Windows Analysis Report
Receipt.exe

Overview

General Information

Sample Name: Receipt.exe
Analysis ID: 714970
MD5: 59082912cb9d1d4ece0567b1354d0f34
SHA1: a3c3e88b6c905eaee872bb21916c792a3ec1d7e7
SHA256: 7ef24f6499dd9fc7809783a98febc44c2dc25a3f74d02c9bf8ddbae0d3b781c6
Tags: exeNanoCoreRAT
Infos:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Detected Nanocore Rat
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Yara detected Nanocore RAT
Snort IDS alert for network traffic
Initial sample is a PE file and has a suspicious name
Yara detected Costura Assembly Loader
Encrypted powershell cmdline option found
Machine Learning detection for sample
Machine Learning detection for dropped file
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
PE file contains executable resources (Code or Archives)
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Receipt.exe ReversingLabs: Detection: 35%
Antivirus / Scanner detection for submitted sample
Source: Receipt.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Avira: detection malicious, Label: HEUR/AGEN.1252994
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe ReversingLabs: Detection: 35%
Yara detected Nanocore RAT
Source: Yara match File source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR
Machine Learning detection for sample
Source: Receipt.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Receipt.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Receipt.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256w^ source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49697 -> 103.141.138.125:24980
Source: Traffic Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.5:49697 -> 103.141.138.125:24980
Source: Traffic Snort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 103.141.138.125:24980 -> 192.168.2.5:49697
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0K
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/json
Source: Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

E-Banking Fraud
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Receipt.exe
Uses 32bit PE files
Source: Receipt.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Detected potential crypto function
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_018111B0 0_2_018111B0
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01815BD1 0_2_01815BD1
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BF7120 0_2_01BF7120
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BF33A8 0_2_01BF33A8
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BF8CB8 0_2_01BF8CB8
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BF3043 0_2_01BF3043
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BF2E90 0_2_01BF2E90
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_01621127 7_2_01621127
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_01623000 7_2_01623000
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_01625BE0 7_2_01625BE0
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_01625BD1 7_2_01625BD1
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_018891D8 7_2_018891D8
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_018833A8 7_2_018833A8
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_01882FEF 7_2_01882FEF
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_032E9E00 7_2_032E9E00
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_0590D5D0 7_2_0590D5D0
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_05900CF0 7_2_05900CF0
PE file contains executable resources (Code or Archives)
Source: Receipt.exe Static PE information: Resource name: RT_VERSION type: ARC archive data, packed
Source: Jzqbsob.exe.0.dr Static PE information: Resource name: RT_VERSION type: ARC archive data, packed
Sample file is different than original file name gathered from version info
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQnwarliipjooijoxqlleev.dll" vs Receipt.exe
Source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs Receipt.exe
Source: Receipt.exe, 00000000.00000002.530701855.0000000005891000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamethats.exe" vs Receipt.exe
Source: Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs Receipt.exe
Source: Receipt.exe, 00000000.00000002.559896437.0000000005D91000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamethats.exe" vs Receipt.exe
Source: Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs Receipt.exe
Source: Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs Receipt.exe
Source: Receipt.exe, 00000000.00000002.461260742.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamethats.exe" vs Receipt.exe
Source: Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs Receipt.exe
Source: Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs Receipt.exe
Source: Receipt.exe, 00000007.00000000.457523111.0000000000702000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenamethats.exe" vs Receipt.exe
Source: Receipt.exe, 00000007.00000003.470098072.000000000488E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUwtpxswhphuvnrulrb.dll" vs Receipt.exe
Source: Receipt.exe ReversingLabs: Detection: 35%
Source: C:\Users\user\Desktop\Receipt.exe File read: C:\Users\user\Desktop\Receipt.exe Jump to behavior
Source: Receipt.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Receipt.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe "C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe "C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe"
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA== Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe File created: C:\Users\user\AppData\Roaming\Bouqi Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_twhdr2os.ade.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@12/7@0/0
Source: C:\Users\user\Desktop\Receipt.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: Receipt.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Receipt.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_01
Source: C:\Users\user\Desktop\Receipt.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Receipt.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: Receipt.exe Static file information: File size 4574208 > 1048576
Source: Receipt.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Receipt.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x44fc00
Source: Receipt.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256w^ source: Receipt.exe, 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.467694143.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000000.00000002.588758977.0000000006D50000.00000004.08000000.00040000.00000000.sdmp, Receipt.exe, 00000000.00000002.487184452.0000000004AB6000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.632548236.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Receipt.exe, 00000007.00000002.601437093.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000008.00000002.621710984.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, Jzqbsob.exe, 00000009.00000002.619058249.00000000032D3000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected Costura Assembly Loader
Source: Yara match File source: 0.2.Receipt.exe.6b00000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Receipt.exe.5010e10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Receipt.exe.5010e10.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Receipt.exe.5770000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Receipt.exe.6b00000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.Receipt.exe.5bd1038.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Receipt.exe.4c90db0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.Receipt.exe.5bd1038.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Receipt.exe.4c50d90.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Receipt.exe.5770000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.3.Receipt.exe.4c30d70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.599774933.000000000360C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.618961337.000000000394C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.447622011.0000000005FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.578345911.0000000006B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.596522547.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.444317098.00000000059D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.614181534.000000000322B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.466500426.00000000036FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.599218252.0000000003355000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.491615975.0000000005010000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.461260742.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.635737864.0000000005770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000003.470098072.000000000488E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Receipt.exe PID: 4740, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jzqbsob.exe PID: 676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Jzqbsob.exe PID: 2892, type: MEMORYSTR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BFE0E0 push 0000003Bh; ret 0_2_01BFE0E2
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BFE0D2 push 0000003Bh; ret 0_2_01BFE0D4
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BFD2D5 push FFFFFF8Bh; retf 0_2_01BFD2DF
Source: C:\Users\user\Desktop\Receipt.exe Code function: 0_2_01BFDFA8 push 0000003Bh; ret 0_2_01BFDFAA
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_05909C4A pushfd ; retf 7_2_05909C51
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_05900FB0 push ss; ret 7_2_05900FE9
Source: C:\Users\user\Desktop\Receipt.exe Code function: 7_2_05900F58 push ss; ret 7_2_05900FE9
Drops PE files
Source: C:\Users\user\Desktop\Receipt.exe File created: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Jump to dropped file
Source: C:\Users\user\Desktop\Receipt.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Jzqbsob Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Jzqbsob Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: download (102).png
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Receipt.exe TID: 5036 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 260 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 160 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Receipt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8239 Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Receipt.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Encrypted powershell cmdline option found
Source: C:\Users\user\Desktop\Receipt.exe Process created: Base64 decoded Start-Sleep -Seconds 50
Source: C:\Users\user\Desktop\Receipt.exe Process created: Base64 decoded Start-Sleep -Seconds 50 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA== Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Process created: C:\Users\user\Desktop\Receipt.exe C:\Users\user\Desktop\Receipt.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Users\user\Desktop\Receipt.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Users\user\Desktop\Receipt.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bouqi\Jzqbsob.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Receipt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR

Remote Access Functionality
barindex
Detected Nanocore Rat
Source: Receipt.exe, 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Receipt.exe, 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Yara detected Nanocore RAT
Source: Yara match File source: 00000007.00000002.634818451.0000000004556000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.633515113.00000000044DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Receipt.exe PID: 3492, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 714970 Sample: Receipt.exe Startdate: 03/10/2022 Architecture: WINDOWS Score: 100 31 Snort IDS alert for network traffic 2->31 33 Malicious sample detected (through community Yara rule) 2->33 35 Antivirus / Scanner detection for submitted sample 2->35 37 7 other signatures 2->37 7 Receipt.exe 1 5 2->7         started        11 Jzqbsob.exe 2->11         started        13 Jzqbsob.exe 2->13         started        process3 file4 25 C:\Users\user\AppData\Roaming\...\Jzqbsob.exe, PE32 7->25 dropped 27 C:\Users\user\...\Jzqbsob.exe:Zone.Identifier, ASCII 7->27 dropped 29 C:\Users\user\AppData\...\Receipt.exe.log, ASCII 7->29 dropped 39 Encrypted powershell cmdline option found 7->39 15 powershell.exe 16 7->15         started        17 Receipt.exe 7->17         started        19 Receipt.exe 7->19         started        21 Receipt.exe 7->21         started        41 Antivirus detection for dropped file 11->41 43 Multi AV Scanner detection for dropped file 11->43 45 Machine Learning detection for dropped file 11->45 signatures5 process6 process7 23 conhost.exe 15->23         started       
⊘No contacted IP infos