Edit tour

Windows Analysis Report
Invoice.exe

Overview

General Information

Sample Name:	Invoice.exe
Analysis ID:	863303
MD5:	5ccc83a775f796de3dd319752d32a509
SHA1:	f564530c7f2e11f3320fac2a57e8abd33bd67126
SHA256:	8a6bebf08f6c223ed9821ee3b80e420060c66770402687f5c98555f9b0cd02a3
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Contains functionality to capture screen (.Net source)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Machine Learning detection for sample

.NET source code contains potential unpacker

Yara detected Generic Downloader

Sample has a suspicious name (potential lure to open the executable)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Detected potential crypto function

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Invoice.exe (PID: 7148 cmdline: C:\Users\user\Desktop\Invoice.exe MD5: 5CCC83A775F796DE3DD319752D32A509)

RegAsm.exe (PID: 2380 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.512262420.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.512262420.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3aa:$a1: get_encryptedPassword 0xd73f:$a2: get_encryptedUsername 0xd154:$a3: get_timePasswordChanged 0xd25a:$a4: get_passwordField 0xd3c0:$a5: set_encryptedPassword 0xef90:$a7: get_logins 0xec5e:$a8: GetOutlookPasswords 0xe9a6:$a9: StartKeylogger 0xeec7:$a10: KeyLoggerEventArgs 0xe9b5:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x105792:$a1: get_encryptedPassword 0x1197ae:$a1: get_encryptedPassword 0x1ef3f2:$a1: get_encryptedPassword 0x105b27:$a2: get_encryptedUsername 0x119b43:$a2: get_encryptedUsername 0x1ef787:$a2: get_encryptedUsername 0x10553c:$a3: get_timePasswordChanged 0x119558:$a3: get_timePasswordChanged 0x1ef19c:$a3: get_timePasswordChanged 0x105642:$a4: get_passwordField 0x11965e:$a4: get_passwordField 0x1ef2a2:$a4: get_passwordField 0x1057a8:$a5: set_encryptedPassword 0x1197c4:$a5: set_encryptedPassword 0x1ef408:$a5: set_encryptedPassword 0x107378:$a7: get_logins 0x11b394:$a7: get_logins 0x1f0fd8:$a7: get_logins 0x107046:$a8: GetOutlookPasswords 0x11b062:$a8: GetOutlookPasswords 0x1f0ca6:$a8: GetOutlookPasswords
Process Memory Space: Invoice.exe PID: 7148	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Invoice.exe PID: 7148	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22e6f:$a1: get_encryptedPassword 0x23198:$a2: get_encryptedUsername 0x22c2d:$a3: get_timePasswordChanged 0x22d33:$a4: get_passwordField 0x22e85:$a5: set_encryptedPassword 0x246a0:$a7: get_logins 0x243c5:$a8: GetOutlookPasswords 0x2416f:$a9: StartKeylogger 0x245d7:$a10: KeyLoggerEventArgs 0x2417e:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegAsm.exe PID: 2380	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 2380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2380	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x151b7:$a1: get_encryptedPassword 0x1553d:$a2: get_encryptedUsername 0x14f75:$a3: get_timePasswordChanged 0x1507b:$a4: get_passwordField 0x151cd:$a5: set_encryptedPassword 0x16d44:$a7: get_logins 0x16a12:$a8: GetOutlookPasswords 0x1675a:$a9: StartKeylogger 0x16c7b:$a10: KeyLoggerEventArgs 0x16769:$a11: KeyLoggerEventArgsEventHandler
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Invoice.exe.2f891e8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Invoice.exe.2f891e8.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xc4d4:$s1: UnHook 0xc4db:$s2: SetHook 0xc4e3:$s3: CallNextHook 0xc4f0:$s4: _hook
0.2.Invoice.exe.2f891e8.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb7aa:$a1: get_encryptedPassword 0xbb3f:$a2: get_encryptedUsername 0xb554:$a3: get_timePasswordChanged 0xb65a:$a4: get_passwordField 0xb7c0:$a5: set_encryptedPassword 0xd390:$a7: get_logins 0xd05e:$a8: GetOutlookPasswords 0xcda6:$a9: StartKeylogger 0xd2c7:$a10: KeyLoggerEventArgs 0xcdb5:$a11: KeyLoggerEventArgsEventHandler
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xe2d4:$s1: UnHook 0xe2db:$s2: SetHook 0xe2e3:$s3: CallNextHook 0xe2f0:$s4: _hook
1.2.RegAsm.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd5aa:$a1: get_encryptedPassword 0xd93f:$a2: get_encryptedUsername 0xd354:$a3: get_timePasswordChanged 0xd45a:$a4: get_passwordField 0xd5c0:$a5: set_encryptedPassword 0xf190:$a7: get_logins 0xee5e:$a8: GetOutlookPasswords 0xeba6:$a9: StartKeylogger 0xf0c7:$a10: KeyLoggerEventArgs 0xebb5:$a11: KeyLoggerEventArgsEventHandler
0.2.Invoice.exe.2f891e8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Invoice.exe.2f891e8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Invoice.exe.2f891e8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xe2d4:$s1: UnHook 0x222f0:$s1: UnHook 0xf7f34:$s1: UnHook 0xe2db:$s2: SetHook 0x222f7:$s2: SetHook 0xf7f3b:$s2: SetHook 0xe2e3:$s3: CallNextHook 0x222ff:$s3: CallNextHook 0xf7f43:$s3: CallNextHook 0xe2f0:$s4: _hook 0x2230c:$s4: _hook 0xf7f50:$s4: _hook
0.2.Invoice.exe.2f891e8.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd5aa:$a1: get_encryptedPassword 0x215c6:$a1: get_encryptedPassword 0xf720a:$a1: get_encryptedPassword 0xd93f:$a2: get_encryptedUsername 0x2195b:$a2: get_encryptedUsername 0xf759f:$a2: get_encryptedUsername 0xd354:$a3: get_timePasswordChanged 0x21370:$a3: get_timePasswordChanged 0xf6fb4:$a3: get_timePasswordChanged 0xd45a:$a4: get_passwordField 0x21476:$a4: get_passwordField 0xf70ba:$a4: get_passwordField 0xd5c0:$a5: set_encryptedPassword 0x215dc:$a5: set_encryptedPassword 0xf7220:$a5: set_encryptedPassword 0xf190:$a7: get_logins 0x231ac:$a7: get_logins 0xf8df0:$a7: get_logins 0xee5e:$a8: GetOutlookPasswords 0x22e7a:$a8: GetOutlookPasswords 0xf8abe:$a8: GetOutlookPasswords
0.2.Invoice.exe.2eabbb0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Invoice.exe.2eabbb0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Invoice.exe.2eabbb0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xeb90c:$s1: UnHook 0xff928:$s1: UnHook 0x1d556c:$s1: UnHook 0xeb913:$s2: SetHook 0xff92f:$s2: SetHook 0x1d5573:$s2: SetHook 0xeb91b:$s3: CallNextHook 0xff937:$s3: CallNextHook 0x1d557b:$s3: CallNextHook 0xeb928:$s4: _hook 0xff944:$s4: _hook 0x1d5588:$s4: _hook
0.2.Invoice.exe.2eabbb0.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xeabe2:$a1: get_encryptedPassword 0xfebfe:$a1: get_encryptedPassword 0x1d4842:$a1: get_encryptedPassword 0xeaf77:$a2: get_encryptedUsername 0xfef93:$a2: get_encryptedUsername 0x1d4bd7:$a2: get_encryptedUsername 0xea98c:$a3: get_timePasswordChanged 0xfe9a8:$a3: get_timePasswordChanged 0x1d45ec:$a3: get_timePasswordChanged 0xeaa92:$a4: get_passwordField 0xfeaae:$a4: get_passwordField 0x1d46f2:$a4: get_passwordField 0xeabf8:$a5: set_encryptedPassword 0xfec14:$a5: set_encryptedPassword 0x1d4858:$a5: set_encryptedPassword 0xec7c8:$a7: get_logins 0x1007e4:$a7: get_logins 0x1d6428:$a7: get_logins 0xec496:$a8: GetOutlookPasswords 0x1004b2:$a8: GetOutlookPasswords 0x1d60f6:$a8: GetOutlookPasswords
0.2.Invoice.exe.2ea857c.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Invoice.exe.2ea857c.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Invoice.exe.2ea857c.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xeef40:$s1: UnHook 0x102f5c:$s1: UnHook 0x1d8ba0:$s1: UnHook 0xeef47:$s2: SetHook 0x102f63:$s2: SetHook 0x1d8ba7:$s2: SetHook 0xeef4f:$s3: CallNextHook 0x102f6b:$s3: CallNextHook 0x1d8baf:$s3: CallNextHook 0xeef5c:$s4: _hook 0x102f78:$s4: _hook 0x1d8bbc:$s4: _hook
0.2.Invoice.exe.2ea857c.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xee216:$a1: get_encryptedPassword 0x102232:$a1: get_encryptedPassword 0x1d7e76:$a1: get_encryptedPassword 0xee5ab:$a2: get_encryptedUsername 0x1025c7:$a2: get_encryptedUsername 0x1d820b:$a2: get_encryptedUsername 0xedfc0:$a3: get_timePasswordChanged 0x101fdc:$a3: get_timePasswordChanged 0x1d7c20:$a3: get_timePasswordChanged 0xee0c6:$a4: get_passwordField 0x1020e2:$a4: get_passwordField 0x1d7d26:$a4: get_passwordField 0xee22c:$a5: set_encryptedPassword 0x102248:$a5: set_encryptedPassword 0x1d7e8c:$a5: set_encryptedPassword 0xefdfc:$a7: get_logins 0x103e18:$a7: get_logins 0x1d9a5c:$a7: get_logins 0xefaca:$a8: GetOutlookPasswords 0x103ae6:$a8: GetOutlookPasswords 0x1d972a:$a8: GetOutlookPasswords
Click to see the 14 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Invoice.exe	ReversingLabs: Detection: 21%
Source: Invoice.exe	Virustotal: Detection: 20%			Perma Link

Machine Learning detection for sample

Source: Invoice.exe

Joe Sandbox ML: detected

Source: Invoice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Invoice.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: F:\Desktop V500\important\CSharp-RunPE-master\RunPE\obj\Debug\SeaCyanPul.pdb source: Invoice.exe, 00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Invoice.exe, 00000000.00000002.259381177.00000000054E0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 03034610h	1_2_030341F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 03033825h	1_2_03032D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 03033EC9h	1_2_03033C08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0303E5E9h	1_2_0303E330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0303EE99h	1_2_0303EBE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_03032258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_03032A6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 03034610h	1_2_030341E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0303F2F1h	1_2_0303F038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_0303288B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0303FBA1h	1_2_0303F8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0303EA41h	1_2_0303E787
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 03034610h	1_2_0303453E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 0303F749h	1_2_0303F48F

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice.exe.2f891e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice.exe.2eabbb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Invoice.exe.2ea857c.0.raw.unpack, type: UNPACKEDPE

Source: Invoice.exe, 00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.512262420.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Invoice.exe	String found in binary or memory: http://edstarcoordinator.com/api.asmx/GetSystems
Source: Invoice.exe, 00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.512262420.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs

.Net Code: TakeScreenshot

Source: Invoice.exe, 00000000.00000002.256149307.00000000011DA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Invoice.exe.2f891e8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Invoice.exe.2f891e8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Invoice.exe.2f891e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Invoice.exe.2f891e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Invoice.exe.2eabbb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Invoice.exe.2eabbb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Invoice.exe.2ea857c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Invoice.exe.2ea857c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.512262420.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Invoice.exe PID: 7148, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegAsm.exe PID: 2380, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Invoice.exe

Sample has a suspicious name (potential lure to open the executable)

Source: Invoice.exe

Static file information: Suspicious name

Source: Invoice.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Invoice.exe.2f891e8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Invoice.exe.2f891e8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Invoice.exe.2f891e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Invoice.exe.2f891e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Invoice.exe.2eabbb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Invoice.exe.2eabbb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Invoice.exe.2ea857c.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Invoice.exe.2ea857c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.512262420.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Invoice.exe PID: 7148, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegAsm.exe PID: 2380, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\Invoice.exe	Code function: 0_2_013550D0	0_2_013550D0
Source: C:\Users\user\Desktop\Invoice.exe	Code function: 0_2_0135F9B0	0_2_0135F9B0
Source: C:\Users\user\Desktop\Invoice.exe	Code function: 0_2_0135E5E8	0_2_0135E5E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303B2A9	1_2_0303B2A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303A9C8	1_2_0303A9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_030366B8	1_2_030366B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_03032D38	1_2_03032D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_03033C08	1_2_03033C08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303E330	1_2_0303E330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303EBE0	1_2_0303EBE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303ABE8	1_2_0303ABE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_03032230	1_2_03032230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303A230	1_2_0303A230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303A240	1_2_0303A240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_03032258	1_2_03032258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303F038	1_2_0303F038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303F8E8	1_2_0303F8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303E787	1_2_0303E787
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0303F48F	1_2_0303F48F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_057E5260	1_2_057E5260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_057EE248	1_2_057EE248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_057E7F60	1_2_057E7F60

Source: Invoice.exe, 00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSeaCyanPul.dll" vs Invoice.exe
Source: Invoice.exe, 00000000.00000002.256900468.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKrakenStub.exe6 vs Invoice.exe
Source: Invoice.exe, 00000000.00000003.246609960.000000000124D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDataBasePracticalJob.dllJ vs Invoice.exe
Source: Invoice.exe, 00000000.00000002.259381177.00000000054E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSeaCyanPul.dll" vs Invoice.exe
Source: Invoice.exe, 00000000.00000002.259017463.0000000005420000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDataBasePracticalJob.dllJ vs Invoice.exe
Source: Invoice.exe, 00000000.00000000.245827312.0000000000ABE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRareCommodityHelper.exeH vs Invoice.exe
Source: Invoice.exe, 00000000.00000002.258459348.0000000003EC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDataBasePracticalJob.dllJ vs Invoice.exe
Source: Invoice.exe	Binary or memory string: OriginalFilenameRareCommodityHelper.exeH vs Invoice.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Source: Invoice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Invoice.exe	ReversingLabs: Detection: 21%
Source: Invoice.exe	Virustotal: Detection: 20%

Source: Invoice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Invoice.exe C:\Users\user\Desktop\Invoice.exe
Source: C:\Users\user\Desktop\Invoice.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Users\user\Desktop\Invoice.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior

Source: C:\Users\user\Desktop\Invoice.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Invoice.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/0

Source: Invoice.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Invoice.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: Invoice.exe, RareCommodityHelper/MainForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/KrakenDumpedList.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: C:\Users\user\Desktop\Invoice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Invoice.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: Invoice.exe, PathNode.cs

.Net Code: ANTR3ND0 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: initial sample

Static PE information: section name: .text entropy: 7.692787601373311

Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Invoice.exe TID: 2888

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Invoice.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Invoice.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0303A9C8 LdrInitializeThunk,

1_2_0303A9C8

Source: C:\Users\user\Desktop\Invoice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll')
Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/FFDecryptor.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\Invoice.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Jump to behavior

Source: C:\Users\user\Desktop\Invoice.exe	Queries volume information: C:\Users\user\Desktop\Invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Invoice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Windows Analysis Report
Invoice.exe