Edit tour

Windows Analysis Report
Remittance Receipt.exe

Overview

General Information

Sample name:	Remittance Receipt.exe
Analysis ID:	1543469
MD5:	db9a323fde82eac0d972eec0acde0209
SHA1:	88ead16576193df0d647c722d70b79f50300e852
SHA256:	e93171125e897ba3a556f1b0171629d2a9aaa3298510f97b5d7cda44b9c3c313
Tags:	AgentTeslaexeuser-susugenjot
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Remittance Receipt.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\Remittance Receipt.exe" MD5: DB9A323FDE82EAC0D972EEC0ACDE0209)

powershell.exe (PID: 7460 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Remittance Receipt.exe (PID: 7468 cmdline: "C:\Users\user\Desktop\Remittance Receipt.exe" MD5: DB9A323FDE82EAC0D972EEC0ACDE0209)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.privateemail.com", "Username": "info@bondamit.shop", "Password": "payment1759"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2939186420.0000000002971000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2939186420.0000000002971000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Remittance Receipt.exe PID: 7252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Remittance Receipt.exe PID: 7252	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Remittance Receipt.exe PID: 7252	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Remittance Receipt.exe PID: 7468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Remittance Receipt.exe PID: 7468	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.Remittance Receipt.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.Remittance Receipt.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.Remittance Receipt.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33495:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33507:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33591:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33623:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3368d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33795:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33825:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Remittance Receipt.exe.4c38430.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Remittance Receipt.exe.4c38430.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Remittance Receipt.exe.4c38430.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31695:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31707:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31791:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31823:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3188d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31995:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a25:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xb00d5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xeaaf5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x125315:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xb0147:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xeab67:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x125387:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xb01d1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xeabf1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x125411:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xb0263:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xeac83:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1254a3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xb02cd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xeaced:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x12550d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xb033f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xead5f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x12557f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xb03d5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xeadf5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x125615:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Remittance Receipt.exe.4c38430.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Remittance Receipt.exe.4c38430.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Remittance Receipt.exe.4c38430.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33495:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6deb5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa86d5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33507:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df27:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8747:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33591:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfb1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87d1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33623:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e043:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8863:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3368d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0ad:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88cd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e11f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa893f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33795:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1b5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa89d5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x12c4f5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x166f15:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a1735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x12c567:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x166f87:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a17a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x12c5f1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x167011:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a1831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x12c683:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1670a3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a18c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x12c6ed:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16710d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a192d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x12c75f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16717f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a199f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x12c7f5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x167215:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a1a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Remittance Receipt.exe", ParentImage: C:\Users\user\Desktop\Remittance Receipt.exe, ParentProcessId: 7252, ParentProcessName: Remittance Receipt.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe", ProcessId: 7460, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 66.29.159.53, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Remittance Receipt.exe, Initiated: true, ProcessId: 7468, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49735

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Remittance Receipt.exe", ParentImage: C:\Users\user\Desktop\Remittance Receipt.exe, ParentProcessId: 7252, ParentProcessName: Remittance Receipt.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe", ProcessId: 7460, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.2.Remittance Receipt.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.privateemail.com", "Username": "info@bondamit.shop", "Password": "payment1759"}

Multi AV Scanner detection for submitted file

Source: Remittance Receipt.exe

ReversingLabs: Detection: 64%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Remittance Receipt.exe

Joe Sandbox ML: detected

Source: Remittance Receipt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: Remittance Receipt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: JAlv.pdbSHA256 source: Remittance Receipt.exe
Source:	Binary string: JAlv.pdb source: Remittance Receipt.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 66.29.159.53:587

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 66.29.159.53 66.29.159.53

Source: Joe Sandbox View

ASN Name: ADVANTAGECOMUS ADVANTAGECOMUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 66.29.159.53:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.privateemail.com

Source: Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2937793253.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Remittance Receipt.exe, 00000003.00000002.2937793253.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2938474547.0000000000C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2937793253.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2938474547.0000000000C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Remittance Receipt.exe, 00000000.00000002.1707885261.000000000330A000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2939186420.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.privateemail.com
Source: Remittance Receipt.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Remittance Receipt.exe, 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Remittance Receipt.exe, 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2939186420.0000000002921000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Remittance Receipt.exe, 00000003.00000002.2939186420.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Remittance Receipt.exe, 00000003.00000002.2939186420.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2938474547.0000000000C2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49733 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, R1W.cs

.Net Code: Niu4iGJUscW

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.Remittance Receipt.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Remittance Receipt.exe.4c38430.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Remittance Receipt.exe

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A2CA8 NtQueryInformationProcess,		0_2_079A2CA8
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A2CA0 NtQueryInformationProcess,		0_2_079A2CA0

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_015FD304	0_2_015FD304
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_0721F408	0_2_0721F408
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_0721CCD8	0_2_0721CCD8
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_0721A158	0_2_0721A158
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_072199F0	0_2_072199F0
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_07216578	0_2_07216578
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_07216310	0_2_07216310
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_0721F3F8	0_2_0721F3F8
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A3404	0_2_079A3404
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A5020	0_2_079A5020
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A0040	0_2_079A0040
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A2578	0_2_079A2578
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079AC4F0	0_2_079AC4F0
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079AC4E1	0_2_079AC4E1
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079AE418	0_2_079AE418
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079AE409	0_2_079AE409
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A52B0	0_2_079A52B0
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A52A2	0_2_079A52A2
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A20B8	0_2_079A20B8
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079AC0B8	0_2_079AC0B8
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A5012	0_2_079A5012
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A0006	0_2_079A0006
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A2E28	0_2_079A2E28
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079ABC80	0_2_079ABC80
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A1C80	0_2_079A1C80
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079A1C70	0_2_079A1C70
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079AB822	0_2_079AB822
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_079AB848	0_2_079AB848
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 0_2_0F701B60	0_2_0F701B60
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_00DAE2D0	3_2_00DAE2D0
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_00DAA968	3_2_00DAA968
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_00DA4AA0	3_2_00DA4AA0
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_00DA3E88	3_2_00DA3E88
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_00DA41D0	3_2_00DA41D0
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_00DAB76F	3_2_00DAB76F
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_06556678	3_2_06556678
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_06557E08	3_2_06557E08
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_06555630	3_2_06555630
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_06552420	3_2_06552420
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_0655C220	3_2_0655C220
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_0655B2C8	3_2_0655B2C8
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_06557728	3_2_06557728
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_0655E448	3_2_0655E448
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_06555D78	3_2_06555D78
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_06550006	3_2_06550006

Source: Remittance Receipt.exe, 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Remittance Receipt.exe
Source: Remittance Receipt.exe, 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb26f961-fadf-4425-9082-cde080536011.exe4 vs Remittance Receipt.exe
Source: Remittance Receipt.exe, 00000000.00000002.1706846848.000000000137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Remittance Receipt.exe
Source: Remittance Receipt.exe, 00000000.00000002.1707885261.000000000330A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb26f961-fadf-4425-9082-cde080536011.exe4 vs Remittance Receipt.exe
Source: Remittance Receipt.exe, 00000000.00000002.1716544151.000000000C020000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Remittance Receipt.exe
Source: Remittance Receipt.exe, 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebb26f961-fadf-4425-9082-cde080536011.exe4 vs Remittance Receipt.exe
Source: Remittance Receipt.exe, 00000003.00000002.2937042879.0000000000939000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Remittance Receipt.exe
Source: Remittance Receipt.exe	Binary or memory string: OriginalFilenameJAlv.exe> vs Remittance Receipt.exe

Source: Remittance Receipt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.Remittance Receipt.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Remittance Receipt.exe.4c38430.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Remittance Receipt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, wF8wPweGFdnjAJoAS6.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, wF8wPweGFdnjAJoAS6.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, wF8wPweGFdnjAJoAS6.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, wF8wPweGFdnjAJoAS6.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, wF8wPweGFdnjAJoAS6.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, wF8wPweGFdnjAJoAS6.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/6@2/2

Source: C:\Users\user\Desktop\Remittance Receipt.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Remittance Receipt.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esxcg2rg.0v0.ps1

Jump to behavior

Source: Remittance Receipt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Remittance Receipt.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Remittance Receipt.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Remittance Receipt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Remittance Receipt.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Remittance Receipt.exe

ReversingLabs: Detection: 64%

Source: unknown	Process created: C:\Users\user\Desktop\Remittance Receipt.exe "C:\Users\user\Desktop\Remittance Receipt.exe"
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe"
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process created: C:\Users\user\Desktop\Remittance Receipt.exe "C:\Users\user\Desktop\Remittance Receipt.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process created: C:\Users\user\Desktop\Remittance Receipt.exe "C:\Users\user\Desktop\Remittance Receipt.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Remittance Receipt.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Remittance Receipt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Remittance Receipt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Remittance Receipt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: JAlv.pdbSHA256 source: Remittance Receipt.exe
Source:	Binary string: JAlv.pdb source: Remittance Receipt.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: Remittance Receipt.exe, formMain.cs	.Net Code: InitializeComponent
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	.Net Code: R0WqVSB9jp System.Reflection.Assembly.Load(byte[])
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	.Net Code: R0WqVSB9jp System.Reflection.Assembly.Load(byte[])
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	.Net Code: R0WqVSB9jp System.Reflection.Assembly.Load(byte[])
Source: 0.2.Remittance Receipt.exe.7970000.4.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Remittance Receipt.exe.40c0b90.3.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])

Source: Remittance Receipt.exe

Static PE information: 0xBF845F71 [Mon Oct 26 22:17:21 2071 UTC]

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_00DAA255 push esp; retf 00E7h		3_2_00DAA6C1
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Code function: 3_2_00DA0C6D push edi; retf		3_2_00DA0C7A

Source: Remittance Receipt.exe

Static PE information: section name: .text entropy: 7.9413447657152325

Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, uUyLT6rWraNTNR9Bes.cs	High entropy of concatenated method names: 'LtuCIuW0JN', 'geoCvjJrsq', 'VLvCeJuX7b', 'yIqCrXQ71d', 'WasC4hA7K4', 'AwtCGUC9mn', 'U2UCYIPmJc', 'CmUCtRGWAl', 'lhYCJOnUY8', 'YmXCF1O0BM'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, Viq15SsIit3NiZkjhA.cs	High entropy of concatenated method names: 'a4QTSg4ow6', 'XbgTCbbOGt', 'f8YTQObd7k', 'sKaQRNthbm', 'bMuQzXfved', 'FHsTh9mvQd', 'oZNTd0RTq5', 'IdBTxFKjei', 'iIiTZ3RFER', 'ECvTqgIwvh'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, wIqJrOdZ56y6xyPWuhx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TlaFDRNEvD', 'NHgFOh5ABY', 'wUtFggtgyB', 'SKxFacX3ZJ', 'rGTFbnVjoj', 'zIHF5XMkpO', 'ScDFM6GALZ'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, eOaMVbaLTkyQmyHWEB.cs	High entropy of concatenated method names: 'a7QY7NBboI', 'mDnY94mrZ8', 'ToString', 'A7DYSQQ37k', 'HsdYfoUb6s', 'IyEYC1Qvud', 'FY5Y3VWUnr', 'BrZYQjY6y5', 'Mw3YTa6NRH', 'J6mYlARBLU'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, uo6sWEdhOuZxlT37aDM.cs	High entropy of concatenated method names: 'UIZJpG8Ft1', 'GApJyg03P4', 'YufJVZC1i0', 'P6cJI40Vhb', 'MHtJ0imdj9', 'GnLJvMtZmE', 'k0FJKSdfW5', 'mMPJeeyNdX', 'FKjJrR4FMk', 'aLeJ1ffIdo'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, wF8wPweGFdnjAJoAS6.cs	High entropy of concatenated method names: 'fqnfDnuKDN', 'tW2fOTJ3eK', 'IUifgi6QXE', 'q8TfaJoC5K', 'Ml2fbnKfYV', 'pd1f5Hfm0F', 'RrafMvUWIr', 'CBPfNJbKXS', 'hLFfWviTQq', 'lNefRXNfc9'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, tyFMtN2g9fpQOpTUBO.cs	High entropy of concatenated method names: 'QHITpfisfY', 'O8DTys9vtK', 'guCTVMGNC4', 'DsTTIfu05E', 'Q4BT0SDPM6', 'VFhTvPcDx1', 'XIJTKTJIvY', 'GbNTeA7lUA', 'C9yTrPqm64', 'yhfT1EZqFx'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	High entropy of concatenated method names: 'rDPZEgAVG8', 'TU7ZSIidYq', 'MFmZfSwwAw', 'tBvZCX2HG1', 'gnQZ3VwQto', 'hjhZQfV7mU', 'IaQZTE7FCN', 'yklZlSktqT', 'TxSZATNepT', 'KdTZ7kIQig'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, hluDHtjT4EfvxDCuWZ.cs	High entropy of concatenated method names: 'iGNQE1g2pQ', 'w7MQfrl4Tk', 'YWiQ38iRwA', 'aytQT6DLQg', 'XSYQl1uqD1', 'r0a3bpZldC', 'YsK354ixGi', 'Ppe3MtnjaB', 'PN63NKydRF', 'RP33WiM6sR'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, YySA4CRAfZopcXJlUS.cs	High entropy of concatenated method names: 'yapJdUPGJe', 'pVXJZ8Td9a', 'mwmJqlJppf', 'umLJSDvXxr', 'OM3Jfqkdsp', 'hsFJ3Hy4o7', 'yclJQiulkk', 'GoxtMo8HxC', 'B13tNG86ta', 'nRltWRxmYA'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, BIropUwKGWAP0KsEjt.cs	High entropy of concatenated method names: 'Sy5neDPs0Q', 'R7Pnrho2Xr', 'dfxnjubFqk', 'DKUnicVoUJ', 'Ap7n6weswt', 'BEDnBPbkbl', 'Tk7nsBAkr5', 'n5VnUaPVif', 'pu0nuhnQjw', 'b6InXtQpVK'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, uSAGG0NJjPyxhOyBIw.cs	High entropy of concatenated method names: 'DLwtShvCx1', 'AY8tf7sWHg', 'fdEtC293gF', 'PJqt3pRraO', 'KHqtQfyY5V', 'xlZtTVqaqn', 'it3tlF3oDs', 'y7CtA1deBf', 'Pptt7sngiA', 'Rg9t9QVuUc'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, hTp9K4fUflI2NTAFdZ.cs	High entropy of concatenated method names: 'Dispose', 'A14dWf93Ys', 'o9rxifJRPL', 'e5WGGCFm5A', 'CHSdRAGG0J', 'GPydzxhOyB', 'ProcessDialogKey', 'zwQxhRCHjl', 'tSyxdmtEmh', 'nLuxxRySA4'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, DUANteqPTww7e4XBnT.cs	High entropy of concatenated method names: 'AJkdTF8wPw', 'pFddlnjAJo', 'IWrd7aNTNR', 'mBed9sckfV', 'dbXd4Bp3lu', 'RHtdGT4Efv', 'GntuQpT6w9u1i9Xht9', 'lltGtmLfGaW8oTFwkM', 'EwVddjTwK2', 'YEKdZOOyVL'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, OnYsWAgpGSVkWwb4h1.cs	High entropy of concatenated method names: 'ToString', 'LIIGXrbReS', 'BDTGicQcrj', 'fGoGoRyavJ', 'SCjG6Ph8t1', 'JRdGBO5Saq', 'Os9G8IgnLk', 'EgvGss6OYs', 'dsuGUZuDDN', 'vZXG2J018B'
Source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, yBjtk8xgpnq3MBFwn4.cs	High entropy of concatenated method names: 'hybViWf0V', 'aHZIrJ3lO', 'GiSvbpDOl', 'edGKqxg2F', 'DaxriVfbi', 'm2l12dgiq', 'n37nINcbRy2PjSNYwe', 'CLqNoogrCtScT2e7Cf', 'w3pGP4UDg42ZZ6aXDV', 'gjgttsp5L'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, uUyLT6rWraNTNR9Bes.cs	High entropy of concatenated method names: 'LtuCIuW0JN', 'geoCvjJrsq', 'VLvCeJuX7b', 'yIqCrXQ71d', 'WasC4hA7K4', 'AwtCGUC9mn', 'U2UCYIPmJc', 'CmUCtRGWAl', 'lhYCJOnUY8', 'YmXCF1O0BM'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, Viq15SsIit3NiZkjhA.cs	High entropy of concatenated method names: 'a4QTSg4ow6', 'XbgTCbbOGt', 'f8YTQObd7k', 'sKaQRNthbm', 'bMuQzXfved', 'FHsTh9mvQd', 'oZNTd0RTq5', 'IdBTxFKjei', 'iIiTZ3RFER', 'ECvTqgIwvh'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, wIqJrOdZ56y6xyPWuhx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TlaFDRNEvD', 'NHgFOh5ABY', 'wUtFggtgyB', 'SKxFacX3ZJ', 'rGTFbnVjoj', 'zIHF5XMkpO', 'ScDFM6GALZ'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, eOaMVbaLTkyQmyHWEB.cs	High entropy of concatenated method names: 'a7QY7NBboI', 'mDnY94mrZ8', 'ToString', 'A7DYSQQ37k', 'HsdYfoUb6s', 'IyEYC1Qvud', 'FY5Y3VWUnr', 'BrZYQjY6y5', 'Mw3YTa6NRH', 'J6mYlARBLU'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, uo6sWEdhOuZxlT37aDM.cs	High entropy of concatenated method names: 'UIZJpG8Ft1', 'GApJyg03P4', 'YufJVZC1i0', 'P6cJI40Vhb', 'MHtJ0imdj9', 'GnLJvMtZmE', 'k0FJKSdfW5', 'mMPJeeyNdX', 'FKjJrR4FMk', 'aLeJ1ffIdo'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, wF8wPweGFdnjAJoAS6.cs	High entropy of concatenated method names: 'fqnfDnuKDN', 'tW2fOTJ3eK', 'IUifgi6QXE', 'q8TfaJoC5K', 'Ml2fbnKfYV', 'pd1f5Hfm0F', 'RrafMvUWIr', 'CBPfNJbKXS', 'hLFfWviTQq', 'lNefRXNfc9'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, tyFMtN2g9fpQOpTUBO.cs	High entropy of concatenated method names: 'QHITpfisfY', 'O8DTys9vtK', 'guCTVMGNC4', 'DsTTIfu05E', 'Q4BT0SDPM6', 'VFhTvPcDx1', 'XIJTKTJIvY', 'GbNTeA7lUA', 'C9yTrPqm64', 'yhfT1EZqFx'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	High entropy of concatenated method names: 'rDPZEgAVG8', 'TU7ZSIidYq', 'MFmZfSwwAw', 'tBvZCX2HG1', 'gnQZ3VwQto', 'hjhZQfV7mU', 'IaQZTE7FCN', 'yklZlSktqT', 'TxSZATNepT', 'KdTZ7kIQig'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, hluDHtjT4EfvxDCuWZ.cs	High entropy of concatenated method names: 'iGNQE1g2pQ', 'w7MQfrl4Tk', 'YWiQ38iRwA', 'aytQT6DLQg', 'XSYQl1uqD1', 'r0a3bpZldC', 'YsK354ixGi', 'Ppe3MtnjaB', 'PN63NKydRF', 'RP33WiM6sR'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, YySA4CRAfZopcXJlUS.cs	High entropy of concatenated method names: 'yapJdUPGJe', 'pVXJZ8Td9a', 'mwmJqlJppf', 'umLJSDvXxr', 'OM3Jfqkdsp', 'hsFJ3Hy4o7', 'yclJQiulkk', 'GoxtMo8HxC', 'B13tNG86ta', 'nRltWRxmYA'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, BIropUwKGWAP0KsEjt.cs	High entropy of concatenated method names: 'Sy5neDPs0Q', 'R7Pnrho2Xr', 'dfxnjubFqk', 'DKUnicVoUJ', 'Ap7n6weswt', 'BEDnBPbkbl', 'Tk7nsBAkr5', 'n5VnUaPVif', 'pu0nuhnQjw', 'b6InXtQpVK'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, uSAGG0NJjPyxhOyBIw.cs	High entropy of concatenated method names: 'DLwtShvCx1', 'AY8tf7sWHg', 'fdEtC293gF', 'PJqt3pRraO', 'KHqtQfyY5V', 'xlZtTVqaqn', 'it3tlF3oDs', 'y7CtA1deBf', 'Pptt7sngiA', 'Rg9t9QVuUc'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, hTp9K4fUflI2NTAFdZ.cs	High entropy of concatenated method names: 'Dispose', 'A14dWf93Ys', 'o9rxifJRPL', 'e5WGGCFm5A', 'CHSdRAGG0J', 'GPydzxhOyB', 'ProcessDialogKey', 'zwQxhRCHjl', 'tSyxdmtEmh', 'nLuxxRySA4'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, DUANteqPTww7e4XBnT.cs	High entropy of concatenated method names: 'AJkdTF8wPw', 'pFddlnjAJo', 'IWrd7aNTNR', 'mBed9sckfV', 'dbXd4Bp3lu', 'RHtdGT4Efv', 'GntuQpT6w9u1i9Xht9', 'lltGtmLfGaW8oTFwkM', 'EwVddjTwK2', 'YEKdZOOyVL'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, OnYsWAgpGSVkWwb4h1.cs	High entropy of concatenated method names: 'ToString', 'LIIGXrbReS', 'BDTGicQcrj', 'fGoGoRyavJ', 'SCjG6Ph8t1', 'JRdGBO5Saq', 'Os9G8IgnLk', 'EgvGss6OYs', 'dsuGUZuDDN', 'vZXG2J018B'
Source: 0.2.Remittance Receipt.exe.c020000.5.raw.unpack, yBjtk8xgpnq3MBFwn4.cs	High entropy of concatenated method names: 'hybViWf0V', 'aHZIrJ3lO', 'GiSvbpDOl', 'edGKqxg2F', 'DaxriVfbi', 'm2l12dgiq', 'n37nINcbRy2PjSNYwe', 'CLqNoogrCtScT2e7Cf', 'w3pGP4UDg42ZZ6aXDV', 'gjgttsp5L'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, uUyLT6rWraNTNR9Bes.cs	High entropy of concatenated method names: 'LtuCIuW0JN', 'geoCvjJrsq', 'VLvCeJuX7b', 'yIqCrXQ71d', 'WasC4hA7K4', 'AwtCGUC9mn', 'U2UCYIPmJc', 'CmUCtRGWAl', 'lhYCJOnUY8', 'YmXCF1O0BM'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, Viq15SsIit3NiZkjhA.cs	High entropy of concatenated method names: 'a4QTSg4ow6', 'XbgTCbbOGt', 'f8YTQObd7k', 'sKaQRNthbm', 'bMuQzXfved', 'FHsTh9mvQd', 'oZNTd0RTq5', 'IdBTxFKjei', 'iIiTZ3RFER', 'ECvTqgIwvh'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, wIqJrOdZ56y6xyPWuhx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TlaFDRNEvD', 'NHgFOh5ABY', 'wUtFggtgyB', 'SKxFacX3ZJ', 'rGTFbnVjoj', 'zIHF5XMkpO', 'ScDFM6GALZ'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, eOaMVbaLTkyQmyHWEB.cs	High entropy of concatenated method names: 'a7QY7NBboI', 'mDnY94mrZ8', 'ToString', 'A7DYSQQ37k', 'HsdYfoUb6s', 'IyEYC1Qvud', 'FY5Y3VWUnr', 'BrZYQjY6y5', 'Mw3YTa6NRH', 'J6mYlARBLU'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, uo6sWEdhOuZxlT37aDM.cs	High entropy of concatenated method names: 'UIZJpG8Ft1', 'GApJyg03P4', 'YufJVZC1i0', 'P6cJI40Vhb', 'MHtJ0imdj9', 'GnLJvMtZmE', 'k0FJKSdfW5', 'mMPJeeyNdX', 'FKjJrR4FMk', 'aLeJ1ffIdo'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, wF8wPweGFdnjAJoAS6.cs	High entropy of concatenated method names: 'fqnfDnuKDN', 'tW2fOTJ3eK', 'IUifgi6QXE', 'q8TfaJoC5K', 'Ml2fbnKfYV', 'pd1f5Hfm0F', 'RrafMvUWIr', 'CBPfNJbKXS', 'hLFfWviTQq', 'lNefRXNfc9'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, tyFMtN2g9fpQOpTUBO.cs	High entropy of concatenated method names: 'QHITpfisfY', 'O8DTys9vtK', 'guCTVMGNC4', 'DsTTIfu05E', 'Q4BT0SDPM6', 'VFhTvPcDx1', 'XIJTKTJIvY', 'GbNTeA7lUA', 'C9yTrPqm64', 'yhfT1EZqFx'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, mvQ1eYlRRr6cG91YYT.cs	High entropy of concatenated method names: 'rDPZEgAVG8', 'TU7ZSIidYq', 'MFmZfSwwAw', 'tBvZCX2HG1', 'gnQZ3VwQto', 'hjhZQfV7mU', 'IaQZTE7FCN', 'yklZlSktqT', 'TxSZATNepT', 'KdTZ7kIQig'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, hluDHtjT4EfvxDCuWZ.cs	High entropy of concatenated method names: 'iGNQE1g2pQ', 'w7MQfrl4Tk', 'YWiQ38iRwA', 'aytQT6DLQg', 'XSYQl1uqD1', 'r0a3bpZldC', 'YsK354ixGi', 'Ppe3MtnjaB', 'PN63NKydRF', 'RP33WiM6sR'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, YySA4CRAfZopcXJlUS.cs	High entropy of concatenated method names: 'yapJdUPGJe', 'pVXJZ8Td9a', 'mwmJqlJppf', 'umLJSDvXxr', 'OM3Jfqkdsp', 'hsFJ3Hy4o7', 'yclJQiulkk', 'GoxtMo8HxC', 'B13tNG86ta', 'nRltWRxmYA'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, BIropUwKGWAP0KsEjt.cs	High entropy of concatenated method names: 'Sy5neDPs0Q', 'R7Pnrho2Xr', 'dfxnjubFqk', 'DKUnicVoUJ', 'Ap7n6weswt', 'BEDnBPbkbl', 'Tk7nsBAkr5', 'n5VnUaPVif', 'pu0nuhnQjw', 'b6InXtQpVK'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, uSAGG0NJjPyxhOyBIw.cs	High entropy of concatenated method names: 'DLwtShvCx1', 'AY8tf7sWHg', 'fdEtC293gF', 'PJqt3pRraO', 'KHqtQfyY5V', 'xlZtTVqaqn', 'it3tlF3oDs', 'y7CtA1deBf', 'Pptt7sngiA', 'Rg9t9QVuUc'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, hTp9K4fUflI2NTAFdZ.cs	High entropy of concatenated method names: 'Dispose', 'A14dWf93Ys', 'o9rxifJRPL', 'e5WGGCFm5A', 'CHSdRAGG0J', 'GPydzxhOyB', 'ProcessDialogKey', 'zwQxhRCHjl', 'tSyxdmtEmh', 'nLuxxRySA4'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, DUANteqPTww7e4XBnT.cs	High entropy of concatenated method names: 'AJkdTF8wPw', 'pFddlnjAJo', 'IWrd7aNTNR', 'mBed9sckfV', 'dbXd4Bp3lu', 'RHtdGT4Efv', 'GntuQpT6w9u1i9Xht9', 'lltGtmLfGaW8oTFwkM', 'EwVddjTwK2', 'YEKdZOOyVL'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, OnYsWAgpGSVkWwb4h1.cs	High entropy of concatenated method names: 'ToString', 'LIIGXrbReS', 'BDTGicQcrj', 'fGoGoRyavJ', 'SCjG6Ph8t1', 'JRdGBO5Saq', 'Os9G8IgnLk', 'EgvGss6OYs', 'dsuGUZuDDN', 'vZXG2J018B'
Source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, yBjtk8xgpnq3MBFwn4.cs	High entropy of concatenated method names: 'hybViWf0V', 'aHZIrJ3lO', 'GiSvbpDOl', 'edGKqxg2F', 'DaxriVfbi', 'm2l12dgiq', 'n37nINcbRy2PjSNYwe', 'CLqNoogrCtScT2e7Cf', 'w3pGP4UDg42ZZ6aXDV', 'gjgttsp5L'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Remittance Receipt.exe PID: 7252, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Remittance Receipt.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: 15F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: 50A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: 9480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: A480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: A690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: B690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: C0A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: D0A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: E0A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: 2920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5317	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3806	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Window / User API: threadDelayed 1208	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Window / User API: threadDelayed 3737	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7616	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7740	Thread sleep count: 1208 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7740	Thread sleep count: 3737 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -99407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -99282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -99172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -97891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -97672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -97563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -97438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -97328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe TID: 7736	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Remittance Receipt.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Remittance Receipt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 97891	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 97563	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 97438	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Remittance Receipt.exe, 00000000.00000002.1706846848.00000000013B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Remittance Receipt.exe, 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: hgfsZrw6
Source: Remittance Receipt.exe, 00000003.00000002.2938474547.0000000000C2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe"
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Memory written: C:\Users\user\Desktop\Remittance Receipt.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Process created: C:\Users\user\Desktop\Remittance Receipt.exe "C:\Users\user\Desktop\Remittance Receipt.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Users\user\Desktop\Remittance Receipt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Users\user\Desktop\Remittance Receipt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.Remittance Receipt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4c38430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2939186420.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Remittance Receipt.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Remittance Receipt.exe PID: 7468, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Remittance Receipt.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Remittance Receipt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Remittance Receipt.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Remittance Receipt.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Remittance Receipt.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.Remittance Receipt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4c38430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2939186420.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Remittance Receipt.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Remittance Receipt.exe PID: 7468, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.Remittance Receipt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4c38430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4bbb7f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4c38430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Remittance Receipt.exe.4b3f3d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2939186420.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Remittance Receipt.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Remittance Receipt.exe PID: 7468, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Remittance Receipt.exe	65%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
Remittance Receipt.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		unknown
smtp.privateemail.com	66.29.159.53	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2938474547.0000000000C2C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2938474547.0000000000C2C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	Remittance Receipt.exe, 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2938474547.0000000000C2C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/DataSet1.xsd	Remittance Receipt.exe	false		unknown
http://www.tiro.com	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	Remittance Receipt.exe, 00000003.00000002.2939186420.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://smtp.privateemail.com	Remittance Receipt.exe, 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	Remittance Receipt.exe, 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2939186420.0000000002921000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Remittance Receipt.exe, 00000000.00000002.1707885261.000000000330A000.00000004.00000800.00020000.00000000.sdmp, Remittance Receipt.exe, 00000003.00000002.2939186420.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Remittance Receipt.exe, 00000000.00000002.1713130239.0000000007252000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
66.29.159.53	smtp.privateemail.com	United States		19538	ADVANTAGECOMUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543469
Start date and time:	2024-10-27 23:20:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Remittance Receipt.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 92 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Remittance Receipt.exe

Simulations

Behavior and APIs

Time	Type	Description
18:20:59	API Interceptor	26x Sleep call for process: Remittance Receipt.exe modified
18:21:01	API Interceptor	13x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
66.29.159.53	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	HSBC Payment Advice_pdf.exe	Get hash	malicious	AgentTesla	Browse
	Payment List.bat.exe	Get hash	malicious	AgentTesla	Browse
	INQUIRY RE44535_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	e-dekont_swift-details.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	17129052285907bbffa1e06db9a2c2be9b124dbfe370dcce33488c29504b5286529b8a6aa8471.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	Scan_IMG-Payment Sheet _Till Febuary 2024...bat.exe	Get hash	malicious	AgentTesla	Browse
	1709572324a197889913f96ec9bd444cdc1a03ae72cd8e81098994f82b76ebbbd558d62ba0270.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.privateemail.com	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	66.29.159.53
	HSBC Payment Advice_pdf.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	Payment List.bat.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	INQUIRY RE44535_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	66.29.159.53
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	e-dekont_swift-details.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	17129052285907bbffa1e06db9a2c2be9b124dbfe370dcce33488c29504b5286529b8a6aa8471.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	Scan_IMG-Payment Sheet _Till Febuary 2024...bat.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	1709572324a197889913f96ec9bd444cdc1a03ae72cd8e81098994f82b76ebbbd558d62ba0270.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
api.ipify.org	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	EICAR	Browse	104.26.13.205
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	SUNNY HONG VSL PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Rampage.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://pub-535a4999ab4b4c1e81647bad9b888e40.r2.dev/onedrivefresh.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://gf5q.sqpbij.shop/?c2V0aC5wZW1iZXJAYXV0b3BhcnRpbnRsLmNvbTp3NThyNg	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	https://bit.ly/3Cbulr1	Get hash	malicious	Unknown	Browse	172.67.154.120
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SecuriteInfo.com.Win64.Malware-gen.13500.20938.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	162.159.135.232
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	104.20.23.46
ADVANTAGECOMUS	mm.exe	Get hash	malicious	Unknown	Browse	66.29.137.43
	rBALT-10212024.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	9b7dlGj5Gq.exe	Get hash	malicious	FormBook	Browse	66.29.141.40
	https://vestliaresort-my.sharepoint.com/:o:/g/personal/ziga_vestlia_no/Eky579E0q2lOhPOUshOGsHcBMaZdCfwRcrEzHT2ZmUZxNA?e=ksWeaa	Get hash	malicious	Unknown	Browse	66.29.147.206
	https://new-doctor-booking-php-mysql.filemakrxpert.com/	Get hash	malicious	Unknown	Browse	66.29.148.84
	https://mairenaflores.com/office.html	Get hash	malicious	Unknown	Browse	66.29.141.48
	rAGROTIS10599242024.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	oO3ZmCAeLQ.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	https://app.powerbi.com/view?r=eyJrIjoiOWEwN2RmMjItNjhiOC00Njc0LTliM2MtNzdiNWRiOGVlMWIyIiwidCI6IjJkMTNkMGU4LTI1YjgtNDE2Yi04YzQ1LTVkZDU4MDgzYmVjZCJ9	Get hash	malicious	Unknown	Browse	66.29.131.166
	https:/app.powerbi.com/view?r=eyJrIjoiOWEwN2RmMjItNjhiOC00Njc0LTliM2MtNzdiNWRiOGVlMWIyIiwidCI6IjJkMTNkMGU4LTI1YjgtNDE2Yi04YzQ1LTVkZDU4MDgzYmVjZCJ9	Get hash	malicious	EvilProxy	Browse	66.29.131.166

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.26.12.205
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	104.26.12.205
	SecuriteInfo.com.Win64.Trojan.Agent.2S9FJA.25494.32016.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	SecuriteInfo.com.Win64.Trojan.Agent.2S9FJA.25494.32016.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	sheisverynicegirlwithgreatworkingskillwithgereatniceworkign.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.26.12.205
	seemeherewithgreatthingsentiretimewithgreatthingsonhere.hta	Get hash	malicious	Cobalt Strike	Browse	104.26.12.205
	seethebestthingswhichgivennewthingswithmewesee.hta	Get hash	malicious	Cobalt Strike	Browse	104.26.12.205
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	Factura-2410-CFDI.bat	Get hash	malicious	Unknown	Browse	104.26.12.205
	SUNNY HONG VSL PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\Remittance Receipt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.357042452875322
Encrypted:	false
SSDEEP:	24:3CytZWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:yyjWSU4y4RQmFoUeWmfmZ9tK8NDE
MD5:	475D428E7231D005EEA5DB556DBED03F
SHA1:	3D603ED4280E0017D1BEB124D68183F8283B5C22
SHA-256:	1314488A930843A7E1A003F2E7C1D883DB44ADEC26AC1CA096FE8DC1B4B180F5
SHA-512:	7181BDCE6DA8DA8AFD3A973BB2B0BA470468EFF32FFB338DB2662FEFA1A7848ACD87C319706B95401EA18DC873CA098DC722EA6F8B2FD04F1AABD2AEBEA97CF9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dcxi2ey.vzw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esxcg2rg.0v0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_peaivkta.owi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zfibl34n.wjg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.933068500226317
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Remittance Receipt.exe
File size:	714'752 bytes
MD5:	db9a323fde82eac0d972eec0acde0209
SHA1:	88ead16576193df0d647c722d70b79f50300e852
SHA256:	e93171125e897ba3a556f1b0171629d2a9aaa3298510f97b5d7cda44b9c3c313
SHA512:	d22a3073ea9d5c6111e61200521fa9453fc5c5814a4cd64595d5d297c6c5f9d2b5d186d10700728d19087a72c8c392a87797ffe5a48440a42165b095f12204ad
SSDEEP:	12288:KCfiaaMHHsczu6ko6E52x82u6/DsXsW7mbXt8V8XME+L:KYi5MH1z9J2du6LsXGtm8Ra
TLSH:	2DE412913BA88B61C9FEA7F54A72595147B3716F587AE34C8DC230DD0073B860E90B6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q_................0.............n.... ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4afa6e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBF845F71 [Mon Oct 26 22:17:21 2071 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xafa1b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x630	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xad8f8	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xada74	0xadc00	03ccd812af1ba1ea2ba05ca705b6677c	False	0.9512294851618706	data	7.9413447657152325	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x630	0x800	7ae99a757c8bb4e800e24f03e06d4f33	False	0.33837890625	data	3.4779937429790824	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x200	49a41c9a66ff4b862ab63a067c950e33	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb0090	0x3a0	data			0.4213362068965517
RT_MANIFEST	0xb0440	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 23:21:01.566791058 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:01.566838980 CET	443	49733	104.26.12.205	192.168.2.4
Oct 27, 2024 23:21:01.566966057 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:01.575361013 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:01.575371027 CET	443	49733	104.26.12.205	192.168.2.4
Oct 27, 2024 23:21:02.182329893 CET	443	49733	104.26.12.205	192.168.2.4
Oct 27, 2024 23:21:02.182470083 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:02.185472012 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:02.185484886 CET	443	49733	104.26.12.205	192.168.2.4
Oct 27, 2024 23:21:02.185915947 CET	443	49733	104.26.12.205	192.168.2.4
Oct 27, 2024 23:21:02.227716923 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:02.251667023 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:02.295331955 CET	443	49733	104.26.12.205	192.168.2.4
Oct 27, 2024 23:21:02.433902979 CET	443	49733	104.26.12.205	192.168.2.4
Oct 27, 2024 23:21:02.433978081 CET	443	49733	104.26.12.205	192.168.2.4
Oct 27, 2024 23:21:02.434118986 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:02.439871073 CET	49733	443	192.168.2.4	104.26.12.205
Oct 27, 2024 23:21:03.439301014 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:03.444751978 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:03.444957972 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:04.640562057 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:04.640748978 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:04.646204948 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:04.786503077 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:04.786648989 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:04.792443991 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:04.932595968 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:04.933202028 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:04.938636065 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.166516066 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.166553974 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.166605949 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.166639090 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.166726112 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.166749001 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.166749001 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.166755915 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.166903973 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.192286015 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.198107958 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.338932037 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.343039989 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.348830938 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.489298105 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.490252972 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.495857954 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.637387991 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.637939930 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.643476009 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.788176060 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.788491011 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.794080019 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.935563087 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:05.935863972 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:05.941266060 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:06.089720011 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:06.096009970 CET	49735	587	192.168.2.4	66.29.159.53
Oct 27, 2024 23:21:06.102263927 CET	587	49735	66.29.159.53	192.168.2.4
Oct 27, 2024 23:21:06.102334023 CET	49735	587	192.168.2.4	66.29.159.53

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 23:21:01.552128077 CET	54389	53	192.168.2.4	1.1.1.1
Oct 27, 2024 23:21:01.560538054 CET	53	54389	1.1.1.1	192.168.2.4
Oct 27, 2024 23:21:03.423233032 CET	49610	53	192.168.2.4	1.1.1.1
Oct 27, 2024 23:21:03.438663006 CET	53	49610	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 23:21:01.552128077 CET	192.168.2.4	1.1.1.1	0x2b60	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 27, 2024 23:21:03.423233032 CET	192.168.2.4	1.1.1.1	0x90fb	Standard query (0)	smtp.privateemail.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 23:21:01.560538054 CET	1.1.1.1	192.168.2.4	0x2b60	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 27, 2024 23:21:01.560538054 CET	1.1.1.1	192.168.2.4	0x2b60	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 27, 2024 23:21:01.560538054 CET	1.1.1.1	192.168.2.4	0x2b60	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 27, 2024 23:21:03.438663006 CET	1.1.1.1	192.168.2.4	0x90fb	No error (0)	smtp.privateemail.com	66.29.159.53	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.26.12.205	443	7468	C:\Users\user\Desktop\Remittance Receipt.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 22:21:02 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-27 22:21:02 UTC	211	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 22:21:02 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8d9613a97a9947a9-DFW
2024-10-27 22:21:02 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 Data Ascii: 173.254.250.90

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 27, 2024 23:21:04.640562057 CET	587	49735	66.29.159.53	192.168.2.4	220 PrivateEmail.com prod Mail Node
Oct 27, 2024 23:21:04.640748978 CET	49735	587	192.168.2.4	66.29.159.53	EHLO 932923
Oct 27, 2024 23:21:04.786503077 CET	587	49735	66.29.159.53	192.168.2.4	250-mta-11.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-CHUNKING 250 STARTTLS
Oct 27, 2024 23:21:04.786648989 CET	49735	587	192.168.2.4	66.29.159.53	STARTTLS
Oct 27, 2024 23:21:04.932595968 CET	587	49735	66.29.159.53	192.168.2.4	220 Ready to start TLS

Target ID:	0
Start time:	18:20:57
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\Remittance Receipt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Remittance Receipt.exe"
Imagebase:	0xce0000
File size:	714'752 bytes
MD5 hash:	DB9A323FDE82EAC0D972EEC0ACDE0209
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1708383480.0000000004938000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:21:00
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Remittance Receipt.exe"
Imagebase:	0x770000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:21:00
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\Remittance Receipt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Remittance Receipt.exe"
Imagebase:	0x4d0000
File size:	714'752 bytes
MD5 hash:	DB9A323FDE82EAC0D972EEC0ACDE0209
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2936779609.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2939186420.0000000002971000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2939186420.0000000002971000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2939186420.000000000299B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	18:21:00
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	289
Total number of Limit Nodes:	19

Executed Functions

Function 0721A158 Relevance: 5.3, Strings: 4, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(okq, xrefs: 0721A260
,oq, xrefs: 0721A2D8
(okq, xrefs: 0721A252
,oq, xrefs: 0721A2CA

Memory Dump Source

Source File: 00000000.00000002.1713075970.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7210000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: (okq$(okq$,oq$,oq
API String ID: 0-2865278577
Opcode ID: 4ba32f2599f5ff76dd7c8d80a13e0dc37c7d74b3f7808a92e7490c1bd91aa89a
Instruction ID: 5ca576fa93a768bf9ad6c221421a08f4f24e1e0d2dc0d792113b224dbeeac941
Opcode Fuzzy Hash: 4ba32f2599f5ff76dd7c8d80a13e0dc37c7d74b3f7808a92e7490c1bd91aa89a
Instruction Fuzzy Hash: 00D13EB0A2111ADFCB14CFA9D988AADBBF6FF99300F15C165E405A7264D730ED41CB50

Function 0721CCD8 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

(okq, xrefs: 0721D0F8
4'kq, xrefs: 0721D6F3

Memory Dump Source

Source File: 00000000.00000002.1713075970.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7210000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: (okq$4'kq
API String ID: 0-1210385896
Opcode ID: 4e459206ac68eadade057c3ef526dda0e7ee27b798465aabd5447d53097b6293
Instruction ID: d5e98de07503b181b02ef6ceac63d9662e9c17e8e99e2627c05a240f0dbf9bab
Opcode Fuzzy Hash: 4e459206ac68eadade057c3ef526dda0e7ee27b798465aabd5447d53097b6293
Instruction Fuzzy Hash: 1472A0B5B2064ADFCF15CF68D984AAEBBF2FF98300F158559E4199B261D730E881CB50

Function 072199F0 Relevance: 3.1, Strings: 2, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 07219DE6
(okq, xrefs: 07219F1A

Memory Dump Source

Source File: 00000000.00000002.1713075970.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7210000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: (okq$Hoq
API String ID: 0-4134915641
Opcode ID: 6d4c6cd763cc710aa2b8da20d4574a4d800b8f6f3a281adfe89d113985d33c36
Instruction ID: c3c3967c32ee548edaa9742b968c67b40aa6c268221e97acc3d4b83a1b43c5ef
Opcode Fuzzy Hash: 6d4c6cd763cc710aa2b8da20d4574a4d800b8f6f3a281adfe89d113985d33c36
Instruction Fuzzy Hash: 5B228FB0A1025A9FDB14DF69C954BAEBBF6FF88300F148429E84597391DF34AD81CB90

Function 079A2CA0 Relevance: 1.6, APIs: 1, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 079A2D27

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 80e9e9b1ffcc22bf4ab044bc3b2b8e27689cd5c76f7865e5e89ec5bdb93f6529
Instruction ID: ae29c5b544824be070a093234df9e338a7a65a25ca64cfe6e387010b99f3441e
Opcode Fuzzy Hash: 80e9e9b1ffcc22bf4ab044bc3b2b8e27689cd5c76f7865e5e89ec5bdb93f6529
Instruction Fuzzy Hash: 74210FB6900249DFCB10CF9AD984ADEFBF4FB48324F20842AE958A7610C334A540CFA5

Function 079A2CA8 Relevance: 1.6, APIs: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 079A2D27

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: e015f1584ac5cc4b956b1f9a091499cfcfbd9ab2113b36a5c97a74a913458eeb
Instruction ID: ad7379a90b6cc73e1260497658461a04e0744451b5f1c57b547627a51a2dd838
Opcode Fuzzy Hash: e015f1584ac5cc4b956b1f9a091499cfcfbd9ab2113b36a5c97a74a913458eeb
Instruction Fuzzy Hash: 6A21C0B6901359EFCB10DF9AD984ADEFBF4FB48314F20842AE958A7210C375A544CFA5

Function 079A0040 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a573f99a51bb03a7e4794c8bc65383eee18b4770f7a9b8b90cfbefb4015b04d
Instruction ID: 844cb068ea4dd905759ab5047506c7a0989af3059643f90792d03a1ec91422c7
Opcode Fuzzy Hash: 7a573f99a51bb03a7e4794c8bc65383eee18b4770f7a9b8b90cfbefb4015b04d
Instruction Fuzzy Hash: 014282B4E11219CFDB64CFA9C984B9DBBF2BF48315F1481A9E809A7355DB30A981CF50

Function 0721F408 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713075970.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7210000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6230c471c43dee8e6b7f3f4a93e6e276d8ca850e7fa549fd378d4d518ed8088
Instruction ID: 6b270fdae561e41a8e558428b15132981c998bc49c993015d64ff2f41de677a0
Opcode Fuzzy Hash: a6230c471c43dee8e6b7f3f4a93e6e276d8ca850e7fa549fd378d4d518ed8088
Instruction Fuzzy Hash: 3132D4B091221ACFDB50DF69C680A8EFBF2BF48315F55D195E418AB212DB30E981CF64

Function 0F701B60 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717632405.000000000F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f700000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b69d6ecbaa94929cd7461135427c74e8dc1fa03a67990f8f66509c040ae657
Instruction ID: fded0b82f5839aaf42f1df8f0b0e7b429ccac7dc081f7f6cd04d4a1d9fbaa28a
Opcode Fuzzy Hash: f5b69d6ecbaa94929cd7461135427c74e8dc1fa03a67990f8f66509c040ae657
Instruction Fuzzy Hash: 9EC1DA70701605CFDB29EB76C410BAEB7FAAF89704F9444ADD24A8B2D5DB74E801CB52

Function 079A3404 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e2c8d0ce3f8615c2602aa6ec6b0d35e6d6f94df1b9acc25ecc50ac394aa1c1
Instruction ID: bea7dfe60f573a46386af54d56614c603b34f651c488923ca4019387583d2e79
Opcode Fuzzy Hash: f6e2c8d0ce3f8615c2602aa6ec6b0d35e6d6f94df1b9acc25ecc50ac394aa1c1
Instruction Fuzzy Hash: 60618BB5E0124A9FCF04DFA9D8449EEFBF6FF88310F10842AE815A7254DB709906CB90

Function 079A0006 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6190dc4badef5d855c10c474bbaa1173527f927d413d26146aa0e53c701ac127
Instruction ID: c6348c09dda1059b1d4caca98d7b1fca21b66e77a834364cfa5a264e6c72b4c8
Opcode Fuzzy Hash: 6190dc4badef5d855c10c474bbaa1173527f927d413d26146aa0e53c701ac127
Instruction Fuzzy Hash: 2971F9B4E01218CFDB19CF69C995BDDBBB2BF89300F1481AAE408AB395D7356941CF50

Function 079A5020 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2aacf1503273f8c5e1af25844726a99112d5dae050d1ed80516a3a75fc0b6d1
Instruction ID: 6c8f7f22f93b2c73a869fa06a327a5baf0594e4582d5065f56730482063cb23f
Opcode Fuzzy Hash: e2aacf1503273f8c5e1af25844726a99112d5dae050d1ed80516a3a75fc0b6d1
Instruction Fuzzy Hash: 7851A3B5E016199FDB04CFEAD8446EEFBB2FF89300F10802AE919AB254DB745946CF50

Function 0721F3F8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713075970.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7210000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b81a921fc0f1e5135652851979958dee69a1c83ef7103c8e46ca1b2454c07f
Instruction ID: 9a6244b98ed9dc8b46d93fd972585010c3023e19eb8a7d09e8ded3301fa9d8e7
Opcode Fuzzy Hash: f1b81a921fc0f1e5135652851979958dee69a1c83ef7103c8e46ca1b2454c07f
Instruction Fuzzy Hash: AD410DB1E016198FEB58CF6AC94079EBBF2BF89300F14C1AAC45CA7255EB300A46CF51

Function 079A5012 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c473cf4785a92e4341cab3d189992304934708a9108b9487ba27113f070e36b0
Instruction ID: 2bcedb8cac7ac98cd902ce2da4b1dde7c73d57874e8e14c73c0b36e5a8c73769
Opcode Fuzzy Hash: c473cf4785a92e4341cab3d189992304934708a9108b9487ba27113f070e36b0
Instruction Fuzzy Hash: 8641A7B5E016599FDB08CFEAC4456EEFBF2AF89300F14C06AD918AB254EB345945CF40

Function 015FD3C9 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015FD456
GetCurrentThread.KERNEL32 ref: 015FD493
GetCurrentProcess.KERNEL32 ref: 015FD4D0
GetCurrentThreadId.KERNEL32 ref: 015FD529

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ae6a80705bacb5fead1d33f99b95e7a1291acb2f38aa73a09b5525f4f9dd560a
Instruction ID: 0d1d1dbeb294c23f7d8b41fc51985c46f59a235e8fc8424eb9072aa89e58bc65
Opcode Fuzzy Hash: ae6a80705bacb5fead1d33f99b95e7a1291acb2f38aa73a09b5525f4f9dd560a
Instruction Fuzzy Hash: D45167B09003098FDB14DFA9D548BEEBFF1FF48314F248459E119AB2A0DB74A984CB65

Function 015FD3D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015FD456
GetCurrentThread.KERNEL32 ref: 015FD493
GetCurrentProcess.KERNEL32 ref: 015FD4D0
GetCurrentThreadId.KERNEL32 ref: 015FD529

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a73cd95188fa3b159285c66221e097836fd4f077fd2a719756a3456901a4bc03
Instruction ID: 672387522ccde359f9c8f45c16c98691b14840df04583c6589379cd1d5c9500c
Opcode Fuzzy Hash: a73cd95188fa3b159285c66221e097836fd4f077fd2a719756a3456901a4bc03
Instruction Fuzzy Hash: 285154B09002098FDB54DFAAD548BEEBBF1FB48314F208459E519AB260DB74A984CF65

Function 079AE9DD Relevance: 1.7, APIs: 1, Instructions: 248processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 079AEC1E

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 10c70e5433ce742df32de354362b62448a4c5a8704c4aed938a83c009cc83dd6
Instruction ID: 71b351cb895a78a93c430b7091a7969bf6fb4086ceac5e00590b0d2e52807cd3
Opcode Fuzzy Hash: 10c70e5433ce742df32de354362b62448a4c5a8704c4aed938a83c009cc83dd6
Instruction Fuzzy Hash: DAA1ADB1D0131ADFDB10CF69C8467DDBBB6BF48314F1485A9E809A7290DB749980CF91

Function 079AE9E8 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 079AEC1E

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5990755acff3f82245bf85b5d34566e44b29b6c4a1ceec568d0aec4bdc69d279
Instruction ID: 58fad86b4df8c605bae5acfe5fadad4ec8412f304aefb4838e26f6e59d073011
Opcode Fuzzy Hash: 5990755acff3f82245bf85b5d34566e44b29b6c4a1ceec568d0aec4bdc69d279
Instruction Fuzzy Hash: 94918DB1D0121ADFDB10CF69C8467EDBBB6BF48314F1481A9E809A7290DB749985CF91

Function 015FAD48 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015FAF9E

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1159a455dbad7251d075ff1e67427566de69f78144458c78320aff93aa7eef94
Instruction ID: 078970044ba9864a8e9241aa4f38603c159fdfeeed4b510428721fb90f928333
Opcode Fuzzy Hash: 1159a455dbad7251d075ff1e67427566de69f78144458c78320aff93aa7eef94
Instruction Fuzzy Hash: BD712370A00B058FD725DF29D54475ABBF5FF88304F108A2DD68ADBA50DB35E849CB92

Function 015F590C Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 015F59C9

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 368572f9053432550ece1cd0036d6cf8259ca49e7818ddca25deb9eda50bb05b
Instruction ID: e251f0590f7965c49e36e1500a151cddd5c86dfe28896dbf6e4dc99a1c13e640
Opcode Fuzzy Hash: 368572f9053432550ece1cd0036d6cf8259ca49e7818ddca25deb9eda50bb05b
Instruction Fuzzy Hash: 9A41F1B0C00219CBDB24DFA9C9847DDBBF5BF48304F24809AD508AB255DB755989CF90

Function 015F44F0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 015F59C9

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 18e70e966de3736364c9bf37b174a2e71ae61cba02c72701b4033685d86006a2
Instruction ID: 300b6d63c9a2f8cfa2d462746150ddc70e0f43555a85ee0f976662e942cef9b4
Opcode Fuzzy Hash: 18e70e966de3736364c9bf37b174a2e71ae61cba02c72701b4033685d86006a2
Instruction Fuzzy Hash: 8041F3B0C0071DCBDB24DFA9C984B9DBBF5BF49304F2480AAD508AB255EBB55945CF90

Function 079AE320 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 079AE3B8

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 03a5d25bd315bafd3099a9dc23912e230da3f0cbd4ea1390d17abb3b006e9e05
Instruction ID: f39e00717de339aec325cbd8831bb393a8dfa765aa071f6c009e39349734c77d
Opcode Fuzzy Hash: 03a5d25bd315bafd3099a9dc23912e230da3f0cbd4ea1390d17abb3b006e9e05
Instruction Fuzzy Hash: 8F2168B2900359DFCB10CFAAC885BEEBBF5FF48310F10842AE559A7250C7789544CBA4

Function 079AE328 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 079AE3B8

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7b17712889e763957b92cd632b43010156c69ff5b827e77b95e57fcca54fcd2e
Instruction ID: bbee102091ce1f7e2ed79a983d394455eed6bc1d80605b5550fd39cfdc46dcc1
Opcode Fuzzy Hash: 7b17712889e763957b92cd632b43010156c69ff5b827e77b95e57fcca54fcd2e
Instruction Fuzzy Hash: C82127B19003599FCB10DFAAC985BDEBBF5FF48314F108429E959A7250C7789944CBA4

Function 079AE848 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 079AE8D0

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c12837ec62c4255c70624aa9c0ade88d2ca4f4fe8a277d2278d1cd25c9bedf4e
Instruction ID: 174093a0b5ad7c9a67e9468a1565741b33a1859d3b41f7fbc7ac74dbf2358d1c
Opcode Fuzzy Hash: c12837ec62c4255c70624aa9c0ade88d2ca4f4fe8a277d2278d1cd25c9bedf4e
Instruction Fuzzy Hash: 7B2136B2C003599FCB10DFAAC881ADEBBF5FF48324F10842AE559A7250C7349554CFA5

Function 079AE188 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 079AE20E

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 24767a050cd78fea6ff0b386235876357657b1f5e78a4550f25f60545b48c793
Instruction ID: d995e7004c025ef3c1c56fec7d93c4894a427815035e2e1dae7698ead9d2f8f6
Opcode Fuzzy Hash: 24767a050cd78fea6ff0b386235876357657b1f5e78a4550f25f60545b48c793
Instruction Fuzzy Hash: 592137B19002499FDB10DFAAC485BEEBBF4EF88324F24C429D459A7241CB789945CFA4

Function 079AE190 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 079AE20E

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f36d695e01c613288ccf780d45fb0f07fcb3049df8f6eb14deb0ab91a9e64644
Instruction ID: 006b6f00e34fab2875d257332fed1c1c2fb0a22f0de89661bccb6a3aba67df91
Opcode Fuzzy Hash: f36d695e01c613288ccf780d45fb0f07fcb3049df8f6eb14deb0ab91a9e64644
Instruction Fuzzy Hash: 122129B19003199FDB10DFAAC585BEEBBF4EF48324F148429D559A7240CB78A944CFA5

Function 079AE850 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 079AE8D0

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ec1eb89898bdcf8ccb5b06faf6f41dcea360bef04595ac4f8c95e7d66f332798
Instruction ID: 983f6c5647b23028b5827ad965ae8037e100e169312137323ff1f7acba12cb23
Opcode Fuzzy Hash: ec1eb89898bdcf8ccb5b06faf6f41dcea360bef04595ac4f8c95e7d66f332798
Instruction Fuzzy Hash: 162137B1D003599FCB10DFAAC881AEEFBF5FF48324F10842AE559A7250C7389944DBA4

Function 015FD619 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015FD6A7

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 071f79f513dff7b4a46870400bb4aaf244f4a95b877da38623053f4fd2cf4741
Instruction ID: 5646b60256ddfbd50a52007db7a8af0aa23863f6d4278597cd16455b18f1db02
Opcode Fuzzy Hash: 071f79f513dff7b4a46870400bb4aaf244f4a95b877da38623053f4fd2cf4741
Instruction Fuzzy Hash: 9921E3B59002189FDB10CF9AD584ADEBBF4FB48324F24841AE958B7210C378A940CF64

Function 015FD620 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015FD6A7

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b584f79958e757367f51efd090c87da333cd8dd85ce8b21cb8fe5548d831e33a
Instruction ID: f781790a64ee6b7b213c6acd3cfb0e120de353eac6dda24e622e2282e88d2db5
Opcode Fuzzy Hash: b584f79958e757367f51efd090c87da333cd8dd85ce8b21cb8fe5548d831e33a
Instruction Fuzzy Hash: AA21C4B59002589FDB10CF9AD584ADEBFF8FB48310F24845AE958A7350D374A944CFA5

Function 079AE260 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 079AE2D6

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b94015bb342f82095dad92a2d301b2fe55a3b6d915b89ef688f002ff6b26d964
Instruction ID: eca6936c7dc86ea71935bc10d526d7b3671d3ebadb47331c72da754fe0847cab
Opcode Fuzzy Hash: b94015bb342f82095dad92a2d301b2fe55a3b6d915b89ef688f002ff6b26d964
Instruction Fuzzy Hash: 351159B1900249DFDB10DFAAC845AEEFFF5EF88324F248819E555A7250C7359544CFA0

Function 079AE268 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 079AE2D6

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4927dd590280423dfa86e859983589b7d5e000dd7d461d553fb0f86c171914be
Instruction ID: b1c7618ae6978210bcca0fd4bab8a0815a63353e24b02534b71d83a950a026d1
Opcode Fuzzy Hash: 4927dd590280423dfa86e859983589b7d5e000dd7d461d553fb0f86c171914be
Instruction Fuzzy Hash: 711137B29002499FCB10DFAAC845BDEBFF9EF88324F208819E555A7250C775A544CFA4

Function 079A40B8 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 079A4128

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: d7d4ab0f27933d4bb2383f6fbcd226f7d605efa8c7298e97aee6336026ee7745
Instruction ID: 8e8de9e5b9641610cb56a0409a889fcd9f5c7d91a9f3d6795c1bcb7f81e70f97
Opcode Fuzzy Hash: d7d4ab0f27933d4bb2383f6fbcd226f7d605efa8c7298e97aee6336026ee7745
Instruction Fuzzy Hash: B41132B1C0065A9BCB00CF9AD944B9EFBF8FB58324F20812AD818B3250C774A940CFA5

Function 079AE0D9 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 079AE142

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ef1378c099ebd5b4011d19b9ed350436819c081252e0870b981340ca6aad30e3
Instruction ID: 41e44e040451a4ecf3b91cf7ad1cbf37fecf62a78ec2fb44cd48f1a429ad430e
Opcode Fuzzy Hash: ef1378c099ebd5b4011d19b9ed350436819c081252e0870b981340ca6aad30e3
Instruction Fuzzy Hash: 671158B19002998FDB20DFAAC4457EEFBF4EF88324F248869D459A7250CB35A544CF94

Function 079A40B1 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 079A4128

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: ff85e71f2edc98d74e3b75b187841fe940a4ee285b56d47080475a2ede4a995d
Instruction ID: 739eccc7640fd339b23267914401d44d460f310f11d2d6bcb3125ee1da6f9cdb
Opcode Fuzzy Hash: ff85e71f2edc98d74e3b75b187841fe940a4ee285b56d47080475a2ede4a995d
Instruction Fuzzy Hash: 82114FB2C0025A9BCB04CF9AD945B9EFBB8FB58324F20812AD818B7210D374A540CFA5

Function 079AE0E0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 079AE142

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e5246d4f7cfddc99bdf8b47753cd5cc2b042a158c114f4f720a99244883bc41e
Instruction ID: 29c426339b96645c076d8cf705f63dc2c79dd8542aad18b67062bb6cfb64f075
Opcode Fuzzy Hash: e5246d4f7cfddc99bdf8b47753cd5cc2b042a158c114f4f720a99244883bc41e
Instruction Fuzzy Hash: E61166B19003588FCB20DFAAC4457DEFBF8EB88324F208829D559A7250CB34A944CFA4

Function 015FAF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015FAF9E

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f5440d25201a1426cb12e5c1a66613b7c3e89a23fa795194c82c06de0d45a1bf
Instruction ID: a7679ab0599b94674c084e290c5cfbc5bbd187bfd09e477c00de7c4e44d508c2
Opcode Fuzzy Hash: f5440d25201a1426cb12e5c1a66613b7c3e89a23fa795194c82c06de0d45a1bf
Instruction Fuzzy Hash: 5D1110B6C002498FDB10CF9AC444ADEFBF4BB88324F10846AD929AB250C379A545CFA5

Function 0F701171 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0F7011D5

Memory Dump Source

Source File: 00000000.00000002.1717632405.000000000F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f700000_Remittance Receipt.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ac0b5303e876ed4694157d8a2fcf09dabc65f063cc265655539496bd979bf9dc
Instruction ID: b1c1d8a769aa177fafa1d8e64764f2d032c6d7cba5b868c99378a0188384fb45
Opcode Fuzzy Hash: ac0b5303e876ed4694157d8a2fcf09dabc65f063cc265655539496bd979bf9dc
Instruction Fuzzy Hash: E111F5B6900248DFCB10DF9AD445BDEBFF8EB48324F108459E558A7241C375A544CFA5

Function 0F701178 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0F7011D5

Memory Dump Source

Source File: 00000000.00000002.1717632405.000000000F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0F700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f700000_Remittance Receipt.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 05e38854046fc19ee521c4efc23630b2b20c19d59aee00c9f1c02b7947ee44cb
Instruction ID: 34b18342f7053c547ff1d8798da742584cfd8bea2be702351c456bf3d6022d3c
Opcode Fuzzy Hash: 05e38854046fc19ee521c4efc23630b2b20c19d59aee00c9f1c02b7947ee44cb
Instruction Fuzzy Hash: A51103B5800348DFCB10DF9AD845BDEBBF8EB48324F208459E558A7240C375A944CFA5

Function 0135D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706781963.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_135d000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c780536816bc41141da11d278a1818f180b8ba97a85ca5758953ca56c6c730
Instruction ID: cd2d6142a2312f70337e7fd9903361fbc13a51d92062228ea1789091cef3b67e
Opcode Fuzzy Hash: 63c780536816bc41141da11d278a1818f180b8ba97a85ca5758953ca56c6c730
Instruction Fuzzy Hash: 422145B1100204DFDB05DF48D9C0F66BF69FB88728F20C169ED0A1F256C73AE446CAA2

Function 0136D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706828405.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136d000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e60aaac98bc05f1c4c2646aa585b22e54bdc936f3ba1a6a0bcc7965b9c741ea
Instruction ID: da978cb5a687dc81b0a90118410b493fde5a475328e1c12a1d8d792692a74d65
Opcode Fuzzy Hash: 1e60aaac98bc05f1c4c2646aa585b22e54bdc936f3ba1a6a0bcc7965b9c741ea
Instruction Fuzzy Hash: F9214971604204DFDB01DF98D5C0B26BBA9FB84328F24C56DD8894B35AC376D446CA61

Function 0136D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706828405.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136d000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab44fe2c28a2211e9bb0077d1d60150dcc8e48cd1b21f9143a624fdb1720ed54
Instruction ID: a1c59ffb96c9b1cc01344cbb5ac3649d9b57e289a5145608920634a287bdf2d9
Opcode Fuzzy Hash: ab44fe2c28a2211e9bb0077d1d60150dcc8e48cd1b21f9143a624fdb1720ed54
Instruction Fuzzy Hash: 46212271604204DFCB15DF58D984B26BFA9FB88318F20C56DE88A4B25AC33BD447CAA1

Function 0135D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706781963.000000000135D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0135D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_135d000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 1dcfb9f5729b20969fb1ea3f1911263b4be37f0c1e20086751f3fa9d6f8b5a18
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 8E11DFB2404240CFDB06CF44D5C4B56BF72FB94328F24C2A9DD090B256C33AE45ACBA1

Function 0136D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706828405.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136d000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 22fdd415041c999ff4073b269bc957c6c2b1eba0636b8b5d13b1634b6085226f
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 2D118E75604280DFDB16CF54D5C4B15BF71FB84318F24C6AAD8494B65AC33AD44ACB61

Function 0136D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706828405.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136d000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 9c0f1c3b6504844234759444ca9969704fd856f00bfd715c5c213d26a92da93b
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 32118B75604280DFDB16CF54D5C4B15BFB1FB84228F28C6AAD8894B69AC33AD44ACB61

Non-executed Functions

Function 07216578 Relevance: 3.9, Strings: 3, Instructions: 168COMMON

Download Yara Rule

Strings

2, xrefs: 0721675E
U, xrefs: 072166A0
c, xrefs: 072166B3

Memory Dump Source

Source File: 00000000.00000002.1713075970.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7210000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: 2$U$c
API String ID: 0-2109151629
Opcode ID: 28bbb2cac7ef02e26aa280203a37c8e6d1af69b24e932d57c3593dc8f4355566
Instruction ID: 07938af2da4c912c24f17df0946d9f57f99e356076d7f162fdfea8599533afd8
Opcode Fuzzy Hash: 28bbb2cac7ef02e26aa280203a37c8e6d1af69b24e932d57c3593dc8f4355566
Instruction Fuzzy Hash: 6F71F9B1E115099FDB04DFAAC580AAEFBF2FF98300F28D169D414A7245D734AA81CF94

Function 07216310 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

{, xrefs: 07216487

Memory Dump Source

Source File: 00000000.00000002.1713075970.0000000007210000.00000040.00000800.00020000.00000000.sdmp, Offset: 07210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7210000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-366298937
Opcode ID: 4fda9a63cd7811d3e28d85235b312d555534cb5a1cb33e0b58352352a30e7f3a
Instruction ID: 09943e07189a9b820429642cbc97b282583c79eef6c1da6ac8732db42e0bca0b
Opcode Fuzzy Hash: 4fda9a63cd7811d3e28d85235b312d555534cb5a1cb33e0b58352352a30e7f3a
Instruction Fuzzy Hash: 835127B1E1060A9BDB14CFAAC8806EEFBF6BF98300F18D165D514E7255DB349A81CB94

Function 079A2578 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fc27035bb166d8736096acf73d9567ef47818bed90024b5d2a896bcd4baaf5
Instruction ID: 02ccc19734b59052d581a8db438aca163c3fd9d7ac97f50e466b3df3bf58d693
Opcode Fuzzy Hash: 50fc27035bb166d8736096acf73d9567ef47818bed90024b5d2a896bcd4baaf5
Instruction Fuzzy Hash: 3BE1D7B4E051199FCB14DFA9C5809AEFBB2FF89304F248169E414AB356DB34AD41CFA1

Function 079AC4F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c387285e149101779de2b6500fb421e16e3e71ff7fbca79526c43c1a945ef6
Instruction ID: 15a19861fc65bbf18f38215638eba973c668d1ec57906452967e1fd6486181a5
Opcode Fuzzy Hash: d6c387285e149101779de2b6500fb421e16e3e71ff7fbca79526c43c1a945ef6
Instruction Fuzzy Hash: F6E1E7B4E015199FCB14CFA9C5809AEBBF2FF89304F248169E814AB356D734AD41CFA1

Function 079AE418 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a66dace272a589f57c92c838504d4dd2c946b5fc11b7188e433bef6daf0b6b
Instruction ID: bda117fae43d33e1e5ea9cea86705f28e46a8a98f75b015832d827ce5ea9e3c8
Opcode Fuzzy Hash: d8a66dace272a589f57c92c838504d4dd2c946b5fc11b7188e433bef6daf0b6b
Instruction Fuzzy Hash: 26E1E7B4E011199FCB14CFA9C5819AEBBF2FF89304F248169E814AB356D734AD41CFA1

Function 079A20B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470d33b260e5bd40cf8a3fe835d7f948226d2e4823d033a9f8f28f67c775e4e1
Instruction ID: 26c3356fe34495b7d47a13bf0080616457b2cff98004ad792026223d6ff0feab
Opcode Fuzzy Hash: 470d33b260e5bd40cf8a3fe835d7f948226d2e4823d033a9f8f28f67c775e4e1
Instruction Fuzzy Hash: 8EE1C8B4E011199FCB14DFA9C5809AEBBF2FF89304F248169E814AB355D734AD41CFA1

Function 079AC0B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d981f2cb74ab5ad52fd73238496c3f988b368e078111910cb8abee6354ae21a3
Instruction ID: 43a0824ac24d837dd126f39869f2f7c84d24ccfdedded0967253c9937ca93fa0
Opcode Fuzzy Hash: d981f2cb74ab5ad52fd73238496c3f988b368e078111910cb8abee6354ae21a3
Instruction Fuzzy Hash: 6BE1D9B4E011199FCB14DFA9C5809AEBBF2FF89305F248169D814AB356DB34AD41CFA1

Function 079A2E28 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c986b20ac3692b2b86980ab42963cf3d6215672ca43352c1f2e61bf36229e78c
Instruction ID: 19e708c76bbd34cb9f2da1b5b5fb5d0193b6234f3d9277a734d6c9d8be7322c7
Opcode Fuzzy Hash: c986b20ac3692b2b86980ab42963cf3d6215672ca43352c1f2e61bf36229e78c
Instruction Fuzzy Hash: E9E1C8B4E0111A9FCB14CFA9C5809AEFBB2FF89304F24C169E814AB355D735A941CFA0

Function 079ABC80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5268260552b55eac431fad1dcbd41ead57f58974323147a95a0978a943802698
Instruction ID: 97441eb0f02ea7e035cb56b906b36d015bbc962aa979ee4c07e8ec6c2b3b23ed
Opcode Fuzzy Hash: 5268260552b55eac431fad1dcbd41ead57f58974323147a95a0978a943802698
Instruction Fuzzy Hash: 54E1D7B4E011199FCB14DFA9C5809AEFBF2FF89304F248169E814AB356D735A941CFA1

Function 079A1C80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da212cabe0fc1a9523dc0cf020412b62b2cc62f00d4da340c0d2453577dafd7
Instruction ID: 8c17657d580228a4ef6701f54cfbdd89ccdf99bd7cdc331cbe019e485f11bbb7
Opcode Fuzzy Hash: 0da212cabe0fc1a9523dc0cf020412b62b2cc62f00d4da340c0d2453577dafd7
Instruction Fuzzy Hash: 36E1E6B4E0111A9FCB14CFA9C5809AEFBB2FF89304F248169E415AB356D735AD41CFA0

Function 079AB848 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c46476d2b4867432fca06c68695c36842fedb0cbb1359d7016d57156f8c466
Instruction ID: c6154aa99e3d98fabfabe95d9f12c2977c92fdca44fa9d17c360019a0bb3d5b7
Opcode Fuzzy Hash: d3c46476d2b4867432fca06c68695c36842fedb0cbb1359d7016d57156f8c466
Instruction Fuzzy Hash: 10E1D9B4E012199FCB14CFA9C5809AEBBF2FF89304F248169D815AB355D735AD41CFA1

Function 015FD304 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707329637.00000000015F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1a0d4082b48946e4da31beeeae88701e6de677e2dacc31ec41f8a93300b1c3
Instruction ID: 2da76fa9fd7537fa9765c3b06cad7317cf456291dda89387a948a99bf10e271d
Opcode Fuzzy Hash: da1a0d4082b48946e4da31beeeae88701e6de677e2dacc31ec41f8a93300b1c3
Instruction Fuzzy Hash: A5A16E36E006068FCF15DFB4C88499EBBB6FF84300B15456EEA06AF265DB71E916CB40

Function 079A52B0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6ebf9381b3c0e6097aaa6e817b8b54f925fe5f381f208f3b3397df33cb51dd
Instruction ID: d03309cb6d3d6df9d5811c0a7e3d063da562a783b283705ed9934e1ff01601ed
Opcode Fuzzy Hash: 0b6ebf9381b3c0e6097aaa6e817b8b54f925fe5f381f208f3b3397df33cb51dd
Instruction Fuzzy Hash: B07192B4E012199FCB04DFAAC58499EFBF2BF88301F15D169E818AB315DB34A942CF50

Function 079AB822 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9c0f6a0afa7962599da91707d2277601961a395721a0a9258480c6a3f9aad7
Instruction ID: 1e1ebc3afacdbabed21f491ec52dc335a93f523aff719c567fd0c7f32e52a438
Opcode Fuzzy Hash: 5a9c0f6a0afa7962599da91707d2277601961a395721a0a9258480c6a3f9aad7
Instruction Fuzzy Hash: E6512CB4E052198FCB14CFA9C5409AEBBF2FF89308F14C1AAD418AB356D7349941CFA1

Function 079AC4E1 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5e0c898303c869bc846882b4f614933f12bac9b998690d4a213298af948dd4
Instruction ID: a4935244c8c76252b561a4961ebbd7bcc6746cc45285ad5faeb0af9f935cd356
Opcode Fuzzy Hash: ee5e0c898303c869bc846882b4f614933f12bac9b998690d4a213298af948dd4
Instruction Fuzzy Hash: F251FBB4E0161A8FCB15CFA9C5405AEBBF2EF89304F14C1A9D418AB256D7349D41CFA1

Function 079AE409 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6219f372470237cce91f17e256f3a2a04c3faff025fb93bfd512c399dadd37b
Instruction ID: cd514ac44de9de43879bfbc0cba5d5e4d9043c12948c740a76b5aa2290dc354e
Opcode Fuzzy Hash: e6219f372470237cce91f17e256f3a2a04c3faff025fb93bfd512c399dadd37b
Instruction Fuzzy Hash: E2512AB4E0121A8FCB14CFA9D5815AEFBF2FF89304F24C1A9D418AB256D7349941CFA1

Function 079A52A2 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a8f42215bc0236c2e5b784cb07cee44ee642f0c117271d71645d6377554f37
Instruction ID: aebcbc814e2c3f1540e048cc357faefc978e4cbe3c76a529b64f1b54463fe7b2
Opcode Fuzzy Hash: 59a8f42215bc0236c2e5b784cb07cee44ee642f0c117271d71645d6377554f37
Instruction Fuzzy Hash: 095193B5E016598FDB08CFAAD98469EFBF2BF88301F14C06AD818AB355DB705946CF40

Function 079A1C70 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714682053.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79a0000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d041e4bbdef6e01d377e479cccc01b560b439115b951addb3b3c94607a2617a
Instruction ID: 9ecb2b12e5c038d35b0dbe19d9bb688ffa7d9bc15ea5f9ffb31b92fbe79325a5
Opcode Fuzzy Hash: 7d041e4bbdef6e01d377e479cccc01b560b439115b951addb3b3c94607a2617a
Instruction Fuzzy Hash: 6E51EBB4E052198FCB14CFA9C5805AEFBB6FF89304F24C1AAD418AB356D7359941CFA1

Analysis Process: Remittance Receipt.exePID: 7468, Parent PID: 7252COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 06552420 Relevance: 9.0, Strings: 6, Instructions: 1484COMMON

Download Yara Rule

Strings

$kq, xrefs: 06553850
$kq, xrefs: 06553820
$kq, xrefs: 065537F7
$kq, xrefs: 06553803
$kq, xrefs: 0655382C
$kq, xrefs: 06553844

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 0f846622fef2055e6197b21f23faa45a0542d823e89931b06e0d56a56ec3e55c
Instruction ID: ab336fe83312e7f7664f18295ce65adcc771c42798de7be87cd5ed66dff3588e
Opcode Fuzzy Hash: 0f846622fef2055e6197b21f23faa45a0542d823e89931b06e0d56a56ec3e55c
Instruction Fuzzy Hash: 1AD23930E102058FCB64DF64C598A9DB7F2FF85310F5589AAD809AB265EB34ED85CF90

Function 0655B2C8 Relevance: 8.3, Strings: 6, Instructions: 765COMMON

Download Yara Rule

Strings

$kq, xrefs: 0655BC39
$kq, xrefs: 0655BCA1
$kq, xrefs: 0655BCAD
$kq, xrefs: 0655BC6D
$kq, xrefs: 0655BC45
$kq, xrefs: 0655BC79

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 6c90ab0860c665d5dd8bebabfe6823660259eb35baad5288109ffcf6013ad099
Instruction ID: 964d7d5a78c59d7a4aba3ab2e8272ffbbda9a87cdee40dd5e74914d552b77de0
Opcode Fuzzy Hash: 6c90ab0860c665d5dd8bebabfe6823660259eb35baad5288109ffcf6013ad099
Instruction Fuzzy Hash: 3B528130E102098FDF64DB58D5B87AEB7B6FB85310F218826E805EB395DA34DC85CB91

Function 06557E08 Relevance: 3.0, Strings: 2, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06558145
$kq, xrefs: 06558151

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 1170bf221899db732d0a0f94fed6a7de351f739ddbe45829a5d72de0c4e832bc
Instruction ID: 2679c71d662c1a75ea1e2e350165ad8e0bbfbdcd1302b0a004d476cf4964b8b8
Opcode Fuzzy Hash: 1170bf221899db732d0a0f94fed6a7de351f739ddbe45829a5d72de0c4e832bc
Instruction Fuzzy Hash: 1402CF30B002158FDB54DF65D9A866EB7E2FF84300F15856AE805DB3A9DB35EC86CB90

Function 06555630 Relevance: 1.8, Strings: 1, Instructions: 597
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 065559E7

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: c9b7bc7d47eaa5818a6becbd038e7a26f118367af4860387b6f5b44a1bc49660
Instruction ID: 71cd6b52672e3ad35723b7c2a94608433f55bd4a2036924f5b58845d7a47cada
Opcode Fuzzy Hash: c9b7bc7d47eaa5818a6becbd038e7a26f118367af4860387b6f5b44a1bc49660
Instruction Fuzzy Hash: 7A22D571E102058FDF60DBA4C5946AEBBF2FF84320F25846AD805AB355EB35ED41CB91

Function 06556678 Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4eb35b9935d9ba20c0dedf1785637ea1ba19c16d94f8fd2585228b829edfa61
Instruction ID: d3f3c8149b8249b35fdc53d053dfdd54204fd08f05e77df438750b553936f067
Opcode Fuzzy Hash: b4eb35b9935d9ba20c0dedf1785637ea1ba19c16d94f8fd2585228b829edfa61
Instruction Fuzzy Hash: 8A629E34E002058FDB64DB68D568AADB7F2FF88310F55846AE806DB3A5DB35EC45CB90

Function 0655C220 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237aa44f377a0528774a5a3215e2bb3a431e7c151e42a9744a574e2cebf97c98
Instruction ID: 60a9cceda77d6d05bbb5fee7c2a5192a3ac5095e0f73b9e9426b0577b9507b69
Opcode Fuzzy Hash: 237aa44f377a0528774a5a3215e2bb3a431e7c151e42a9744a574e2cebf97c98
Instruction Fuzzy Hash: FD328034B102098FDB54DF68D994BAEB7B2FB88310F15852AE806EB355DB35EC45CB90

Function 0655AD60 Relevance: 10.4, Strings: 8, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 0655AF38
$kq, xrefs: 0655AF0F
$kq, xrefs: 0655AE8D
$kq, xrefs: 0655AF03
$kq, xrefs: 0655AE81
$kq, xrefs: 0655AED4
$kq, xrefs: 0655AEE0
$kq, xrefs: 0655AF2C

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: a50fa766fc0837ead692067eaf036d7818b6e26cfaaf887ebf3338527b0fab3f
Instruction ID: bb7c7eb455c42dfbad73a00a461d82913a6e864630c6ab91c8c22d0e45085562
Opcode Fuzzy Hash: a50fa766fc0837ead692067eaf036d7818b6e26cfaaf887ebf3338527b0fab3f
Instruction Fuzzy Hash: 8DE17130E1020A8FCF65DF69D9686AEB7F2FF85300F118A2AD815AB355DB35D845CB90

Function 065591D8 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 0655921F
$kq, xrefs: 06559266
$kq, xrefs: 0655922B
$kq, xrefs: 0655925A

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 1e0a5eb04ccc8f04541b54d997ff13a94e186df67868586d5daf7a284f05a78a
Instruction ID: 4530c93a5acd80bebf060c5a440d25fd081a75f7446b0f8a721fa3d13df3cf62
Opcode Fuzzy Hash: 1e0a5eb04ccc8f04541b54d997ff13a94e186df67868586d5daf7a284f05a78a
Instruction Fuzzy Hash: 05915230F1025A8FDB64DF65D9647AEB7F6BFC8240F10846AD8099B398EB74DC418B90

Function 0655CFE8 Relevance: 4.6, Strings: 3, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 0655D3DF
$kq, xrefs: 0655D3E7
$kq, xrefs: 0655D3F3

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq
API String ID: 0-2086306503
Opcode ID: a87433124d7f2fab8fc579876aba8b2cbb2da3e323deea098f6daf950bd874e2
Instruction ID: e20aaf8a74870493a792f7822da6a20e2e4836a1317a6b0e402b83473062e6aa
Opcode Fuzzy Hash: a87433124d7f2fab8fc579876aba8b2cbb2da3e323deea098f6daf950bd874e2
Instruction Fuzzy Hash: 81623F30A006058FCB65EF68D594A5EB7F2FF84300F218A69D4059F369DB75ED86CB84

Function 06554C08 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPpq, xrefs: 06554D59
\Opq, xrefs: 06554DE3
fpq, xrefs: 06554C33

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: fpq$XPpq$\Opq
API String ID: 0-2571271785
Opcode ID: 499b8e2de7447267ac46cfdc8731ec674d38e79d14678adee0ef66ea9c2ea755
Instruction ID: 2d57e46d3533b5f8ae467a420b40ba9deb1fb1dcb2a0e74002256cc8b32a954b
Opcode Fuzzy Hash: 499b8e2de7447267ac46cfdc8731ec674d38e79d14678adee0ef66ea9c2ea755
Instruction Fuzzy Hash: 9D619431F102089FEB549FA4C8587AEBBF6FF88700F21842AE505AB395DE758C458F91

Function 065591CA Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 0655921F
$kq, xrefs: 0655925A

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 2c0e05e966525c78f4a7a51d1069dce6ecaeedb6ba8596d842ca8948106d22b0
Instruction ID: ed369e9ea1d42e6a5d6ed6aafae90ab34655dab14965b2510530b1952e11a148
Opcode Fuzzy Hash: 2c0e05e966525c78f4a7a51d1069dce6ecaeedb6ba8596d842ca8948106d22b0
Instruction Fuzzy Hash: C0513070B001058FDF54EB75D9A0BAE77F6BFC8650F50846AD90ADB398EA34EC118B90

Function 06554BF8 Relevance: 2.6, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPpq, xrefs: 06554D59
fpq, xrefs: 06554C33

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: fpq$XPpq
API String ID: 0-1280283
Opcode ID: 6a0bff4085843ef1969388f9a3d947b2ef3745590cf6706b390df8357c1ae96d
Instruction ID: c900e96c082298a38a4728f4787e510bf55111f6c018f2c842cd43b620168c4b
Opcode Fuzzy Hash: 6a0bff4085843ef1969388f9a3d947b2ef3745590cf6706b390df8357c1ae96d
Instruction Fuzzy Hash: 6B519170F102089FDB54DFA4C514BAEBBF6BF88700F20852AE506AB3D5DE748C448B90

Function 00DAEC15 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00DAEBBA), ref: 00DAECA7

Memory Dump Source

Source File: 00000003.00000002.2938648329.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_da0000_Remittance Receipt.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c6e81e86aedd8524f2dbb868fa62acd3552787b2f6ec01e3c528a606eae8f145
Instruction ID: b80bfd5305a63fab7bb3f4daa8930873f57299b51174f6387657f7c291bb1cd8
Opcode Fuzzy Hash: c6e81e86aedd8524f2dbb868fa62acd3552787b2f6ec01e3c528a606eae8f145
Instruction Fuzzy Hash: 062177B1C002599FCB10DFAAD5447EEFBF4AF08320F14842AD918A7650D338A984CFA4

Function 00DAE758 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00DAEBBA), ref: 00DAECA7

Memory Dump Source

Source File: 00000003.00000002.2938648329.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_da0000_Remittance Receipt.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 9e041d5478ff8aba39d77c9ac7e26572554b05d9c48cbeaa057d285b364a6e5d
Instruction ID: c564c3e0d5f2a3c6dd1bb1b5a650e81726bca48922608e2e3c17699d9ae94f23
Opcode Fuzzy Hash: 9e041d5478ff8aba39d77c9ac7e26572554b05d9c48cbeaa057d285b364a6e5d
Instruction Fuzzy Hash: 041112B1C006599BCB10DF9AC545BDEFBF4EB49320F14816AE918B7240D378A944CFE5

Function 0655DB70 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0655DCB9

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 947f13d02e1b842118b508972fc1a3260705eabfffbb6693ab92da93c45d0aa4
Instruction ID: 5e709b8b795f9008c3927562d95e6a89df4c4f2204b3da9ff9a3edd800d78a55
Opcode Fuzzy Hash: 947f13d02e1b842118b508972fc1a3260705eabfffbb6693ab92da93c45d0aa4
Instruction Fuzzy Hash: E7419E31E102099FDB64EF65C59869EBBB6BF85340F21462AE805EB254EB70D846CF84

Function 0655DB5D Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0655DCB9

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 773c22c8ffbfa545fa1c3608fc58e8cd0aec686c9f8a459e2144bb84bad77247
Instruction ID: 1e6c84c1189fd3652662f6898d90e6571b16c60ae8a4ec9fed61e7ca75c35e89
Opcode Fuzzy Hash: 773c22c8ffbfa545fa1c3608fc58e8cd0aec686c9f8a459e2144bb84bad77247
Instruction Fuzzy Hash: 8241B131E106099FDB65DF64C59869EBBB2FF85300F15862AE805EB250EB70E846CF84

Function 06552285 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PHkq, xrefs: 065523D3

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 3f16ddc19e001d20bb17af12deb6183982caa76b7f3381a291cf1a7955226042
Instruction ID: a0b9d4fb221c0ad9647d8da8b62c177e84e7a5191e540310ed35fe5d3ea66f22
Opcode Fuzzy Hash: 3f16ddc19e001d20bb17af12deb6183982caa76b7f3381a291cf1a7955226042
Instruction Fuzzy Hash: 75310431B102058FDB55AB34C96836F7BE6BB89200F25847AD806DB395EF34DE46CB90

Function 06552298 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHkq, xrefs: 065523D3

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: f96c0dc5bb305c396b29a5e4810390a5820610333b0b3f7a177fbd0a72033db0
Instruction ID: aed661b91a2524527eca4135804e62057bdc9851f0ee7e9ebd92d32de116bd8d
Opcode Fuzzy Hash: f96c0dc5bb305c396b29a5e4810390a5820610333b0b3f7a177fbd0a72033db0
Instruction Fuzzy Hash: 02310231B102058FDB54AB34C96876F7BE6BBC9200F25846AD806DB3A5EF35DD46CB90

Function 0655B2BA Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be18f64921594790f51bb35ac1b197302af0fcf3dcf6abeaa852809da756094a
Instruction ID: 876afc4e1324f49284b940934672c2ba0e1f55243f6f27021c655d4800a6edb7
Opcode Fuzzy Hash: be18f64921594790f51bb35ac1b197302af0fcf3dcf6abeaa852809da756094a
Instruction Fuzzy Hash: CEA16430F102098FDF64DB98D5BC7AE77A6FB89310F254826E805EB395DA35DC818B51

Function 06556270 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bfa8df6ba4150d659ee87d60044ef5073d8c96bbdc19d306e25b7a9627d30fc
Instruction ID: bfa466c11c1655a46b5a58392c7de0bcc029af9cd94d6b963d1fef65507587bb
Opcode Fuzzy Hash: 1bfa8df6ba4150d659ee87d60044ef5073d8c96bbdc19d306e25b7a9627d30fc
Instruction Fuzzy Hash: 8D61E3B2F001114FCF519A7DCC9466EBADBAFD4620B56443AE80ADB379DEA5DC0287C1

Function 06554339 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8844bf1c6d49eee3ffe6ddc9c4b8c4de802e97f3b1fa72819a86239771fa9775
Instruction ID: 02b6f17da5cc4c6329603b84cfe04e22280a284d8c9aa141059d009dc4f3d7c1
Opcode Fuzzy Hash: 8844bf1c6d49eee3ffe6ddc9c4b8c4de802e97f3b1fa72819a86239771fa9775
Instruction Fuzzy Hash: 7D814E30B002058FDF54DFA8D5647AEB7F6BF85310F118826D80ADB399EA74EC858B91

Function 06554658 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7859b358ed02fbd2752d3ce309aef78b9e9709118ae42a3ad17cfd276c5cb501
Instruction ID: 1b39dda0af645e140be10f14dbbc470114700584bdf0d7b8d9e1beb43b500d61
Opcode Fuzzy Hash: 7859b358ed02fbd2752d3ce309aef78b9e9709118ae42a3ad17cfd276c5cb501
Instruction Fuzzy Hash: 6C913B30E102198FDF60DF68C890B9DB7B1FF89310F21859AD549AB395DB70AA85CF91

Function 06554670 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774424107e43cb674de35cc2e57e28ca01bf153d945d3527e6662950e653eae3
Instruction ID: 4a09616c29383c4097b5acf5588cc03ec4e487f67e8d2d590680fa4c1cc7e7f8
Opcode Fuzzy Hash: 774424107e43cb674de35cc2e57e28ca01bf153d945d3527e6662950e653eae3
Instruction Fuzzy Hash: FE913B30E106198BDF60DF68C890B9DB7B1FF89310F20859AD549BB395DB70AA85CF91

Function 0655EBB0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a846f468421e2e7a2a0964045ab328e6b15af50f050a1fe13e3fd221585d60e
Instruction ID: 0a0d87449603d2d400159493429d917a3e01dfb17e3ee41641f5a3a7ad84f15c
Opcode Fuzzy Hash: 3a846f468421e2e7a2a0964045ab328e6b15af50f050a1fe13e3fd221585d60e
Instruction Fuzzy Hash: 26813A70A002099FCB54DFA8D995A9DBBF6FF88300F25856AD409EB355DB30ED46CB50

Function 0655EBC0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3162bfc72bddf86fb8bd983cbf5994a027003b538a735db4e197883a9ad2c39f
Instruction ID: ede0d1288039ccdece871c976cb0d712ab3553af1dded5469fbb61aecb118ef1
Opcode Fuzzy Hash: 3162bfc72bddf86fb8bd983cbf5994a027003b538a735db4e197883a9ad2c39f
Instruction Fuzzy Hash: 56712970A002099FCB54EFA8D995A9DBBF6FF88300F25856AE405EB355DB30ED46CB50

Function 0655FAD2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4447398a8ae284bf6a217ee20db38d3f11b843de548fd72f278917f55a33ce95
Instruction ID: 0164cdcfe73cd6ab472ff028f75e0c7c49defd978f4b6f18bcdcf8e9cd85bb67
Opcode Fuzzy Hash: 4447398a8ae284bf6a217ee20db38d3f11b843de548fd72f278917f55a33ce95
Instruction Fuzzy Hash: 5A51B730B142149FEF70666CD96876F3A9AE789710F214437E80AD77E9CA29CC454BA2

Function 0655FD30 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afc984affd472d53c31d05eb89341f03f2bd8da1b11397d3622135ba3c41f5f
Instruction ID: 0e4d423270d58800551e4b84ef4e3c9ea74ee3202e2b8365f3c9456a339ab610
Opcode Fuzzy Hash: 4afc984affd472d53c31d05eb89341f03f2bd8da1b11397d3622135ba3c41f5f
Instruction Fuzzy Hash: DD51E031E01105DFDF64AB78E8686AEBBB2FF85310F11886AE506D7251DF319855CF80

Function 0655FAE0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f93a18dc0dd7efad3398ce4b4ce2166a9341ce33c749f3a13fdaa041e40997c
Instruction ID: f30d52de58b49a6a72bfcc0fda52982e337e2644cad4b5caf466d9783471ee1a
Opcode Fuzzy Hash: 1f93a18dc0dd7efad3398ce4b4ce2166a9341ce33c749f3a13fdaa041e40997c
Instruction Fuzzy Hash: 8351A630B14204DFEF64766CD96876F269EE789710F214837E90AD73E8CA69CC454BA1

Function 065554C0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e588791c1f47f1157fe2fb8b8ea658af66f91a964013656d0aa9943d69e97a96
Instruction ID: 79f2d5b184434ad62137260e1beb860217eaefcbfe1bde7df79b2770f0968fa5
Opcode Fuzzy Hash: e588791c1f47f1157fe2fb8b8ea658af66f91a964013656d0aa9943d69e97a96
Instruction Fuzzy Hash: 19414971E006098BDB70CEA9C894AAFFBF2FB84310F11492AE556D7650E730E9498F91

Function 06552148 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6aca670f1ef26867b935959bb7bd135ca40bd7e0be768d39f166fcc8f9c0d7
Instruction ID: 301f5854ef4bb0cc1152fe42b5228312ccf868013ee559bb7e3bb80c448e9045
Opcode Fuzzy Hash: cf6aca670f1ef26867b935959bb7bd135ca40bd7e0be768d39f166fcc8f9c0d7
Instruction Fuzzy Hash: FC31B235E102058FCB19CFA4D96469EB7F2BF89300F11892AE805EB354DB31E942CF50

Function 06555620 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ef87e5991d8a90a3636c7f4be0d0fd6b428643d76513eb83f95aebe348d461
Instruction ID: 40c9e58a554bd35bc6116234142f3602de3b4ac0bd7037e77f23c04973cbc24d
Opcode Fuzzy Hash: d7ef87e5991d8a90a3636c7f4be0d0fd6b428643d76513eb83f95aebe348d461
Instruction Fuzzy Hash: 78318F31E102058FDB60DEA9C4956AFFBB1FB45210F21882BD915D7291E634D9418F91

Function 06552158 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24a4d93a0fd312455448fdbd7597451ae6e126968ea0ee7a6f6efca1e1c4b0a
Instruction ID: 8c74b9d69758a39d144c89496bdc54d9c6b81955968f26a9c00064da0aae3eea
Opcode Fuzzy Hash: a24a4d93a0fd312455448fdbd7597451ae6e126968ea0ee7a6f6efca1e1c4b0a
Instruction Fuzzy Hash: 66316F35E106098BCB19CFA4D85569EB7F2BF89300F11892AE806EB354DB71AD46CB60

Function 06553B38 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26cbadef451af9a713e41bfaa93af55c69e883960b5523a91c96a6e54853b372
Instruction ID: 644a0f48caa5935c7b2467fe1e440a08a700b267d1ffc1705391a143163b1216
Opcode Fuzzy Hash: 26cbadef451af9a713e41bfaa93af55c69e883960b5523a91c96a6e54853b372
Instruction Fuzzy Hash: F4218B71E006159FDB40DFA9E991AAEBBF1BB88750F108826E905EB395E770D840CB90

Function 06553B48 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84948377f3b995faf4fefa95e7e15300854b3df3e9bdcec910d79fe0d38989a
Instruction ID: 88625098727b1ff2de78570a10d8b22f25fecabf527e97931407db0fe50c06ef
Opcode Fuzzy Hash: c84948377f3b995faf4fefa95e7e15300854b3df3e9bdcec910d79fe0d38989a
Instruction Fuzzy Hash: D3216B75E006159FDB50DFA9D990AAEBBF1BB88650F10842AE905EB355E730D840CB94

Function 00B1D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2937444153.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b1d000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9729f268c0467c56d66a669a9de6a502b934482c0aeb7efdba9dc43be80b25c9
Instruction ID: 494f49c7696e9e8af01bac1f1ab4dd8718a81767708ee0685bc1b5ce0c1b913d
Opcode Fuzzy Hash: 9729f268c0467c56d66a669a9de6a502b934482c0aeb7efdba9dc43be80b25c9
Instruction Fuzzy Hash: 7C210471504204EFCB14DF24C9D8B66BBA5FB88314F60C6ADE8494B256C73AD886CA61

Function 065530F8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd9fbd9d1a237d55ca4550b0a8612a3a991b19adcb23aa965729bf10cbfb287
Instruction ID: ac9286e7ded3e8b18fa41e3e435a9e282d9b506c7421c0cfaa421b5cdb1f8186
Opcode Fuzzy Hash: 2dd9fbd9d1a237d55ca4550b0a8612a3a991b19adcb23aa965729bf10cbfb287
Instruction Fuzzy Hash: 0711B171E002185BCB68DB78D8541DEF7B5FB89350F11897AD40AEB204EA319944CBE0

Function 06553C58 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8354ddf25ddbf2c3a9ed74c618ba0c90ab1f3fe44edb48bcaa4926d8f258bdb7
Instruction ID: c3173947bfd53ddee7628543266713a55a3d0fe373d550891eef8d9592287e0c
Opcode Fuzzy Hash: 8354ddf25ddbf2c3a9ed74c618ba0c90ab1f3fe44edb48bcaa4926d8f258bdb7
Instruction Fuzzy Hash: 8111A532B105254BCF549679D8186AE77AABBC8690F01453AD80AE7358FE65DC018BD0

Function 0655429A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89382e67a60c6c78dc00cc30acc80d292a84f3d76659834718e3f238f17457b
Instruction ID: 250ff014ddbe0d0577d3e3db0cdbb1737b5b9d81940abb92e4d5c743ac7b878a
Opcode Fuzzy Hash: f89382e67a60c6c78dc00cc30acc80d292a84f3d76659834718e3f238f17457b
Instruction Fuzzy Hash: 5401BC31B040200BDB6096ADE86976BB3CAEBCA760F15843AE40AC7395EDA1CC824790

Function 0655EE31 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430d1f933ba721185b81d39633994d131b6df645c48c984e6281588c7f74f53d
Instruction ID: 19e1f1422a7bb53269d034a56209eff1e787ba64368fcb211f6ad6e90da4bde3
Opcode Fuzzy Hash: 430d1f933ba721185b81d39633994d131b6df645c48c984e6281588c7f74f53d
Instruction Fuzzy Hash: CF01D2317105010FDB259A3C9465B2BB7D6EBC6720F05882AE80ACB380E921ED068791

Function 06553C48 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec305b840420e508ffa8b354b17b960e78ca55f59e13663f50e30891835a969b
Instruction ID: 640df36a403049a16bdfd30b84eee2efde62f7eb9d4c7a39253dbe64103246fd
Opcode Fuzzy Hash: ec305b840420e508ffa8b354b17b960e78ca55f59e13663f50e30891835a969b
Instruction Fuzzy Hash: BD01B132B100244BCF5896B9D8686EB76AAAFC4690F01053BD80AD7264FF65DC018BE1

Function 00B1D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2937444153.0000000000B1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b1d000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 8890d343d7717ab2e47ea151638692cd15020b59a883973f3c46aaeb473bc0f3
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7411DD75504284DFCB11CF24C9C4B56BFA2FB88314F24C6AED8494B252C33AD89ACF62

Function 06553910 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6b110d8ec3a0e4fab7d9c3aa4174c81b34750621bd0cc595b7899cc031a781
Instruction ID: 29b5c18ee9ed17ceffc451d4f366e44c7e645b472f5f50230bc58a30e45e8830
Opcode Fuzzy Hash: db6b110d8ec3a0e4fab7d9c3aa4174c81b34750621bd0cc595b7899cc031a781
Instruction Fuzzy Hash: D421C2B5D012199FCB10CF99D988ADEFBF4BB08314F10812AE918A7740D375A954CFA5

Function 0655A398 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cff0b15a2ecf2d84f29774367750c5e729023da296fbd68aac858cdb521417
Instruction ID: ff30b7cabdfdfcbc491f9234fa019663c49d3efd6bcfe5faef4b3091d8a6fa13
Opcode Fuzzy Hash: 98cff0b15a2ecf2d84f29774367750c5e729023da296fbd68aac858cdb521417
Instruction Fuzzy Hash: 7A01DF35B141104FC7B0AA7CE46976EB7E5EB85764F11883AE50ACB394FE22DD018790

Function 06553918 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7c83028680e6f3d5fa4a1e63aa13b4c3cf3609533dbf49200b2898352de817
Instruction ID: e26416881ca4f449aa68d6d594603b8170d4b339a1adb34ef33f21a67a65622c
Opcode Fuzzy Hash: 9b7c83028680e6f3d5fa4a1e63aa13b4c3cf3609533dbf49200b2898352de817
Instruction Fuzzy Hash: B911D3B1D012199FCB00CF9AD884ADEFBF4FB48314F10812AE918A7300D375A954CFA5

Function 065542A8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12565195a5ec72c68788cdfc29d60072b26fdb584b552eb418464fe108a5488
Instruction ID: 1075cced60d0fc3f2ee197a06a993a42ac1c3931fab9079e51cdffd6e74124e8
Opcode Fuzzy Hash: f12565195a5ec72c68788cdfc29d60072b26fdb584b552eb418464fe108a5488
Instruction Fuzzy Hash: F701A931B000200FDB6496BDE91872FB3DAEBC9750F11843AE50AC7355ED61DC4247D1

Function 0655EE40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbca92abaf0ef09d3ae14b08c854b662b1f0f90098cc8ae8303c87a92feb8f7
Instruction ID: ec43e07505b10a4bdef1c04c53b3de2d22d62c9ba9bf53de0536b2aade845e68
Opcode Fuzzy Hash: bbbca92abaf0ef09d3ae14b08c854b662b1f0f90098cc8ae8303c87a92feb8f7
Instruction Fuzzy Hash: A401A431B204110BDB74967CA46973FB7DAEBC9B20F15883AF90AC7384EE21DD424791

Function 0655A3A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8747cd9230de9881e58fc4b1ebc34f5dddb418a72e1c15043a2fe56fb9095f
Instruction ID: 620a66acff37bec2459aab4a82ad71494142a91d8467f0ea24173337affcf397
Opcode Fuzzy Hash: 1f8747cd9230de9881e58fc4b1ebc34f5dddb418a72e1c15043a2fe56fb9095f
Instruction Fuzzy Hash: AD018134B141144FCB70AA7CE46872E77D6EB89760F11893AE50ACB394EE22DC428794

Function 065564F9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ee854fdb6a288a842857df5503629917e8c510ffaf1581f99dc4ca3326f7c2
Instruction ID: fb805b75a42f48caced76de6c353c7fcf8de9be78ff3a055040d2dfe9d4ab83a
Opcode Fuzzy Hash: 85ee854fdb6a288a842857df5503629917e8c510ffaf1581f99dc4ca3326f7c2
Instruction Fuzzy Hash: 56E02071E241445BDF90CEB0CF1D35A7BA4F741204FA149A7C808D7101F137CE418B40

Function 06556508 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: 65857349085d4b32539b04f1db83b9d41410db85776a2e31d22ea5cfc7bdaf20
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: 04E08C71E10149ABDF60CEA0C91975A7AACE741204FA185A6D808C7202E272CA018B80

Non-executed Functions

Function 06557728 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$kq, xrefs: 06557899
$kq, xrefs: 0655785C
$kq, xrefs: 06557868
$kq, xrefs: 06557CC4
$kq, xrefs: 06557C25
$kq, xrefs: 06557CB8
$kq, xrefs: 0655788D
$kq, xrefs: 06557CDA
$kq, xrefs: 06557C19
$kq, xrefs: 06557CCE

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1324371161
Opcode ID: d162724a59854481ac52577675f3a3d210fddc9646de640c88e9529d279d4cf5
Instruction ID: 8ea90412ef989dbce04f7428b7988997327e015ffc93fab7f7753099952d17e8
Opcode Fuzzy Hash: d162724a59854481ac52577675f3a3d210fddc9646de640c88e9529d279d4cf5
Instruction Fuzzy Hash: 5F125E30E012198FDB64DF65D958AAEB7F2FF88300F21856AD409AB364DB349D85CF90

Function 0655A9C8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$kq, xrefs: 0655AACA
$kq, xrefs: 0655AB50
$kq, xrefs: 0655AB25
$kq, xrefs: 0655AB86
$kq, xrefs: 0655AB19
$kq, xrefs: 0655AB7A
$kq, xrefs: 0655AB44
$kq, xrefs: 0655AABE

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: b2051ca0b2548d2ed1b1882a3d20246d11ce98ff9328fa28fee868a98da7a27f
Instruction ID: 8cd2dd71869716b710174a1c20e439133d28ebaaa3003c51e1fb526fa5d72456
Opcode Fuzzy Hash: b2051ca0b2548d2ed1b1882a3d20246d11ce98ff9328fa28fee868a98da7a27f
Instruction Fuzzy Hash: BF917230A10209DFDB64EF64D96876EBBF2BF84300F25862AE8019B395DB759D45CF90

Function 06557128 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$kq, xrefs: 0655740A
$kq, xrefs: 0655763C
$kq, xrefs: 06557464
$kq, xrefs: 065575C4
$kq, xrefs: 06557630
$kq, xrefs: 06557470

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 6251b45c9723190304fcf4060364325bddda366cae61b6ba4e7cefa5fa081ada
Instruction ID: 149b2c25ebc14022e359eef28958cb39ce9ea8d44e90d6a64e4f48f46610223e
Opcode Fuzzy Hash: 6251b45c9723190304fcf4060364325bddda366cae61b6ba4e7cefa5fa081ada
Instruction Fuzzy Hash: 61F13E30A00209CFDB55EF64D554B5EBBB6FF88300F25856AD8059B3A9DB35EC46CB90

Function 06558460 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$kq, xrefs: 065586BA
$kq, xrefs: 0655871F
$kq, xrefs: 0655872B
$kq, xrefs: 065586C6

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 83e823e2723a23ee3ef191e9ef6e8329cac6398f9ad0a93c40588fbb76b5caa4
Instruction ID: d10db44d66818c7b36d484f5a4bf9b4f3eba383e7e0b3950f6f45778df3546aa
Opcode Fuzzy Hash: 83e823e2723a23ee3ef191e9ef6e8329cac6398f9ad0a93c40588fbb76b5caa4
Instruction Fuzzy Hash: A2B14C30E11218CFDB64EF64D56865EBBB2FF84300F25886AD8069B395DB35DC86CB90

Function 06558878 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRkq, xrefs: 0655896B
$kq, xrefs: 065588F7
LRkq, xrefs: 065589BA
$kq, xrefs: 06558903

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: LRkq$LRkq$$kq$$kq
API String ID: 0-2392252538
Opcode ID: 2660652afdc9670120a04ee7f2ccf2188313c2a517d63d127070710d2b32e6c1
Instruction ID: b54ca9a88227cae61c8fa319623c4a5f25a5ffe9edf910807585ac6ce7d7f876
Opcode Fuzzy Hash: 2660652afdc9670120a04ee7f2ccf2188313c2a517d63d127070710d2b32e6c1
Instruction Fuzzy Hash: 7A51C530B002158FDB64EF68D954A6AB7F6FF84710F15896AE8059F3A9DB30EC44CB91

Function 0655AD50 Relevance: 5.2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

Strings

$kq, xrefs: 0655AF03
$kq, xrefs: 0655AE81
$kq, xrefs: 0655AED4
$kq, xrefs: 0655AF2C

Memory Dump Source

Source File: 00000003.00000002.2943917038.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6550000_Remittance Receipt.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: fb9a5cedc4cb73b5098d2559b7a5339776a8c51a24c4243caf59fad8115d15d1
Instruction ID: 4d001a88d9dd6385538e05ddb18e4e52f89990a4960cff5a0e6a3f80c6f41af5
Opcode Fuzzy Hash: fb9a5cedc4cb73b5098d2559b7a5339776a8c51a24c4243caf59fad8115d15d1
Instruction Fuzzy Hash: BC518034E102058FCB65EB64E4A466EB7B2FF85311F168A2AD805DB355DB34EC41CFA0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Remittance Receipt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Remittance Receipt.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dcxi2ey.vzw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esxcg2rg.0v0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_peaivkta.owi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zfibl34n.wjg.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Remittance Receipt.exe

Function 0721A158 Relevance: 5.3, Strings: 4, Instructions: 328
COMMON

Function 072199F0 Relevance: 3.1, Strings: 2, Instructions: 560
COMMON

Function 015FD3C9 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Function 015FD3D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre