98BBDE9F71CADF559A5A7EB41C383160EA1E4E882804505C93275037C73E69111BD01791498894D2CE28084BC8F3A6FE4D69
                                        Malicious:false
                                        Reputation:low
                                        Preview:MDMP....... ..........b............4........... ...H.......$...h'.......*...d..........`.......8...........T........... @...............'..........x)...................................................................U...........B.......*......GenuineIntelW...........T.......x......b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE47.tmp.WERInternalMetadata.xml

                                        Download File
                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                        File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):6398
                                        Entropy (8bit):3.7184008918597233
                                        Encrypted:false
                                        SSDEEP:192:Rrl7r3GLNiYy6UkzeqYZWSGXqCprs89b3usfIj9m:RrlsNi16VYESGXL3tfj
                                        MD5:AF74ADB6BDF2F6E9969733D15DB19EE9
                                        SHA1:429BF764B6F5F4B2156758A737C3A87839D78479
                                        SHA-256:AB36802BCF813D147F98CCC027383FA39834F7879B6E3496447185263688B704
                                        SHA-512:5D621527F858D6E30319FCDB8AF8E70364C1D948AF35FA48E9245DA2F80921B5CF6EFF5E6F79F389A7A7A411E3897FBDD7A70331D63B2B5518CF5A8CE38C36C5
                                        Malicious:false
                                        Reputation:low
                                        Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.5.2.<./.P.i.d.>.......

                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF71.tmp.xml

                                        Download File
                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):4762
                                        Entropy (8bit):4.490459471843885
                                        Encrypted:false
                                        SSDEEP:48:cvIwSD8zsXJgtWI9YUhWgc8sqYjk8fm8M4JwLjJ2Fns+q8vALjJVR+ZOOotXd:uITf5HPgrsqYtJGKDoOoxd
                                        MD5:E6331D171E1B25BCEF4B236C7E4E37E2
                                        SHA1:8F416276567B3692F3D0873208F6C3952BE17EA4
                                        SHA-256:10F01086E08F58084EE6181CAB60B33DE1EF630CF5F3DB857066AAA6FC99CF28
                                        SHA-512:5A5EFB43B71B6F503554099831E3D77F6DD03CD11E66810FDA94566101E98673655608DB70F19C0AAE152EC38766FBE9647047C537250EB791F82E5962BD3C86
                                        Malicious:false
                                        Reputation:low
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1639307" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SWIFT TRANSFER.exe.log

                                        Download File
                                        Process:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):1308
                                        Entropy (8bit):5.345811588615766
                                        Encrypted:false
                                        SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
                                        MD5:2E016B886BDB8389D2DD0867BE55F87B
                                        SHA1:25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
                                        SHA-256:1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
                                        SHA-512:C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
                                        Malicious:true
                                        Reputation:high, very likely benign file
                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                        C:\Windows\System32\drivers\etc\hosts

                                        Download File
                                        Process:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:modified
                                        Size (bytes):835
                                        Entropy (8bit):4.694294591169137
                                        Encrypted:false
                                        SSDEEP:24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
                                        MD5:6EB47C1CF858E25486E42440074917F2
                                        SHA1:6A63F93A95E1AE831C393A97158C526A4FA0FAAE
                                        SHA-256:9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
                                        SHA-512:08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
                                        Malicious:true
                                        Reputation:high, very likely benign file
                                        Preview:# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Entropy (8bit):7.786674550423878
                                        TrID:
                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                        • Win32 Executable (generic) a (10002005/4) 49.78%
                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                        • DOS Executable Generic (2002/1) 0.01%
                                        File name:SWIFT TRANSFER.exe
                                        File size:834048
                                        MD5:735ee862055fcbcc574b73b1695af599
                                        SHA1:a4438d8649da60b9ed19aa5d98962dc1de1efa3a
                                        SHA256:b496205d5045c9c9f9407bfca6a4c9088218560c2884fd737c8efe76352ae3ca
                                        SHA512:30792e3468246e6145c37f9bc7502ad20e88912dcc82c3e608eb7ff3522f11ba14890abe2a33425b14d249352ec33a46f63e8d7602a88f3d1def215d89dcac36
                                        SSDEEP:24576:H96FxgV10gJ+em8LKYXFWYNe9IbUDHDl:2gVWgflnWYN7U
                                        TLSH:7B05BF5BAF147708C5A7AAB5EE0BBD72A7F61C1D3175D0783A64BC0A4AFF301D51202A
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..b..............0.................. ........@.. ....................... ............@................................

                                        File Icon

                                        Icon Hash:00828e8e8686b000

                                        Static PE Info

                                        General

                                        Entrypoint:0x4cd0fa
                                        Entrypoint Section:.text
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                        Time Stamp:0x62F0B226 [Mon Aug 8 06:50:14 2022 UTC]
                                        TLS Callbacks:
                                        CLR (.Net) Version:
                                        OS Version Major:4
                                        OS Version Minor:0
                                        File Version Major:4
                                        File Version Minor:0
                                        Subsystem Version Major:4
                                        Subsystem Version Minor:0
                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                        Entrypoint Preview

                                        Instruction
                                        jmp dword ptr [00402000h]
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xcd0a80x4f.text
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xce0000x3c0.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xd00000xc.reloc
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x20000xcb1000xcb200False0.8196189903846154data7.792812997909333IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .rsrc0xce0000x3c00x400False0.3837890625data3.001696674534704IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .reloc0xd00000xc0x200False0.044921875data0.09800417566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountry
                                        RT_VERSION0xce0580x364data

                                        Imports

                                        DLLImport
                                        mscoree.dll_CorExeMain

                                        Network Behavior

                                        Snort IDS Alerts

                                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                        192.168.2.3185.162.171.75497445872851779 08/08/22-17:36:37.122597TCP2851779ETPRO TROJAN Agent Tesla Telegram Exfil49744587192.168.2.3185.162.171.75
                                        192.168.2.3185.162.171.75497445872030171 08/08/22-17:36:37.122505TCP2030171ET TROJAN AgentTesla Exfil Via SMTP49744587192.168.2.3185.162.171.75
                                        192.168.2.3185.162.171.75497445872840032 08/08/22-17:36:37.122597TCP2840032ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M249744587192.168.2.3185.162.171.75

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Aug 8, 2022 17:36:36.486733913 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:36.532057047 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:36.532193899 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:36.733409882 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:36.733877897 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:36.779390097 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:36.781019926 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:36.826838017 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:36.827361107 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:36.911923885 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:36.917680025 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:36.973114014 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:37.018518925 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:37.018560886 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:37.023947954 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:37.075958967 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:37.076226950 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:37.121546030 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:37.121611118 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:37.122504950 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:37.122596979 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:37.123333931 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:37.123416901 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:37.167886972 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:37.168486118 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:37.206161976 CEST58749744185.162.171.75192.168.2.3
                                        Aug 8, 2022 17:36:37.343115091 CEST49744587192.168.2.3185.162.171.75
                                        Aug 8, 2022 17:36:50.403903961 CEST49744587192.168.2.3185.162.171.75

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Aug 8, 2022 17:36:36.304270029 CEST5641753192.168.2.38.8.8.8
                                        Aug 8, 2022 17:36:36.350898027 CEST53564178.8.8.8192.168.2.3
                                        Aug 8, 2022 17:36:36.407972097 CEST5592353192.168.2.38.8.8.8
                                        Aug 8, 2022 17:36:36.456037045 CEST53559238.8.8.8192.168.2.3

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                        Aug 8, 2022 17:36:36.304270029 CEST192.168.2.38.8.8.80xcb34Standard query (0)mail.activandalucia.comA (IP address)IN (0x0001)
                                        Aug 8, 2022 17:36:36.407972097 CEST192.168.2.38.8.8.80xecf6Standard query (0)mail.activandalucia.comA (IP address)IN (0x0001)

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                        Aug 8, 2022 17:36:36.350898027 CEST8.8.8.8192.168.2.30xcb34No error (0)mail.activandalucia.comactivandalucia.comCNAME (Canonical name)IN (0x0001)
                                        Aug 8, 2022 17:36:36.350898027 CEST8.8.8.8192.168.2.30xcb34No error (0)activandalucia.com185.162.171.75A (IP address)IN (0x0001)
                                        Aug 8, 2022 17:36:36.456037045 CEST8.8.8.8192.168.2.30xecf6No error (0)mail.activandalucia.comactivandalucia.comCNAME (Canonical name)IN (0x0001)
                                        Aug 8, 2022 17:36:36.456037045 CEST8.8.8.8192.168.2.30xecf6No error (0)activandalucia.com185.162.171.75A (IP address)IN (0x0001)

                                        SMTP Packets

                                        TimestampSource PortDest PortSource IPDest IPCommands
                                        Aug 8, 2022 17:36:36.733409882 CEST58749744185.162.171.75192.168.2.3220-cloudvip3.45st.com ESMTP Exim 4.95 #2 Mon, 08 Aug 2022 17:36:36 +0200
                                        220-We do not authorize the use of this system to transport unsolicited,
                                        220 and/or bulk e-mail.
                                        Aug 8, 2022 17:36:36.733877897 CEST49744587192.168.2.3185.162.171.75EHLO 376483
                                        Aug 8, 2022 17:36:36.779390097 CEST58749744185.162.171.75192.168.2.3250-cloudvip3.45st.com Hello 376483 [102.129.143.3]
                                        250-SIZE 52428800
                                        250-8BITMIME
                                        250-PIPELINING
                                        250-PIPE_CONNECT
                                        250-AUTH PLAIN LOGIN
                                        250-STARTTLS
                                        250 HELP
                                        Aug 8, 2022 17:36:36.781019926 CEST49744587192.168.2.3185.162.171.75AUTH login bWFya2V0aW5nOUBhY3RpdmFuZGFsdWNpYS5jb20=
                                        Aug 8, 2022 17:36:36.826838017 CEST58749744185.162.171.75192.168.2.3334 UGFzc3dvcmQ6
                                        Aug 8, 2022 17:36:36.917680025 CEST58749744185.162.171.75192.168.2.3235 Authentication succeeded
                                        Aug 8, 2022 17:36:36.973114014 CEST49744587192.168.2.3185.162.171.75MAIL FROM:<marketing9@activandalucia.com>
                                        Aug 8, 2022 17:36:37.018560886 CEST58749744185.162.171.75192.168.2.3250 OK
                                        Aug 8, 2022 17:36:37.023947954 CEST49744587192.168.2.3185.162.171.75RCPT TO:<sales9@activandalucia.com>
                                        Aug 8, 2022 17:36:37.075958967 CEST58749744185.162.171.75192.168.2.3250 Accepted
                                        Aug 8, 2022 17:36:37.076226950 CEST49744587192.168.2.3185.162.171.75DATA
                                        Aug 8, 2022 17:36:37.121611118 CEST58749744185.162.171.75192.168.2.3354 Enter message, ending with "." on a line by itself
                                        Aug 8, 2022 17:36:37.123416901 CEST49744587192.168.2.3185.162.171.75.
                                        Aug 8, 2022 17:36:37.206161976 CEST58749744185.162.171.75192.168.2.3250 OK id=1oL4o2-0006XH-2q

                                        Statistics

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:17:36:09
                                        Start date:08/08/2022
                                        Path:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\SWIFT TRANSFER.exe"
                                        Imagebase:0x4e0000
                                        File size:834048 bytes
                                        MD5 hash:735EE862055FCBCC574B73B1695AF599
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Yara matches:
                                        • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.271754334.0000000002B22000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.270173185.00000000028D3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000000.00000002.274677900.0000000003999000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                        Reputation:low

                                        General

                                        Target ID:4
                                        Start time:17:36:19
                                        Start date:08/08/2022
                                        Path:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Users\user\Desktop\SWIFT TRANSFER.exe
                                        Imagebase:0xae0000
                                        File size:834048 bytes
                                        MD5 hash:735EE862055FCBCC574B73B1695AF599
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Yara matches:
                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000004.00000000.266929046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000000.305229027.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        Reputation:low

                                        General

                                        Target ID:15
                                        Start time:17:36:41
                                        Start date:08/08/2022
                                        Path:C:\Windows\SysWOW64\WerFault.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1700
                                        Imagebase:0x800000
                                        File size:434592 bytes
                                        MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Reputation:high

                                        Disassembly

                                        ⊘No disassembly