Edit tour

Windows Analysis Report
CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Overview

General Information

Sample Name:	CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe
Analysis ID:	831701
MD5:	8b00956371455a2cec3430013108263c
SHA1:	7e4c0599f6c94762172431f522ced9873b2f01f6
SHA256:	86e233cb75b893c9e4e0d26385155c4f575e4217f2d52cba592641c996bc9cc8
Tags:	exe
Infos:

Detection

Vector Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected zgRAT

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected Vector Stealer

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Machine Learning detection for sample

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe (PID: 5812 cmdline: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe MD5: 8B00956371455A2CEC3430013108263C)

CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe (PID: 2636 cmdline: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe MD5: 8B00956371455A2CEC3430013108263C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT		No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Vector Stealer

{"C2 url": "https://api.telegram.org/bot6060819824:AAG5pGuc1f_lNmdP8ekHh8QHPqsZRtRtPwo/sendMessage?chat_id=2078805713"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.261105633.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.259729927.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VectorStealer	Yara detected Vector Stealer	Joe Security
00000000.00000002.261250417.0000000004621000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe PID: 2636	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe PID: 2636	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe PID: 2636	JoeSecurity_VectorStealer	Yara detected Vector Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.400000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x298b1f:$s1: file:/// 0x298a2f:$s2: {11111-22222-10009-11112} 0x298aaf:$s3: {11111-22222-50001-00000} 0xc9d23:$s4: get_Module 0x198343:$s4: get_Module 0x2980b2:$s4: get_Module 0x441683:$s4: get_Module 0xc5217:$s5: Reverse 0x193837:$s5: Reverse 0x29833d:$s5: Reverse 0x43cb77:$s5: Reverse 0xc9432:$s6: BlockCopy 0x197a52:$s6: BlockCopy 0x296558:$s6: BlockCopy 0x440d92:$s6: BlockCopy 0xc93e1:$s7: ReadByte 0x197a01:$s7: ReadByte 0x440d41:$s7: ReadByte 0x298b31:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.4621e80.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.4621e80.8.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.4621e80.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x373f3f:$s1: file:/// 0x373e4f:$s2: {11111-22222-10009-11112} 0x373ecf:$s3: {11111-22222-50001-00000} 0x1a5143:$s4: get_Module 0x273763:$s4: get_Module 0x3734d2:$s4: get_Module 0x51caa3:$s4: get_Module 0x1a0637:$s5: Reverse 0x26ec57:$s5: Reverse 0x37375d:$s5: Reverse 0x517f97:$s5: Reverse 0x1a4852:$s6: BlockCopy 0x272e72:$s6: BlockCopy 0x371978:$s6: BlockCopy 0x51c1b2:$s6: BlockCopy 0x1a4801:$s7: ReadByte 0x272e21:$s7: ReadByte 0x51c161:$s7: ReadByte 0x373f51:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 3 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	ReversingLabs: Detection: 59%
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Virustotal: Detection: 71%			Perma Link

Machine Learning detection for sample

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Joe Sandbox ML: detected

Source: 1.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.400000.0.unpack

Avira: Label: TR/Dropper.Gen

Source: 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Vector Stealer {"C2 url": "https://api.telegram.org/bot6060819824:AAG5pGuc1f_lNmdP8ekHh8QHPqsZRtRtPwo/sendMessage?chat_id=2078805713"}

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02E505E7
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02FA7A82
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02FA3BD8
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02FA0040
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02FA3BCA
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02FA0006
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then jmp 02FA127Bh	1_2_02FA0F38
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then jmp 02FA127Bh	1_2_02FA0F28
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02FAB4C0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02FAB4B2
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	1_2_02FA44B1

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://api.telegram.org/bot6060819824:AAG5pGuc1f_lNmdP8ekHh8QHPqsZRtRtPwo/sendMessage?chat_id=2078805713

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip6
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip6SOFTWARE
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vectorstealer.com

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000000.00000002.257821594.000000000138B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.4621e80.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.4621e80.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 0_2_015BC01C	0_2_015BC01C
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 0_2_015BEC78	0_2_015BEC78
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 0_2_015BEC68	0_2_015BEC68
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E513C0	1_2_02E513C0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E547F0	1_2_02E547F0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E50B38	1_2_02E50B38
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E53EE0	1_2_02E53EE0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E5CEB8	1_2_02E5CEB8
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E513B0	1_2_02E513B0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E5B6F0	1_2_02E5B6F0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E50B28	1_2_02E50B28
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E53EF0	1_2_02E53EF0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E5DED8	1_2_02E5DED8
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E5AFE0	1_2_02E5AFE0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E5AFD0	1_2_02E5AFD0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA9228	1_2_02FA9228
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA1430	1_2_02FA1430
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA5530	1_2_02FA5530
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA9218	1_2_02FA9218
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FAB0F0	1_2_02FAB0F0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FAB0E0	1_2_02FAB0E0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA89B8	1_2_02FA89B8
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA89B6	1_2_02FA89B6
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA2178	1_2_02FA2178
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA2167	1_2_02FA2167
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA1421	1_2_02FA1421
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA8DF0	1_2_02FA8DF0
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02FA25C0	1_2_02FA25C0

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000000.00000000.250467987.0000000000AF2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUZv.exe6 vs CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000000.00000002.257821594.000000000138B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000000.00000002.258712247.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCruiser.dll, vs CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000000.00000002.258712247.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe* vs CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000000.00000002.270395762.00000000063B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOutimurs.dll2 vs CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Binary or memory string: OriginalFilenameUZv.exe6 vs CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	ReversingLabs: Detection: 59%
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Virustotal: Detection: 71%

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

File read: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe:Zone.Identifier

Jump to behavior

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process created: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process created: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Jump to behavior

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/1@0/0

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static file information: File size 1729024 > 1048576

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1a5800

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 1.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.4621e80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.261105633.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.259729927.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.261250417.0000000004621000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe PID: 2636, type: MEMORYSTR

.NET source code contains potential unpacker

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, LogicGames/Menus/MainMenu.cs	.Net Code: InitializeComponent System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.af0000.0.unpack, LogicGames/Menus/MainMenu.cs	.Net Code: InitializeComponent System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E577FD pushad ; ret		1_2_02E57801
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Code function: 1_2_02E5780B pushfd ; ret		1_2_02E57811

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Static PE information: 0xC4266EA6 [Fri Apr 13 13:50:30 2074 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.772614775846585

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME"SELECT * FROM WIN32_COMPUTERSYSTEM

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe TID: 2620	Thread sleep time: -40023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe TID: 2228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe TID: 4704	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Thread delayed: delay time: 40023	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qemu-ga!SELECT * FROM Win32_PortConnector!Win32_NetworkAdapterConfiguration
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\VMware2C:\Program Files\oracle\virtualbox guest additions
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\VMware
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxMouse.sys
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxGuest.sys
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxSF.sys
Source: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe, 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmmouse.sys

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Process created: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Jump to behavior

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Queries volume information: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe	Queries volume information: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected zgRAT

Source: Yara match	File source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.46fd2a0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe.4621e80.8.raw.unpack, type: UNPACKEDPE

Yara detected Telegram RAT

Source: Yara match	File source: 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe PID: 2636, type: MEMORYSTR

Yara detected Vector Stealer

Source: Yara match	File source: 00000001.00000002.261105633.000000000306D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe PID: 2636, type: MEMORYSTR

Remote Access Functionality

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vector Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vector Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Windows Analysis Report
CTM_ARRANGEMENT_BREAKDOWN_DENOMINATION_-_MV_NEPTUNE_pdf.exe