Edit tour

Windows Analysis Report
rPaymentAdvice-PDF.exe

Overview

General Information

Sample name:	rPaymentAdvice-PDF.exe
Analysis ID:	1455406
MD5:	cc74321fe70654e82ead4093093b0116
SHA1:	68e74f568066c31b0f2b2a2837b5ce072b0857af
SHA256:	8819d137ba69b96b3f3c28cca74603e86c4ecea2c821e5332452a51258176439
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rPaymentAdvice-PDF.exe (PID: 3620 cmdline: "C:\Users\user\Desktop\rPaymentAdvice-PDF.exe" MD5: CC74321FE70654E82EAD4093093B0116)

MSBuild.exe (PID: 4196 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 5048 cmdline: C:\Windows\system32\WerFault.exe -u -p 3620 -s 1152 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.motek.ro", "Username": "office@motek.ro", "Password": "[_QR4eY?2cHe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.3384403596.0000000002C59000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: MSBuild.exe PID: 4196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 4196	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334d9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3354b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335d5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33667:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336d1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33743:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337d9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33869:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334d9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3354b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335d5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33667:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336d1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33743:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337d9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33869:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316d9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3174b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317d5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31867:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318d1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31943:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319d9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a69:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316d9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3174b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317d5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31867:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318d1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31943:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319d9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a69:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334d9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3354b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335d5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33667:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336d1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33743:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337d9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33869:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 212.146.84.76, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 4196, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49715

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.motek.ro", "Username": "office@motek.ro", "Password": "[_QR4eY?2cHe"}

Multi AV Scanner detection for submitted file

Source: rPaymentAdvice-PDF.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620, type: MEMORYSTR

Source: rPaymentAdvice-PDF.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: indoC:\Windows\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbo source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: symbols\dll\System.pdb.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2187838193.0000024E6C387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbll source: rPaymentAdvice-PDF.exe, 00000000.00000002.2187838193.0000024E6C387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb?lN source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: assembly\GAC_MSC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Xml.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbjc' source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\rPaymentAdvice-PDF.PDBm source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb\ source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdbA source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdbp`Oq4 source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb@ source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp, WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb}#_ source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.pdbSystem.pdbpdbtem.pdbGAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb* source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\System.pdbc source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WERFFAD.tmp.dmp.6.dr

Source: global traffic

TCP traffic: 192.168.2.6:49715 -> 212.146.84.76:587

Source: global traffic

TCP traffic: 192.168.2.6:55813 -> 162.159.36.2:53

Source: Joe Sandbox View

ASN Name: GTSCEGTSCentralEuropeAntelGermanyCZ GTSCEGTSCentralEuropeAntelGermanyCZ

Source: global traffic

TCP traffic: 192.168.2.6:49715 -> 212.146.84.76:587

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.126.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.126.163
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.motek.ro

Source: MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.motek.ro
Source: MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://motek.ro
Source: MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3383297469.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3383297469.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3383297469.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3383297469.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp, rPaymentAdvice-PDF.exe, 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, SKTzxzsJw.cs	.Net Code: cOd8BoX
Source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack, SKTzxzsJw.cs	.Net Code: cOd8BoX

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: rPaymentAdvice-PDF.exe

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD34684908	0_2_00007FFD34684908
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD3468ADD0	0_2_00007FFD3468ADD0
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD346831F0	0_2_00007FFD346831F0
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD3468B9F2	0_2_00007FFD3468B9F2
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD3468DB4A	0_2_00007FFD3468DB4A
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD3468E308	0_2_00007FFD3468E308
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD34691709	0_2_00007FFD34691709
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD34687007	0_2_00007FFD34687007
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD34680E65	0_2_00007FFD34680E65
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD34680EFA	0_2_00007FFD34680EFA
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD3478026B	0_2_00007FFD3478026B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_02A94A98	3_2_02A94A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_02A99B40	3_2_02A99B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_02A93E80	3_2_02A93E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_02A9CDC0	3_2_02A9CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_02A941C8	3_2_02A941C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0576DD20	3_2_0576DD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0576BD28	3_2_0576BD28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_05769AF0	3_2_05769AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_05763F48	3_2_05763F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_05764FF8	3_2_05764FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_057656D8	3_2_057656D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_05760040	3_2_05760040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0576322B	3_2_0576322B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_05762AF8	3_2_05762AF8

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3620 -s 1152

Source: rPaymentAdvice-PDF.exe

Static PE information: No import functions for PE file found

Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5522c644-5386-4d0c-b3dc-cccb0f430efa.exe4 vs rPaymentAdvice-PDF.exe
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5522c644-5386-4d0c-b3dc-cccb0f430efa.exe4 vs rPaymentAdvice-PDF.exe
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUcorasewogitiwug: vs rPaymentAdvice-PDF.exe
Source: rPaymentAdvice-PDF.exe, 00000000.00000000.2131800063.0000024E6C202000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIluluxove: vs rPaymentAdvice-PDF.exe
Source: rPaymentAdvice-PDF.exe	Binary or memory string: OriginalFilenameIluluxove: vs rPaymentAdvice-PDF.exe

Source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: rPaymentAdvice-PDF.exe, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb}#_
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@4/5@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3620

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\1f16400a-6eae-41a4-9738-e694aecad83e

Jump to behavior

Source: rPaymentAdvice-PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rPaymentAdvice-PDF.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rPaymentAdvice-PDF.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

File read: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe "C:\Users\user\Desktop\rPaymentAdvice-PDF.exe"
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3620 -s 1152
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: rPaymentAdvice-PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rPaymentAdvice-PDF.exe

Static file information: File size 2613780 > 1048576

Source: rPaymentAdvice-PDF.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: rPaymentAdvice-PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: indoC:\Windows\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbo source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: symbols\dll\System.pdb.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2187838193.0000024E6C387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbll source: rPaymentAdvice-PDF.exe, 00000000.00000002.2187838193.0000024E6C387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb?lN source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: assembly\GAC_MSC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Xml.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbjc' source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\rPaymentAdvice-PDF.PDBm source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb\ source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdbA source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdbp`Oq4 source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb@ source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp, WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb}#_ source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA21000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: System.pdbSystem.pdbpdbtem.pdbGAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185081185.000000B9477A1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb* source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERFFAD.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\System.pdbc source: rPaymentAdvice-PDF.exe, 00000000.00000002.2189034686.0000024E6FA7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WERFFAD.tmp.dmp.6.dr

Source: rPaymentAdvice-PDF.exe

Static PE information: 0x864F4AF4 [Tue May 28 08:44:36 2041 UTC]

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD34686240 push edi; retn 5F4Ch	0_2_00007FFD346862D6
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD34683DEE push es; ret	0_2_00007FFD34683DEF
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD3478026B push esp; retf 4810h	0_2_00007FFD34780312
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Code function: 0_2_00007FFD34781798 push eax; ret	0_2_00007FFD34781799

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Memory allocated: 24E6C530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Memory allocated: 24E6DEC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4BE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2326			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 6138			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3260	Thread sleep count: 2326 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -99859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3260	Thread sleep count: 6138 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -99526s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -99296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -99137s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -99031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97810s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97481s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97374s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97263s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97152s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -97045s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96827s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96499s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -96062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -95953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -95843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -95734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -95625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -95515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -95406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5176	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99526	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99137	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97810	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97481	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97263	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97152	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97045	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: rPaymentAdvice-PDF.exe, 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: rPaymentAdvice-PDF.exe, --.cs	Reference to suspicious API methods: LoadLibrary(_3227_A9B7_31C8(_321F_3200_3211_3215_31D3._3218_31C4_31CA_31D5_31E5_A97D_31E8_3209))
Source: rPaymentAdvice-PDF.exe, --.cs	Reference to suspicious API methods: GetProcAddress(intPtr, _3227_A9B7_31C8(_321F_3200_3211_3215_31D3._3201_3207_31C3_A9B4))
Source: rPaymentAdvice-PDF.exe, --.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)array.Length, 64u, out _320B_3225_31E4_31C4_3223_A9B6_D7FF_3198)
Source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, zOS.cs	Reference to suspicious API methods: _120HqGy.OpenProcess(_2pIt.DuplicateHandle, bInheritHandle: true, (uint)iVE.ProcessID)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: A50008	Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe	Queries volume information: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rPaymentAdvice-PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3384403596.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4196, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4196, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e10c79158.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPaymentAdvice-PDF.exe.24e1035a758.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3384403596.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rPaymentAdvice-PDF.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4196, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Disable or Modify Tools	2 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Email Collection	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	1 Credentials in Registry	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rPaymentAdvice-PDF.exe	26%	ReversingLabs	Win64.Trojan.GenSteal

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://motek.ro	0%	Avira URL Cloud	safe
http://x1.c.lencr.org/0	0%	Avira URL Cloud	safe
http://x1.i.lencr.org/0	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	Avira URL Cloud	safe
http://mail.motek.ro	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
motek.ro	212.146.84.76	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
mail.motek.ro	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3383297469.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F7B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://account.dyn.com/	rPaymentAdvice-PDF.exe, 00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp, rPaymentAdvice-PDF.exe, 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.motek.ro	MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://motek.ro	MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3383297469.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F7B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/0	MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3383297469.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F7B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	MSBuild.exe, 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3383297469.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F4E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.3388722812.0000000005F7B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.146.84.76	motek.ro	Romania		5588	GTSCEGTSCentralEuropeAntelGermanyCZ	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1455406
Start date and time:	2024-06-11 19:46:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rPaymentAdvice-PDF.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@4/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 78% Number of executed functions: 58 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.113.110.67, 40.126.31.73, 40.126.31.67, 20.190.159.71, 20.190.159.23, 20.190.159.75, 20.190.159.2, 20.190.159.0, 20.190.159.4, 192.229.221.95, 104.208.16.94, 199.232.210.172, 184.28.90.27, 40.127.169.103, 52.165.164.15, 20.242.39.171
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, wns.notify.trafficmanager.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: rPaymentAdvice-PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
13:47:10	API Interceptor	42x Sleep call for process: MSBuild.exe modified
13:47:13	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	zb1.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://drive.google.com/file/d/1rUX5pF_yChUfocjQZEgSZVDbnTsCbsyI/view?usp=sharing_eil_m&ts=66679781	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://workspace.cftc.gov/cedc903c-09bb-4a95-bb76-9b133af0550f/?action=reply	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	199.232.210.172
	https://mcfp.felk.cvut.cz	Get hash	malicious	Phisher	Browse	199.232.210.172
	https://info.virtualhealth.com/e3t/Ctc/GB+113/cmmfD04/VWRD9T8N6WzjN8MJTHvTlRp-W842MfZ5g9NL_N6-TN-l3qgyTW7Y8-PT6lZ3mfW56Rjx787zhFxW4_YPND6r6flrW4BlJlg1DphdCVWC28Z4PpMbRW6GGMRN2bfpFdW7hSWPP6KFbcRW4PBy7c6n3dRqN7ztR5NtV-d9W1y6F6Z799h-lN1ZbvtmQ73TLW5ShFj48-W2NPW1L2f016vN6bSW45yp6K7Xp_V9W1fy0nl6xLNR_N5n9x3txmtWFN2nZ6w9QgWwJW1rlxcq4rmPQZW2D31f_3FjFXjN7D51x8lx574V_S2G96X3V3rW3xJHsh5zkBZjW6M_Gg24KcjVwW2wm07P9jh6znVyVtyJ6VBB3ZW80wlHc6H0YX2W1stJK56XtGc2f45z9Cx04	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://www.tlyrxy.skyliexhys.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://www.tlyrxy.skyliexhys.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://deyangming.angebotfilesoffer.top/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	199.232.210.172
	https://thetechglitch.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
fp2e7a.wpc.phicdn.net	https://34.75.2o2.lol/XZXlZcys3Y0lMeE9qTWRaYisvV2ozVCtKTk9jbmZUSEdiYTZpTS9BYmpHY1I5Q3lSanAxam16TnE1Ly8zaitNeWxyTzBVQWhCS1VjcExjT0xsb284a2FQR1RLMkF3NGpiOVVvVHp4R2h6M3NmOWRIQmlQdmY2clJOcm11TXM2TDNadXUrUGxmclIwVGpyc3ViVndCME9RWXltbDl4QkZiNDVqRUhuVzNpZCs1cmNhS0s2bVk1ZWY3K0VCTG5FQzByWWJBTU53TGVvSjV2MXFBMitJQmgtLUNmdVg1bG1UOGdhbzNBaTQtLU9YTW5YNHNaYnFhVDM5V3BKaGVUZWc9PQ==?cid=2059126474	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://drive.google.com/file/d/1rUX5pF_yChUfocjQZEgSZVDbnTsCbsyI/view?usp=sharing_eil_m&ts=66679781	Get hash	malicious	Unknown	Browse	192.229.221.95
	file.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	192.229.221.95
	https://workspace.cftc.gov/cedc903c-09bb-4a95-bb76-9b133af0550f/?action=reply	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://www.chanamais.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	192.229.221.95
	https://na2.docusign.net/Member/EmailStart.aspx?a=d9cc73d9-ae0f-4253-a792-b28e8e553025&acct=61cb9522-75f6-4286-9c9e-e0f21cfcb28c&er=7c01d5b5-65de-4226-821a-b71d7d0d5623&c=E,1,Js_dcjgNrYNrel1HuUzofphnyLHztW0huM_6dgU6JXOMHy6LrFNyRz9u0XbDVY5U7gRSOASLaSlWJc5pS8NIpp_k-HIIGeO2F0BtBCErZxdMks2Qmw,,&typo=1	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://mcfp.felk.cvut.cz	Get hash	malicious	Phisher	Browse	192.229.221.95
	https://info.virtualhealth.com/e3t/Ctc/GB+113/cmmfD04/VWRD9T8N6WzjN8MJTHvTlRp-W842MfZ5g9NL_N6-TN-l3qgyTW7Y8-PT6lZ3mfW56Rjx787zhFxW4_YPND6r6flrW4BlJlg1DphdCVWC28Z4PpMbRW6GGMRN2bfpFdW7hSWPP6KFbcRW4PBy7c6n3dRqN7ztR5NtV-d9W1y6F6Z799h-lN1ZbvtmQ73TLW5ShFj48-W2NPW1L2f016vN6bSW45yp6K7Xp_V9W1fy0nl6xLNR_N5n9x3txmtWFN2nZ6w9QgWwJW1rlxcq4rmPQZW2D31f_3FjFXjN7D51x8lx574V_S2G96X3V3rW3xJHsh5zkBZjW6M_Gg24KcjVwW2wm07P9jh6znVyVtyJ6VBB3ZW80wlHc6H0YX2W1stJK56XtGc2f45z9Cx04	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://rrohlo.ac-page.com/paymentconfirmation	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GTSCEGTSCentralEuropeAntelGermanyCZ	Ordine_nr.24061168372.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	pilnie wymagana wycena dlaprojektu suwalki (1).vbs	Get hash	malicious	GuLoader	Browse	109.205.90.147
	QSX0atAPpN.elf	Get hash	malicious	Mirai	Browse	91.120.152.19
	YfM6hAPQaS.elf	Get hash	malicious	Mirai	Browse	94.42.225.10
	9W8C6mXhAB.elf	Get hash	malicious	Mirai	Browse	94.42.250.26
	mpsl.elf	Get hash	malicious	Mirai	Browse	46.13.53.8
	SMLUVN#U00cd FORMUL#U00c1#U0158-pdf.pif.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	31.14.12.234
	5dzdxe7bVc.elf	Get hash	malicious	Mirai	Browse	194.213.46.247
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	td2RgV6HyP.exe	Get hash	malicious	SystemBC	Browse	188.240.2.189

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rPaymentAdvice-P_7067ea40173c6bca932f69650b72adac4cc52d8_897d0994_fa2abc5b-2323-451c-b16b-90c9e3ef8be0\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1634753436511065
Encrypted:	false
SSDEEP:	192:JCr0ofla1Oi0VeWpRaWz3S9l/gCZFv82zuiFFZ24lO8r:O0otaSVBpRa4ifE2zuiFFY4lO8r
MD5:	AA2997089778CAEEAF45A5A0C048CD82
SHA1:	417FDBC31B73AD59B98D6BD7AB46653140FEAB6D
SHA-256:	A4C5607BF4A8E60A61D3E24CD6F75C63776D009AB4DBA6358A87AA5A8AF27D69
SHA-512:	D175AEAFB53462AF13A22234B096A070DF9E84F530A380D522ED05565BF79926CB1C2B5F57B5D4DB378F5498F7FF50EBE921DBA42F4E1CC999C7957C12068515
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.2.6.0.1.6.2.9.8.2.9.4.6.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.2.6.0.1.6.3.0.5.1.6.9.7.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.2.a.b.c.5.b.-.2.3.2.3.-.4.5.1.c.-.b.1.6.b.-.9.0.c.9.e.3.e.f.8.b.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.5.3.1.b.f.8.b.-.3.5.b.f.-.4.e.c.a.-.9.4.4.9.-.6.8.b.8.2.2.a.4.7.4.c.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.P.a.y.m.e.n.t.A.d.v.i.c.e.-.P.D.F...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.I.l.u.l.u.x.o.v.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.2.4.-.0.0.0.1.-.0.0.1.5.-.f.1.a.a.-.0.1.6.1.2.7.b.c.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.0.8.9.a.1.2.b.8.4.4.0.8.5.b.7.2.c.7.c.2.3.2.1.8.a.7.0.e.a.d.6.0.0.0.0.0.0.0.0.!.0.0.0.0.6.8.e.7.4.f.5.6.8.0.6.6.c.3.1.b.0.f.2.b.2.a.2.8.3.7.b.5.c.e.0.7.2.b.0.8.5.7.a.f.!.r.P.a.y.m.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER183.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8912
Entropy (8bit):	3.711066349047004
Encrypted:	false
SSDEEP:	192:R6l7wVeJ91ZPwJ6Y2D97gogmfZIS0epr089bU4DfaR8m:R6lXJ/ZP26Yg7gogmffbUEfaf
MD5:	59A852A989183917C29247C244E8F0F2
SHA1:	015CCDB4F81E915B1E076FEB07953B75795A68A8
SHA-256:	0EAC9AFA8355701203BC37471F7AD229EDC961005DAD526FC0FC67F8A005484C
SHA-512:	98172C8FC3F1BA969E0364C90E748F51A976C0E24E88D9AB468FC2F97058E916C701250BC9A050E3C9358A93AC38AA0E47D0D809165599FEACE7DAC4047FACBB
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.6.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C2.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4857
Entropy (8bit):	4.524786232894984
Encrypted:	false
SSDEEP:	48:cvIwWl8zsjJg771I9FCWpW8VY85Ym8M4J6sE6FNTeTyq8v5sET5dhIBOd:uIjf9I7uD7VToJmyeTW71zIAd
MD5:	2E03A5ABEB34B02A176BF99BC6788267
SHA1:	B3B5B7B2DCB99F83BED61D32A8D2AA9DBF7DD59F
SHA-256:	7A7A38EFCAC650A4271A870FCB136A5D94A3319322AB3BEDF306FE9FA40E4C1D
SHA-512:	1AE1BA186ADE2FCCCC29186E5088D44547B236B542777A620A2DA9D6C10821229D2981AE3B2EE9B025F8215F4D7E55550367505A7BF3D1FCCDF08429F6AD74CF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="363409" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFAD.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Jun 11 17:47:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	482481
Entropy (8bit):	3.585596037280979
Encrypted:	false
SSDEEP:	6144:T8gYzePoqUH0W3QwXTw5zqkbhbkQN3o9mVFIK0/xng:BYjqUH0WQwXTib3Cg
MD5:	D5D8C8B60558EBCABBB2D7334A052133
SHA1:	A48BB031B595B41EC53EECF513663B8A9A140268
SHA-256:	D0ABA6D32D2A5B453121084F7C41E56AD4857767C44AB3730DAE9DF0D6248054
SHA-512:	5750AA48516B1E818159963E87A250ECCF92B531C9F5EA6F020E357935738405316820B2DA67DBD477CB1561E518C62CBA99998103FBC5A556AB579A69E84C39
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........hf............................4.......$.... ......."... ......TX..X...........l.......8...........T...........`-..Q/...........C...........E..............................................................................eJ......LF......Lw......................T.......$.....hf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4691333758830405
Encrypted:	false
SSDEEP:	6144:kzZfpi6ceLPx9skLmb0fLZWSP3aJG8nAgeiJRMMhA2zX4WABluuNFjDH5S:KZHtLZWOKnMM6bFpXj4
MD5:	7CA0E16B29C77E2DB0E87B5E32FE91A3
SHA1:	A7C1C47D8EB5F480DE6E403B2EC33380035D0FFA
SHA-256:	656283DD1E542EFA3726274374346E12F9A4A62AC2C38CC4B856711E68742020
SHA-512:	AE45B769DC53F96D9326AE0565BFEF091EEA5812ECBD3890928B51939947F5F93DE32E67DBBD624A97A202EF6CCD3512AF1810A4A2689389614065F57057CEF8
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..&b'...............................................................................................................................................................................................................................................................................................................................................+.1V........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.745052609995144
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	rPaymentAdvice-PDF.exe
File size:	2'613'780 bytes
MD5:	cc74321fe70654e82ead4093093b0116
SHA1:	68e74f568066c31b0f2b2a2837b5ce072b0857af
SHA256:	8819d137ba69b96b3f3c28cca74603e86c4ecea2c821e5332452a51258176439
SHA512:	e02dc05c21788129ee7509daf307b48632fb76d72ad0c01bd5bae78962a0e3c5b3e78052ca6db9a5f5d31d7b3e3ccbc77385a28a62b208385158a5852d897214
SSDEEP:	12288:KP6pSfs5iMrbVM48GaHeRlPKlBEM9JVmkGkJ+yXiR0kVOmPiBR6y:KSIfspZRaHUlCR9JVYci05m6BR6y
TLSH:	C2C51155B263AE4BFC9A4275D4E034F109FD6D2331FAA25FEF821CA691927FC02446B1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....JO..........."...0.]................ ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x864F4AF4 [Tue May 28 08:44:36 2041 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x9e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb1a0	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x925d	0x9400	80f737d13de9c0324f797a5829ca123a	False	0.5640836148648649	data	6.371425468205272	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x9e4	0xa00	de6ce812b86c1485eea247616e078f5d	False	0.31171875	data	4.127915122439665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0b8	0x3a0	data			0.4859913793103448
RT_VERSION	0xc458	0x3a0	data	English	United States	0.4870689655172414
RT_MANIFEST	0xc7f8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2024 19:47:05.364284039 CEST	49674	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:05.364284039 CEST	49673	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:05.692512989 CEST	49672	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:11.651597977 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:11.656829119 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:11.657011986 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:12.677642107 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:12.678028107 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:12.688040018 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:12.951570034 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:12.951874971 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:12.956803083 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.221443892 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.225975037 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:13.230818033 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.503258944 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.503304958 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.503340960 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.503376961 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.503391027 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:13.503443956 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:13.563231945 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:13.568075895 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.831501007 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:13.843555927 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:13.848407030 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:14.112457037 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:14.116955042 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:14.123064995 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:14.387032032 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:14.399949074 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:14.404999018 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:14.966567993 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:14.966928005 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:14.971720934 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:14.973642111 CEST	49673	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:14.973720074 CEST	49674	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:15.235213041 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:15.235557079 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:15.240367889 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:15.301764011 CEST	49672	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:15.633728981 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:15.633955002 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:15.638840914 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:15.901952028 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:15.902702093 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:15.902792931 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:15.902867079 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:15.902867079 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:15.907566071 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:15.907623053 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:15.907766104 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:15.907932997 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:16.205813885 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:47:16.254925966 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:47:25.995182037 CEST	49705	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:25.995559931 CEST	49724	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:25.995610952 CEST	443	49724	173.222.162.64	192.168.2.6
Jun 11, 2024 19:47:25.995846033 CEST	49724	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:25.995923042 CEST	49724	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:25.995939016 CEST	443	49724	173.222.162.64	192.168.2.6
Jun 11, 2024 19:47:26.000179052 CEST	443	49705	173.222.162.64	192.168.2.6
Jun 11, 2024 19:47:27.010385990 CEST	443	49724	173.222.162.64	192.168.2.6
Jun 11, 2024 19:47:27.010456085 CEST	49724	443	192.168.2.6	173.222.162.64
Jun 11, 2024 19:47:52.217619896 CEST	55813	53	192.168.2.6	162.159.36.2
Jun 11, 2024 19:47:52.223841906 CEST	53	55813	162.159.36.2	192.168.2.6
Jun 11, 2024 19:47:52.223947048 CEST	55813	53	192.168.2.6	162.159.36.2
Jun 11, 2024 19:47:52.223985910 CEST	55813	53	192.168.2.6	162.159.36.2
Jun 11, 2024 19:47:52.229672909 CEST	53	55813	162.159.36.2	192.168.2.6
Jun 11, 2024 19:47:52.865334988 CEST	53	55813	162.159.36.2	192.168.2.6
Jun 11, 2024 19:47:52.866178989 CEST	55813	53	192.168.2.6	162.159.36.2
Jun 11, 2024 19:47:52.871273041 CEST	53	55813	162.159.36.2	192.168.2.6
Jun 11, 2024 19:47:52.871339083 CEST	55813	53	192.168.2.6	162.159.36.2
Jun 11, 2024 19:48:45.146063089 CEST	49704	80	192.168.2.6	2.19.126.163
Jun 11, 2024 19:48:45.153090000 CEST	80	49704	2.19.126.163	192.168.2.6
Jun 11, 2024 19:48:45.153306961 CEST	49704	80	192.168.2.6	2.19.126.163
Jun 11, 2024 19:48:51.552035093 CEST	49715	587	192.168.2.6	212.146.84.76
Jun 11, 2024 19:48:51.557054996 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:48:51.820661068 CEST	587	49715	212.146.84.76	192.168.2.6
Jun 11, 2024 19:48:51.825716972 CEST	49715	587	192.168.2.6	212.146.84.76

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2024 19:47:11.533725977 CEST	65353	53	192.168.2.6	1.1.1.1
Jun 11, 2024 19:47:11.625935078 CEST	53	65353	1.1.1.1	192.168.2.6
Jun 11, 2024 19:47:52.216974974 CEST	53	52537	162.159.36.2	192.168.2.6
Jun 11, 2024 19:47:52.884290934 CEST	53	58303	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 11, 2024 19:47:11.533725977 CEST	192.168.2.6	1.1.1.1	0x6434	Standard query (0)	mail.motek.ro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 11, 2024 19:47:11.625935078 CEST	1.1.1.1	192.168.2.6	0x6434	No error (0)	mail.motek.ro	motek.ro		CNAME (Canonical name)	IN (0x0001)	false
Jun 11, 2024 19:47:11.625935078 CEST	1.1.1.1	192.168.2.6	0x6434	No error (0)	motek.ro		212.146.84.76	A (IP address)	IN (0x0001)	false
Jun 11, 2024 19:47:12.739255905 CEST	1.1.1.1	192.168.2.6	0x8d0a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 11, 2024 19:47:12.739255905 CEST	1.1.1.1	192.168.2.6	0x8d0a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jun 11, 2024 19:47:14.076679945 CEST	1.1.1.1	192.168.2.6	0x90a4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jun 11, 2024 19:47:14.076679945 CEST	1.1.1.1	192.168.2.6	0x90a4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 11, 2024 19:47:12.677642107 CEST	587	49715	212.146.84.76	192.168.2.6	220-server30.romania-webhosting.com ESMTP Exim 4.96.2 #2 Tue, 11 Jun 2024 20:47:11 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jun 11, 2024 19:47:12.678028107 CEST	49715	587	192.168.2.6	212.146.84.76	EHLO 284992
Jun 11, 2024 19:47:12.951570034 CEST	587	49715	212.146.84.76	192.168.2.6	250-server30.romania-webhosting.com Hello 284992 [173.254.250.91] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jun 11, 2024 19:47:12.951874971 CEST	49715	587	192.168.2.6	212.146.84.76	STARTTLS
Jun 11, 2024 19:47:13.221443892 CEST	587	49715	212.146.84.76	192.168.2.6	220 TLS go ahead

Target ID:	0
Start time:	13:47:07
Start date:	11/06/2024
Path:	C:\Users\user\Desktop\rPaymentAdvice-PDF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\rPaymentAdvice-PDF.exe"
Imagebase:	0x24e6c200000
File size:	2'613'780 bytes
MD5 hash:	CC74321FE70654E82EAD4093093B0116
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2185470097.0000024E00385000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2186188137.0000024E10C79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2186188137.0000024E1028F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:47:09
Start date:	11/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:	0x8e0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3384403596.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3382092463.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3384403596.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:47:09
Start date:	11/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3620 -s 1152
Imagebase:	0x7ff70f970000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD346831F0 Relevance: 10.2, Strings: 7, Instructions: 1422COMMON

Download Yara Rule

Strings

H:q4, xrefs: 00007FFD34684F1D
d, xrefs: 00007FFD34685384
(=q4, xrefs: 00007FFD34684D6F
H:q4, xrefs: 00007FFD34684D53
!q4, xrefs: 00007FFD34684CF9
H:q4, xrefs: 00007FFD34684DDB
9q4, xrefs: 00007FFD346853A3

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID: 9q4$(=q4$H:q4$H:q4$H:q4$d$!q4
API String ID: 0-3247378605
Opcode ID: 59552f41aef587fce8f33c37fe1b3225b8c3f7adb43bea3f445995099379a9b8
Instruction ID: 81fa2b0330180ffedae1f570e0b7902d9630b1d59a83649c3415cdcb67034732
Opcode Fuzzy Hash: 59552f41aef587fce8f33c37fe1b3225b8c3f7adb43bea3f445995099379a9b8
Instruction Fuzzy Hash: 8F923731B0CA594FE7E5DF2888A56F577E1FF96310B0441BAD58EC7293EE28AC428741

Function 00007FFD34687007 Relevance: 4.2, Strings: 3, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xjq4, xrefs: 00007FFD3468723E
H, xrefs: 00007FFD346870AA
fish, xrefs: 00007FFD34687060

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID: H$Xjq4$fish
API String ID: 0-916339006
Opcode ID: fd505f0604466a814f78024a6fd0e431da9f47d10fa02f68ac3099434e0e2607
Instruction ID: 513209848d46383dab05f47d3cb437a41ad0765548275b2a4215d4ab2461a1fb
Opcode Fuzzy Hash: fd505f0604466a814f78024a6fd0e431da9f47d10fa02f68ac3099434e0e2607
Instruction Fuzzy Hash: 52C1293171CB990FE799AB6898B51F577E1EF97211B04017EE58BC72D3DD1CA8029381

Function 00007FFD3478026B Relevance: 3.0, Strings: 1, Instructions: 1767COMMON

Download Yara Rule

Strings

A, xrefs: 00007FFD34780786

Memory Dump Source

Source File: 00000000.00000002.2190807386.00007FFD34780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34780000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 7b15e1a6c453b515279f330856cc800aa30ee891d9008702212c149d7443911f
Instruction ID: b9096f98931eec66f10dd1ff455928bd5309cc9773377b14523ca15e056689ec
Opcode Fuzzy Hash: 7b15e1a6c453b515279f330856cc800aa30ee891d9008702212c149d7443911f
Instruction Fuzzy Hash: 94C218B2A0D7C58FEB95DB2488A65A47BE0FF57301F1A05FAC189C7193D92C7806D781

Function 00007FFD3468B9F2 Relevance: 2.5, APIs: 1, Instructions: 1014
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7407640976a57028be84db39e0d8d3fccbd5d1feb4b5fc44242720a8f57c2bd0
Instruction ID: edb07380956e39188fdcd2295b9e8bd3d95cbb9c6718d7f87be1c18de4671805
Opcode Fuzzy Hash: 7407640976a57028be84db39e0d8d3fccbd5d1feb4b5fc44242720a8f57c2bd0
Instruction Fuzzy Hash: 0462F772A0D6A24FE756AFAC94F60F67BE0EF52318B0801BAE1DDCB093DD1D74468641

Function 00007FFD3468ADD0 Relevance: 2.2, Strings: 1, Instructions: 934
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#W_L, xrefs: 00007FFD346900CE

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID: #W_L
API String ID: 0-3094981593
Opcode ID: e3fdc5988b805013a54a636ad35626eb4109e5108b11e7f161289f126114d0dd
Instruction ID: 86bf133a663a451484813e103421e99c2a993ff5544b7ea6d37e629f6f67521c
Opcode Fuzzy Hash: e3fdc5988b805013a54a636ad35626eb4109e5108b11e7f161289f126114d0dd
Instruction Fuzzy Hash: 5B52A930B08A594FDBACDF28D4A56B977E1FF56301B1401BED58EC7292DE28EC429741

Function 00007FFD34684908 Relevance: 1.9, Strings: 1, Instructions: 689
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFD3468775F

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: ac9b89acdd60a74f601956a8ecc1027985f7429933bb4b4cae436509979f9d14
Instruction ID: a6a98e0ea4df5821a06daf0934c6b80277b8ef3217b2de503c1d6d5e74c84681
Opcode Fuzzy Hash: ac9b89acdd60a74f601956a8ecc1027985f7429933bb4b4cae436509979f9d14
Instruction Fuzzy Hash: FE125531B1CA690FE799DF2888E15B177E0EF42315B1442BAD59EC7197DE28F842C381

Function 00007FFD34691709 Relevance: 1.6, Instructions: 1575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482a9a817e5a2c5bc6fad11635d255fcf5c1d42712e875316be2781cc5247448
Instruction ID: 631f7128ce51015693bee02e4ed8fa3d52a3fe0f9833efb356b771863a043978
Opcode Fuzzy Hash: 482a9a817e5a2c5bc6fad11635d255fcf5c1d42712e875316be2781cc5247448
Instruction Fuzzy Hash: DFB2473061CB994FE359DF2884A04F577E1FF96301B1449BED58AC72A6DE38E846C781

Function 00007FFD3468DB4A Relevance: .7, Instructions: 738COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e648e735ce0172004b0ca0e4384c16795707401ef258baae2a3a15db3e547f
Instruction ID: f9a43f42a0d6284583b522845b6670309cec310d5e85f8fdfffc991fb2473ef9
Opcode Fuzzy Hash: 53e648e735ce0172004b0ca0e4384c16795707401ef258baae2a3a15db3e547f
Instruction Fuzzy Hash: 5F326A3270CA954FE389DF2884A11F577E2FF96300B1445BED58AC72A3DD2CA842D781

Function 00007FFD3468E308 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c7fb7e89197a456d31a9a060d171f23ef5817d83c2a4a1eb4e37fe67f48fd2
Instruction ID: 3d5d246bf57d17351282219f8a8dcefe14945cb4fc929e4a9bad1581ce61379e
Opcode Fuzzy Hash: 77c7fb7e89197a456d31a9a060d171f23ef5817d83c2a4a1eb4e37fe67f48fd2
Instruction Fuzzy Hash: 77F1693160CB564FE358CF28C4A51B977D2FF92301B14467ED5CAC72A5DE2CE8429782

Function 00007FFD34685C0A Relevance: 1.6, APIs: 1, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD34685CE1

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7ae960112caee9acd5c63b166b3771499fd2aa423377be46eb5c48b4bbcd2fb9
Instruction ID: b54700923594a61c4e213dac10ef88e56824cacaa47c666a1358cd84c1bf154c
Opcode Fuzzy Hash: 7ae960112caee9acd5c63b166b3771499fd2aa423377be46eb5c48b4bbcd2fb9
Instruction Fuzzy Hash: D841263090CB888FD719DFA898566E97FF1EF66321F0402AFD049D3192CB686856CB91

Function 00007FFD347810C9 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2190807386.00007FFD34780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34780000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d454a293bae40697248504df7bf566a5a2372ae7f3cdc2788af8faf16e7827
Instruction ID: 9101c8c0cfaa88ce1918fb9cdb43e0678e49525cfe5fb7cfae0f329430d0e9f1
Opcode Fuzzy Hash: 18d454a293bae40697248504df7bf566a5a2372ae7f3cdc2788af8faf16e7827
Instruction Fuzzy Hash: 49413E76A0DAC98FDB96DF14C8E65E87FA0FF56301B0501EAC08AC7593DA29B841D381

Function 00007FFD34780A04 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2190807386.00007FFD34780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34780000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d53de0bb73280b0af5815dcce0256cfe87b928a935f32107c018a478b5ab42f
Instruction ID: 677cc5005005f157d541fa9f8035b0e869e305de226a9c2619ffbf5ce9de92f0
Opcode Fuzzy Hash: 9d53de0bb73280b0af5815dcce0256cfe87b928a935f32107c018a478b5ab42f
Instruction Fuzzy Hash: 50E0E530A146288ADB64DA58DC81BD9B3B1EB89200F0041E5D54DA3252CA306A84CF42

Non-executed Functions

Function 00007FFD34680EFA Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

5M_^, xrefs: 00007FFD34680F01
6M_I, xrefs: 00007FFD34681104

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID: 5M_^$6M_I
API String ID: 0-2018393683
Opcode ID: 1e0c58f0a4d1072d32b96bf7ca2018481dee561a6b768df42c74963d4e2c1446
Instruction ID: 6f5bef077d9c943b7311e3001914931c8e1e161cf3716b4edc3344533b467749
Opcode Fuzzy Hash: 1e0c58f0a4d1072d32b96bf7ca2018481dee561a6b768df42c74963d4e2c1446
Instruction Fuzzy Hash: DD715B53F1D5A50AE7217BACB8650FABB94EF9233974803BBD1D8DB097AC1864468780

Function 00007FFD34680E65 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

6M_I, xrefs: 00007FFD34681104

Memory Dump Source

Source File: 00000000.00000002.2190301521.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34680000_rPaymentAdvice-PDF.jbxd

Similarity

API ID:
String ID: 6M_I
API String ID: 0-3194347101
Opcode ID: c38651cf03f64c414e6faa3a0f6599866b860a3d6de2465d0a201af289c00ddb
Instruction ID: 0d9e53968613dd77458be19849d84b5344f75ff449c3e15484d2f1a60c455fe7
Opcode Fuzzy Hash: c38651cf03f64c414e6faa3a0f6599866b860a3d6de2465d0a201af289c00ddb
Instruction Fuzzy Hash: D0A10B53B0D6A54BD7216BACB8650FABB64EF9233A70803FBD1C8DB093DD1864468791

Analysis Process: MSBuild.exePID: 4196, Parent PID: 3620COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 02A99B40 Relevance: 2.8, Instructions: 2811COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6750253b68ed2fb91eccd499235327b1b926090cc389f5b6b6dd5ecee54e3ec7
Instruction ID: a03d1deb7e6b1426e8f73c7e710dc8a855d7b5eea6f8702ac0bd8da8651ab586
Opcode Fuzzy Hash: 6750253b68ed2fb91eccd499235327b1b926090cc389f5b6b6dd5ecee54e3ec7
Instruction Fuzzy Hash: E253E931D10B1A8ADB51EF69C880599F7B1EF99300F11D79AE4587B121FF70AAD4CB81

Function 02A9CDC0 Relevance: 2.3, Instructions: 2303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a00e727b7eb5bcf778331ec854b188ae5a8b71179a670eb1c885caa1f13f197
Instruction ID: b40c10b3dd7ea8544cf2f7222aadd2dd3f585f140bf90224a7d8e6b9136f1c57
Opcode Fuzzy Hash: 7a00e727b7eb5bcf778331ec854b188ae5a8b71179a670eb1c885caa1f13f197
Instruction Fuzzy Hash: 59331D31D10B198EDB11EF69C8806ADF7B1FF99300F15C79AE459A7211EB70AAC5CB81

Function 02A93E80 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vm, xrefs: 02A940CB

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vm
API String ID: 0-21153899
Opcode ID: 8b54c661d646435be7bb87e2641b76b69b33b4ada735d56ccaa03feb1ebc10a6
Instruction ID: 70cda2dbde0bba70d0b05027b19ead39d3f8f99f2d7fb147a9eba95dcee66ee7
Opcode Fuzzy Hash: 8b54c661d646435be7bb87e2641b76b69b33b4ada735d56ccaa03feb1ebc10a6
Instruction Fuzzy Hash: D7913D70E00209DFDF14CFAAC9857DEBBF2AF88714F248129E415AB254EB749846CF91

Function 02A94A98 Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e6d5fa0fc6163fdda6059adc69def89280a22ca7d1944ade13550c3ff1788b
Instruction ID: e2e54f7a0f1b2801cbcfc609e582634688646f02b71e7ebafd24fcf81117db96
Opcode Fuzzy Hash: e0e6d5fa0fc6163fdda6059adc69def89280a22ca7d1944ade13550c3ff1788b
Instruction Fuzzy Hash: 30B14D74E003098FDF14CFAAC8817ADBBF2AF8C754F148129D819EB254EB749846CB91

Function 0576E298 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(8B55051A), ref: 0576E307

Memory Dump Source

Source File: 00000003.00000002.3388496793.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5760000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d36573e80309370cde40cc94f2da7b3d5ed49a640605afeaa430323637dd2d49
Instruction ID: eb4cf8d349f0579cf602ee8ea7b02d30e8d0e0c1dd6b481ca6bb7515e784eddb
Opcode Fuzzy Hash: d36573e80309370cde40cc94f2da7b3d5ed49a640605afeaa430323637dd2d49
Instruction Fuzzy Hash: 571100B1C0065A9FDB10CF9AD444BEEFBF5AB48320F24816AD818A7240D378A954CFA5

Function 0576E2A0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(8B55051A), ref: 0576E307

Memory Dump Source

Source File: 00000003.00000002.3388496793.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5760000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e8f416fe5175012373adf0f27ada91eeb13dfb785195f8d3b28747e27737334f
Instruction ID: 235eeb4ea2ef875965b7cd8e8c3342858e14507e1e7a8d19d3fff3ccd5f2ee7e
Opcode Fuzzy Hash: e8f416fe5175012373adf0f27ada91eeb13dfb785195f8d3b28747e27737334f
Instruction Fuzzy Hash: 611112B1C0065A9FDB10DF9AC844BDEFBF4EF48720F14812AD818A7240D378A954CFA5

Function 02A93E74 Relevance: 1.5, Strings: 1, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vm, xrefs: 02A940CB

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID: \Vm
API String ID: 0-21153899
Opcode ID: 90decd1b1586e9a9be6a84508074c84af9580a16045ce7e319161fac9bc65388
Instruction ID: 192d8d47580ff1d07ba0e9a1bfdc605e291c95baca25afc25d5f66742a38357e
Opcode Fuzzy Hash: 90decd1b1586e9a9be6a84508074c84af9580a16045ce7e319161fac9bc65388
Instruction Fuzzy Hash: CD913A70E00209DFDF10CFAAD9857DEBBF2AF48714F248129E415AB254EB749986CF91

Function 02A97908 Relevance: .6, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a7c0b5a5aeddb2e1bbe4cee1dd878315733138ee9d0e45fb9a0a66cec2306a
Instruction ID: 4e0af34b8078c14f93ab93c5ed72405c84790990a1ff741b8400809ee119959c
Opcode Fuzzy Hash: f7a7c0b5a5aeddb2e1bbe4cee1dd878315733138ee9d0e45fb9a0a66cec2306a
Instruction Fuzzy Hash: B31283317102068FDB25AB3CD98672876A2EFC9358B504929E105CF395CFB9DD87DB90

Function 02A996E0 Relevance: .4, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a29006f4e5e64b06e1576e9625bcf848fb4320b2febbeb37dc741be2d305ec0
Instruction ID: 3ae72dfef6cd6e359a1c38b7e9da28d313a645b94b8870ac3f1def39c86a777f
Opcode Fuzzy Hash: 1a29006f4e5e64b06e1576e9625bcf848fb4320b2febbeb37dc741be2d305ec0
Instruction Fuzzy Hash: CFC18A74B002069FDF14CF69D8807AEB7F6EF89310F24856AE909DB395DB35D8418B91

Function 02A99364 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94b22eb9b2d0d34216b8e04bf0044e87b6c1b746aeec5a4c52130b17211ae0d
Instruction ID: fbcebe6667c5122a3b7d138e7fbd7db5e50cab5e1431ad278bec2db7fdb437e7
Opcode Fuzzy Hash: a94b22eb9b2d0d34216b8e04bf0044e87b6c1b746aeec5a4c52130b17211ae0d
Instruction Fuzzy Hash: 61B15939B001059FDB15DBA9D984AAEBBF2EF88310F148469E906E7395DF35DC42CB50

Function 02A94A8C Relevance: .3, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97f9c82f6aea146bcaf64e90ef8a6bb5acec276d5eee66037b954dc66c23141
Instruction ID: 6594f3b17164aea9abff76f333fee454bfbe02cb09b6f95bce34bc420db2d433
Opcode Fuzzy Hash: b97f9c82f6aea146bcaf64e90ef8a6bb5acec276d5eee66037b954dc66c23141
Instruction Fuzzy Hash: 77A14A74E003198FDF10CFAAD88579DBBF1AF8C754F148129D819EB294EB749886CB91

Function 02A9068B Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976cdf669223778c1c0e2bfee51dd749381f461ed609de8847affac0f2d10509
Instruction ID: d7c42ae15e9d14b106d53a746332243f8dfab6a138560020dab2c9511dff7b23
Opcode Fuzzy Hash: 976cdf669223778c1c0e2bfee51dd749381f461ed609de8847affac0f2d10509
Instruction Fuzzy Hash: A751AD72D0C3569FDF11277B8C563A63BE0EB922E4F1640AAD181CB187EE55C886C7E1

Function 02A91108 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c8337dd15e72d1da8cc429122f9b3b8d200ebb33cf842a93ddfd1c564b7dcc
Instruction ID: 48386d73a1228245cb5824e9d17f27012c082f506591e514c9bbca16d7687781
Opcode Fuzzy Hash: 16c8337dd15e72d1da8cc429122f9b3b8d200ebb33cf842a93ddfd1c564b7dcc
Instruction Fuzzy Hash: 39516131645282CFDB0AFF2CFA909647FF6FB9630C71459A9D1144FB2ADA606A46CF40

Function 02A96EE3 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85fe5adae5a7899ee9db0fbe5f364ff445d9a70f39fe984bb370ec6778adedba
Instruction ID: 504a8d72332ce856f0206120fd1aa9be98dae584f2ea0ea44efbb6caec38d08d
Opcode Fuzzy Hash: 85fe5adae5a7899ee9db0fbe5f364ff445d9a70f39fe984bb370ec6778adedba
Instruction Fuzzy Hash: DD41AF30A102099FDF14DF6AC8917AEB7F6EF85700F10846AE406EB290EF759C42CB51

Function 02A96CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b02b821bb0f0c2ecd959aed41165b41ce50bb3b2daad7ef1f69f32aa94b5c6d
Instruction ID: 315450e07a950376272e7c42e03aed1e4fd2da1fecc574ef0c8306ada6cd3f51
Opcode Fuzzy Hash: 7b02b821bb0f0c2ecd959aed41165b41ce50bb3b2daad7ef1f69f32aa94b5c6d
Instruction Fuzzy Hash: 9551E271D006188FDF14CFAAC884BADBBF5BF48714F14852AE815AB351DB74A844CF95

Function 02A96CDF Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b042fb91d428d2c284dcf8a6de60deb397e82f87b12c27cca7d131816da814a
Instruction ID: 2a465b2ed4d74571a5fcef9dba62147a21319eec0a71ee1f15b01c468fb3c416
Opcode Fuzzy Hash: 0b042fb91d428d2c284dcf8a6de60deb397e82f87b12c27cca7d131816da814a
Instruction Fuzzy Hash: D351F075E006188FDF18CFAAD884BADBBF5BF48714F14812AE815AB351DB74A844CF94

Function 02A926DC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052bb6f7d6462f0483bb602d32490771059d972b60e59e75900cfe5e171c2b09
Instruction ID: bb3c3a9db1ec284fc6050a98a9b33b1f269b62dd6ce1ee556c904f67ab2fb3b9
Opcode Fuzzy Hash: 052bb6f7d6462f0483bb602d32490771059d972b60e59e75900cfe5e171c2b09
Instruction Fuzzy Hash: 7751F0719003499FEB14DFAAC884BDEBBF1EF48314F24842AE809AB250DB759945CF90

Function 02A9F2FD Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6676976fa5832026cd805fda4592b230d0da086f35bdd56f3b0fd0680242b69f
Instruction ID: 980af5fda80db2bb6fffdeaa9bd186069747c552a7698a3043d11fd8d7981743
Opcode Fuzzy Hash: 6676976fa5832026cd805fda4592b230d0da086f35bdd56f3b0fd0680242b69f
Instruction Fuzzy Hash: 2231AC30B002059FDF15AB75D99466F7BE2AF89644F2444A8D416DB389DF39CC42CB91

Function 02A91138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bcd0e38324b0f7945ea3082e10ad0f21f432147141fac5611e64eda74b8f473
Instruction ID: 76fac83189e2ac382008577d2f9fb21795be9138cf726d4fde0542832fc0f149
Opcode Fuzzy Hash: 1bcd0e38324b0f7945ea3082e10ad0f21f432147141fac5611e64eda74b8f473
Instruction Fuzzy Hash: 9A51FC30645242CFCB0AFF2CFA909657BF6F7953093149969D2144FB2ADA706A46CF80

Function 02A9F1C0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d16d7a8b6b565fa501a1fbfa30c2db7504909d63d4e18a8fa3233ebbd3b422
Instruction ID: 6b36c4e9306ab31ea904a973de0b4456f5b7bd12b6550031ebb0cc32c91d38ec
Opcode Fuzzy Hash: 79d16d7a8b6b565fa501a1fbfa30c2db7504909d63d4e18a8fa3233ebbd3b422
Instruction Fuzzy Hash: DD314A38E102059FDB15CFA9D99569EB7F2BF88300F108529E816E7784DF70AC82CB80

Function 02A96F78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8de1005b6b378cdf8962eb1bc632b36dcef11d49d4f009741399c9b6700f770
Instruction ID: dce518bb97c19a2876b35c63357c8f117117175adef1c85a70e6450fc0c8434e
Opcode Fuzzy Hash: c8de1005b6b378cdf8962eb1bc632b36dcef11d49d4f009741399c9b6700f770
Instruction Fuzzy Hash: 29315C71E102199BEF14CF66D89179EB7F6FF85700F108526E406EB280EF71A946CB50

Function 02A9F1D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0f079b365743fe414777526a1f8fb9164720e839fa0876df60ca8fa7e052c5
Instruction ID: 2e7814c49b08405de878b1bcf4e14aa0debaaaf673bdfc2942b0c91c2b2d7819
Opcode Fuzzy Hash: be0f079b365743fe414777526a1f8fb9164720e839fa0876df60ca8fa7e052c5
Instruction Fuzzy Hash: B7313A38A106099FDB15CFA9D99469EF7F2AF89300F108919E816E7744DF70A842CB90

Function 02A926E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3fe519951b47ee7ff029613fc281956799e816fc94709284dc650e0597d14b
Instruction ID: 5ddc9bd8d54e033418810071c494f4c14e831e12ab51ae01f7ea19dba89f8fac
Opcode Fuzzy Hash: 9f3fe519951b47ee7ff029613fc281956799e816fc94709284dc650e0597d14b
Instruction Fuzzy Hash: F241C0B0D00349EFEB14DFAAC884ADEBBF5FF48714F148429E809AB250DB759945CB90

Function 02A9081E Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a087b4898508e6d23133c1aa1fcb03f6d71bf1cf4c2dfeaa9a4603d6efb2d70
Instruction ID: fb8facbe7c46c283ee4d342d289f2eb7b8ef39fa68b418ac95ff540d58f806f9
Opcode Fuzzy Hash: 9a087b4898508e6d23133c1aa1fcb03f6d71bf1cf4c2dfeaa9a4603d6efb2d70
Instruction Fuzzy Hash: C021F831B10209DBEF54677B999177A32D4EB453A4F20CA2EE166CF685EF61C8818FC1

Function 02A99251 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b083cc0db1f298ef3cd94c7edf03728ce4334b437aec73c9a9d1c3a8ee8794
Instruction ID: 50bec80e2a522143204a827a041651b4d8206df9b6fff538713f3a73455b116e
Opcode Fuzzy Hash: b9b083cc0db1f298ef3cd94c7edf03728ce4334b437aec73c9a9d1c3a8ee8794
Instruction Fuzzy Hash: B4315C35E0024AABDF05CFA9D99079EF7B2BF89304F54865AE805AB340DB71D846CB80

Function 02A99260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba8774aaddcc6dea136151d1205cf572028b5c80fe0411490d00bc10606ad97
Instruction ID: d09dbed47b3611eb96b8f8f7acfa7ecb5ee4b869e92e443d9cf3a88b9d3fd8b0
Opcode Fuzzy Hash: aba8774aaddcc6dea136151d1205cf572028b5c80fe0411490d00bc10606ad97
Instruction Fuzzy Hash: 37214D35E0020AABDF15CFA5D99069FF7B2BF89304F10861AE805AB340DB71D846CB90

Function 02A99150 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e8e6905fbdb5237ad878f6f9610eb603edec11ad5573e2127b3f757bc5f0a0
Instruction ID: 10ade47050324b0be64e674127b68b63d434706fb2b2380651d26bd52e21f5e7
Opcode Fuzzy Hash: a3e8e6905fbdb5237ad878f6f9610eb603edec11ad5573e2127b3f757bc5f0a0
Instruction Fuzzy Hash: 58216235E00206ABDF19CF65D98469EF7F2BF89310F10862AE816F7341EB709946CB50

Function 02A916A3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e36d538f4f1875a81bc3f4b59441ef50b559c31f154a72e2304634a05c0fc1
Instruction ID: ef362bc12f373be0a614c76cfc2b0350a4f79bf7f9a86574161df6f7f7e59717
Opcode Fuzzy Hash: a9e36d538f4f1875a81bc3f4b59441ef50b559c31f154a72e2304634a05c0fc1
Instruction Fuzzy Hash: 202180386001039FEF11EB29E9C472A77E6E745318F104A29E11ECFB95EF29D8818F91

Function 029CD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3383717591.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71518b0b96e8c8619f4079cf720d154603a5e3dd9121648d182105e6a0773bc1
Instruction ID: dd011d5fcaa34671ba306776ca97c438d38bcd5d64f23d0cd4083c77aa7e1d3d
Opcode Fuzzy Hash: 71518b0b96e8c8619f4079cf720d154603a5e3dd9121648d182105e6a0773bc1
Instruction Fuzzy Hash: 4621C271504244EFDB14DF18D9C0B26BBA5EB84324F34C97DD94A4B296C37AD447CA72

Function 02A94F89 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972f4ff1c17ec700e48655a3baa200f40dddfdd88541886b6330ca17551f7b52
Instruction ID: 03869c1aa8872165c41bbf7dce9779b811133b06747e9c141d59cc4728061556
Opcode Fuzzy Hash: 972f4ff1c17ec700e48655a3baa200f40dddfdd88541886b6330ca17551f7b52
Instruction Fuzzy Hash: 5B213534B002058FCB14EB79C699BAD7BF1AF89304F5008A8E406EB3A0DB769D01CB91

Function 02A99160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4fc9ca197e9496106f6bfe4089f3e43ea584dfd2fda129356c538fe8f3578d
Instruction ID: 95988c3e3cf2c47dc68414d22264cc089d26bd0fb1a667dc100c6324b5d06b93
Opcode Fuzzy Hash: 9e4fc9ca197e9496106f6bfe4089f3e43ea584dfd2fda129356c538fe8f3578d
Instruction Fuzzy Hash: 40212F35E0020AABDF19CFA5D99469EF7F2BF89710F20851AE816BB340EB719945CB50

Function 02A91888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f70c7391efc5a17dbdb0e0d05b8fe13c8654c28e523272b0465db39186569d
Instruction ID: a77d9bc28b7eaf949fb7200fff1ccb5708f454ae9c3bd4c1b1d7994558043874
Opcode Fuzzy Hash: c4f70c7391efc5a17dbdb0e0d05b8fe13c8654c28e523272b0465db39186569d
Instruction Fuzzy Hash: 47213934B0021ACFEF14EB79C6547AE77F6AB89244F240468C50AEB394DF769D40CBA1

Function 02A91383 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b29452082f76494e5d9b4c1806c862d98df20e20b496b63269d1c1863848cb4
Instruction ID: bad770337ec18cb30a7664143733e6cd766f218d22deb14976e296717d9293c0
Opcode Fuzzy Hash: 2b29452082f76494e5d9b4c1806c862d98df20e20b496b63269d1c1863848cb4
Instruction Fuzzy Hash: 6021E1B46042029BEF716729E5D93293AE1EB86319F001879E40ECB7C1DF68C8C1C742

Function 02A916B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df47eb3c70217c52be8f42890610bcf4d2bbc58d0b3e41f362c1f3e0b71202cb
Instruction ID: d25039d333d6d0651578e56427a5ee7ed9f2ae324f9a3a0c646040d58e09b2e3
Opcode Fuzzy Hash: df47eb3c70217c52be8f42890610bcf4d2bbc58d0b3e41f362c1f3e0b71202cb
Instruction Fuzzy Hash: 15216D386001039FEF12EB29E9C476A77E6E745318F104A25E11ECFB59DF29D8818F91

Function 02A9187B Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc33642d055bf20d7e5ba0157ad4d877d537f24edd2e09fc36afbb25d9acc1f
Instruction ID: fbd390f956cde39341e66ad345d03f7d8c0a373aa4e1cb4b3326a9dc8e0459e8
Opcode Fuzzy Hash: afc33642d055bf20d7e5ba0157ad4d877d537f24edd2e09fc36afbb25d9acc1f
Instruction Fuzzy Hash: 14214A30B04256CFDF14EB79C6947AD37F2AB49208F240468C10AEB295DF368D40CB91

Function 02A94F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af761a3490390cba96b15c251c0032baa298340b05e8057452a52443539c7088
Instruction ID: 49df9deb125518914bf224d257dc749426441f38d5413d3152ca165028eb7e8c
Opcode Fuzzy Hash: af761a3490390cba96b15c251c0032baa298340b05e8057452a52443539c7088
Instruction Fuzzy Hash: A621F234A402058FDB14EB79C699BAD77F2AB89304F500868E40AEB3A4DF769D41CB91

Function 029CD006 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3383717591.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afa476867eef5cc5c30109d30591bcf8e096a85ffd9a80d366dd86752ee423e
Instruction ID: 306ffd1fd31f87963e6bb28f8fbd95cf1ca9cf93777348b67868d7a54df5b6c8
Opcode Fuzzy Hash: 8afa476867eef5cc5c30109d30591bcf8e096a85ffd9a80d366dd86752ee423e
Instruction Fuzzy Hash: 7D217A7550D3C08FDB07CB24C990715BF71AB46214F28C5EBD8898F6A3C33A984ACB62

Function 02A90848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7590cce0b32e1947d0856e204cb81e18614f2b9e27cec7344761f15707c85ab
Instruction ID: bf3ac91b5eff7ca040b80b91f2b641e6b4eaeca80ea57cb18d84487298c6043e
Opcode Fuzzy Hash: d7590cce0b32e1947d0856e204cb81e18614f2b9e27cec7344761f15707c85ab
Instruction Fuzzy Hash: 33115130B002098FEF54AB7BD99472936E5EB85394F208A3AE116CF785DF61CC818BC1

Function 02A917C3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308cbf12078a2533c705a2a51acf094fc5506abdb52dfd1990918dee7e55c9a4
Instruction ID: acc75cf2f3bf66f39748cfc1ea8d82b83bdeae92ace2ea9d8b703149ce3c0e30
Opcode Fuzzy Hash: 308cbf12078a2533c705a2a51acf094fc5506abdb52dfd1990918dee7e55c9a4
Instruction Fuzzy Hash: 5511C231F01212AFDF00AB7A9A046AF7BF9FB48660F104825E909D7380EF34C9418B80

Function 02A91488 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d112348ed5e030fe40f2cd62eafa59b1aa028e327acb51c79ddbbe5fc11da9d1
Instruction ID: 6313c86e17df96cdfd81ebe719d6296b6179a9e4ecc4cc0f0c641a5abacecb94
Opcode Fuzzy Hash: d112348ed5e030fe40f2cd62eafa59b1aa028e327acb51c79ddbbe5fc11da9d1
Instruction Fuzzy Hash: C7117075A012128FCF12EFB985903AD77F5AF49250B15447AD409EB301EF35D941CF91

Function 02A91498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac510b2cc480e0a9ed000571d4312cd09890adf3bfc08fd3c7d486724abe7d94
Instruction ID: 11d8054bcc5c3e41a158484a66c936aa7fa0182dc4f599a3365d74c74c2e597c
Opcode Fuzzy Hash: ac510b2cc480e0a9ed000571d4312cd09890adf3bfc08fd3c7d486724abe7d94
Instruction Fuzzy Hash: DE012D71A012169FCF25EFBA85902AE7BF6EF89250B15047AD40AE7300EF35D941CF95

Function 02A99890 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bf8a2730eaf57158752bdad89f88e91e9ced30b508301eca7f3d9a989e631b
Instruction ID: 0e3bf23a3f8e6a15b2505e47654f5f77f08f9dc867fac66f3e4d4e2dc07953c3
Opcode Fuzzy Hash: f3bf8a2730eaf57158752bdad89f88e91e9ced30b508301eca7f3d9a989e631b
Instruction Fuzzy Hash: 1011C431A002058FDB10DF65E88579ABBB6FF81310F54C229D9085B3AAEB749D46CBA0

Function 02A980F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a6f4068934eda0616aa4f4d4296d0d37659515d0f3b86be8cc24630894cfd3
Instruction ID: ec88a347360e90beb0fe9613eb317aa32ffde558a11b15d06e90036e08b3921a
Opcode Fuzzy Hash: f3a6f4068934eda0616aa4f4d4296d0d37659515d0f3b86be8cc24630894cfd3
Instruction Fuzzy Hash: 6D018F7450028A9EDB02EBA8EA5099D7BB1EF42308B4046E8C1555F696DF36AA46CB81

Function 02A97090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a3b7203121baf5e940d14f524c74e6c7b6cb5c97588ffec05a1a15c6d9eacf
Instruction ID: c68ed5eb6aae0a9022bc6ea6bbeade18307126ab64293cac4631f2781f8d96f5
Opcode Fuzzy Hash: e5a3b7203121baf5e940d14f524c74e6c7b6cb5c97588ffec05a1a15c6d9eacf
Instruction Fuzzy Hash: E2F0E735B10248CFD714EB64D5A9B6D77B2EF88715F5040A8E5069B3A0DF75AD42CF40

Function 02A98100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a65746917dc760a9271f7d48347b0d37aa2cbe4ebcdf3741983862e618050dd
Instruction ID: 5df2566a5648d13224b758a5a85328783555c54ff5de0d9b0664bcb5fd66af0f
Opcode Fuzzy Hash: 7a65746917dc760a9271f7d48347b0d37aa2cbe4ebcdf3741983862e618050dd
Instruction Fuzzy Hash: F1F03C3490010AEFDB01FBA8EA8199DBBF5EF81304F5046A9C1099B755EF31AE468B81

Function 02A96C0C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3384167243.0000000002A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5c84a876baccbe6d06550c11bddef624980fe578e409af2b2b55962569720c
Instruction ID: 9c61be26bc1ec7bb4c50cada12dbb1c99c0f5bd92ebe790c525c3b9f02f84b9e
Opcode Fuzzy Hash: 1a5c84a876baccbe6d06550c11bddef624980fe578e409af2b2b55962569720c
Instruction Fuzzy Hash: 86C0123A3480508F89019728E05447837B5DFC962931400D6D148CB321CE125802CB00

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rPaymentAdvice-PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rPaymentAdvice-P_7067ea40173c6bca932f69650b72adac4cc52d8_897d0994_fa2abc5b-2323-451c-b16b-90c9e3ef8be0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER183.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C2.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFAD.tmp.dmp

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Possible Origin

Windows Analysis Report
rPaymentAdvice-PDF.exe

Function 00007FFD34687007 Relevance: 4.2, Strings: 3, Instructions: 441
COMMON

Function 00007FFD3468B9F2 Relevance: 2.5, APIs: 1, Instructions: 1014
COMMON

Function 00007FFD3468ADD0 Relevance: 2.2, Strings: 1, Instructions: 934
COMMON

Function 00007FFD34684908 Relevance: 1.9, Strings: 1, Instructions: 689
COMMON

Function 00007FFD34685C0A Relevance: 1.6, APIs: 1, Instructions: 141
memoryCOMMON

Function 02A93E80 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Function 02A94A98 Relevance: .3, Instructions: 266
COMMON

Function 0576E298 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Function 0576E2A0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 02A93E74 Relevance: 1.5, Strings: 1, Instructions: 235
COMMON

Function 02A97908 Relevance: .6, Instructions: 551
COMMON

Function 02A996E0 Relevance: .4, Instructions: 357
COMMON

Function 02A94A8C Relevance: .3, Instructions: 261
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre