Edit tour

Windows Analysis Report
RE ADVANCE REMITTANCE-INV000567.exe

Overview

General Information

Sample name:	RE ADVANCE REMITTANCE-INV000567.exe
Analysis ID:	1564720
MD5:	8a31fa0f31962fab9d6b1beecd8b9131
SHA1:	aa7615b1cde0c581b6a4f652c1c0bbcd51a40e7f
SHA256:	10798d4e3848b23917bc722df57e303db30bec2d231c83f0107e9cb64979eb20
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

.NET source code contains potential unpacker

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

RE ADVANCE REMITTANCE-INV000567.exe (PID: 1292 cmdline: "C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe" MD5: 8A31FA0F31962FAB9D6B1BEECD8B9131)

WerFault.exe (PID: 5644 cmdline: C:\Windows\system32\WerFault.exe -u -p 1292 -s 2284 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RE ADVANCE REMITTANCE-INV000567.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: RE ADVANCE REMITTANCE-INV000567.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for sample

Source: RE ADVANCE REMITTANCE-INV000567.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 104.21.13.139:443 -> 192.168.2.6:49706 version: TLS 1.2

Source: RE ADVANCE REMITTANCE-INV000567.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: bindoC:\Windows\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130229261.0000006295DF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.PDB f source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130229261.0000006295DF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Net.Http.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.pdb/ source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.PDBXK source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb]e source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.PDBb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130229261.0000006295DF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RE ADVANCE REMITTANCE-INV000567.PDB source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130229261.0000006295DF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb` source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.ni.pdbRSDS source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER46FF.tmp.dmp.4.dr

Source: global traffic	HTTP traffic detected: GET /data-package/YL4bsZ4V/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/YL4bsZ4V/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 104.21.13.139 104.21.13.139

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /data-package/YL4bsZ4V/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/YL4bsZ4V/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: filetransfer.io

Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B692000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B66C000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B5C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filetransfer.io
Source: RE ADVANCE REMITTANCE-INV000567.exe	String found in binary or memory: http://filetransfer.io/data-package/YL4bsZ4V/download
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.coCp
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6D4000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://palo-alto.cz/
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B5C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B67A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B66C000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B67A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/YL4bsZ4V/download
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6D4000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/dist/filetransfer-social-en.389488efe49681ac059b218c21161d72.png
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6D4000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.filetransfer.io/

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.21.13.139:443 -> 192.168.2.6:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1292 -s 2284

Source: RE ADVANCE REMITTANCE-INV000567.exe

Static PE information: No import functions for PE file found

Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000000.2125263363.0000021889790000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLbglcrmq.exe> vs RE ADVANCE REMITTANCE-INV000567.exe
Source: RE ADVANCE REMITTANCE-INV000567.exe	Binary or memory string: OriginalFilenameLbglcrmq.exe> vs RE ADVANCE REMITTANCE-INV000567.exe

Source: classification engine

Classification label: mal68.evad.winEXE@2/5@1/1

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1292

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\de02f265-cae6-4815-ae24-05fe602cf6d7

Jump to behavior

Source: RE ADVANCE REMITTANCE-INV000567.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RE ADVANCE REMITTANCE-INV000567.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RE ADVANCE REMITTANCE-INV000567.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

File read: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe "C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe"
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1292 -s 2284

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RE ADVANCE REMITTANCE-INV000567.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RE ADVANCE REMITTANCE-INV000567.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: bindoC:\Windows\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130229261.0000006295DF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.PDB f source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130229261.0000006295DF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Net.Http.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.pdb/ source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.PDBXK source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb]e source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.PDBb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130229261.0000006295DF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RE ADVANCE REMITTANCE-INV000567.PDB source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130229261.0000006295DF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb` source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Net.Http.ni.pdbRSDS source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER46FF.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER46FF.tmp.dmp.4.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: RE ADVANCE REMITTANCE-INV000567.exe, Btywhcfcs.cs

.Net Code: Cpplunnvh System.AppDomain.Load(byte[])

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Memory allocated: 21889B10000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Memory allocated: 218A35C0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe TID: 6888	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe TID: 6888	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe TID: 4948	Thread sleep count: 319 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe TID: 4948	Thread sleep count: 180 > 30	Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Thread delayed: delay time: 100000			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3130533206.00000218898F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Queries volume information: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
RE ADVANCE REMITTANCE-INV000567.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeylogger
RE ADVANCE REMITTANCE-INV000567.exe	100%	Avira	TR/AVI.Agent.xaqfy
RE ADVANCE REMITTANCE-INV000567.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://microsoft.coCp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
filetransfer.io	104.21.13.139	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://filetransfer.io/data-package/YL4bsZ4V/download	false		high
https://filetransfer.io/data-package/YL4bsZ4V/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://filetransfer.io	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B67A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.4.dr	false		high
https://filetransfer.io/dist/filetransfer-social-en.389488efe49681ac059b218c21161d72.png	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6D4000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://palo-alto.cz/	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6D4000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://filetransfer.io	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B692000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B66C000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B5C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B5C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://microsoft.coCp	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.filetransfer.io/	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6D4000.00000004.00000800.00020000.00000000.sdmp, RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131154295.000002188B6B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	RE ADVANCE REMITTANCE-INV000567.exe, 00000000.00000002.3131521002.00000218A3E0E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.13.139	filetransfer.io	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564720
Start date and time:	2024-11-28 18:44:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RE ADVANCE REMITTANCE-INV000567.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@2/5@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 90% Number of executed functions: 8 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RE ADVANCE REMITTANCE-INV000567.exe, PID 1292 because it is empty
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: RE ADVANCE REMITTANCE-INV000567.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.13.139	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/3zQMDtTK/download
	QUOTATION_MAYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/aFTjGwJu/download
	QUOTATION_MAYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/aFTjGwJu/download
	QUOTATION_MAYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/mAdHjYPt/download
	B73X15Rsu7.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/mU5kQOzV/download
	Purchase Order No.P7696#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/FUq5fnFw/download
	QUOTATION_MAYQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/GWyzXjYcdownload
	Price List MAYQTRA031244PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/ku7hiEQr/download
	QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/aPtWC5T9/download
	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/EN1H0b0j/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
filetransfer.io	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	PO_203-25.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	rBankRemittance_pdf.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	104.21.76.84
	1C24TBP_00000143.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	172.67.74.152
	tnljashd27.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	sdfgdsfkjg27.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	tnkjasdhf27.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	104.21.76.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	1C24TBP_00000143.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.21.13.139
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	104.21.13.139
	tnljashd27.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.21.13.139
	sdfgdsfkjg27.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.21.13.139
	tnkjasdhf27.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.21.13.139
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.13.139
	#U8b49#U64da_89004161-000002102-66_20241128#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.13.139
	SITHIPHORN_Doc2709202400000.exe	Get hash	malicious	AgentTesla	Browse	104.21.13.139

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RE ADVANCE REMIT_feae7abc6e75625f7773a299423f8bb881cfb_d3bc5aaf_27517a76-553c-427c-a63c-ad1753464821\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2039237594262917
Encrypted:	false
SSDEEP:	192:T+litd2Y6oV4yD0qnquaWB+lPIUMmzuiFwZ24lO8y:ilENVaqnquamIgVmzuiFwY4lO8y
MD5:	3A36CA95CF14B8DDFE21056E9A557578
SHA1:	7AC4A514FD1CB407801F46CF33CC8960C3408F96
SHA-256:	0219FA65898829A867F4810CE281AA4A9E58F206B19CDA5627B62DA38501AAA6
SHA-512:	BA024A60235A70C1B820A2657B747F04755EA23D10280E2611B2742436DF3E5FF248FBE87A295B81C3FBC0934604EC5FF8C9270AC7ADF8633B080EE410AEF6C0
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.2.8.9.5.0.2.7.4.9.8.0.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.2.8.9.5.0.3.4.3.7.3.0.2.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.5.1.7.a.7.6.-.5.5.3.c.-.4.2.7.c.-.a.6.3.c.-.a.d.1.7.5.3.4.6.4.8.2.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.3.a.f.8.9.c.-.c.a.a.1.-.4.5.3.1.-.8.e.2.9.-.9.e.2.a.2.3.3.8.f.2.6.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.R.E. .A.D.V.A.N.C.E. .R.E.M.I.T.T.A.N.C.E.-.I.N.V.0.0.0.5.6.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.L.b.g.l.c.r.m.q...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.0.c.-.0.0.0.1.-.0.0.1.5.-.6.5.a.a.-.6.2.3.d.b.d.4.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.7.4.9.d.f.2.5.6.d.9.2.3.a.e.0.c.9.7.f.9.d.1.7.7.b.b.7.9.7.b.7.0.0.0.0.0.0.0.0.!.0.0.0.0.a.a.7.6.1.5.b.1.c.d.e.0.c.5.8.1.b.6.a.4.f.6.5.2.c.1.c.0.b.b.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46FF.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Nov 28 17:45:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	518458
Entropy (8bit):	2.8964039676427196
Encrypted:	false
SSDEEP:	3072:59DIJZfVTFPdEnF/s3dm1CCq/0TK3+vwj6wRE4C5IwGEjjVcSQPYtUXC/ZVF:TD5V0dMqsm3Q0EPGYQQ6XCxV
MD5:	27260DCB8A2B2FDBAF73DAFB4B187D6C
SHA1:	06C0C34484634C7615536FFD372BDB285A717AF0
SHA-256:	82BAE4542CE402A6B73342E7B5125850658E7DF54BFB2D2C4288D203414549FA
SHA-512:	10C6D6EB07D6174380BA5C6B3363AB6527045D5D01B0DB4BACD79ECB2C681FE23BD8CB10CA1F03FA2F06BFE3EA9ED8E7AFAD5F06614DDA91754C7F698EA3B51C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........Hg....................................<...p(...........(.......8..............l.......8...........T...........pY..............3..........t5..............................................................................eJ.......6......Lw......................T.............Hg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER48C5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8892
Entropy (8bit):	3.7194859040115213
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2HjKU6Y2DzpwngmfZsxyEWprA89bQXkfmwm:R6lXJKx6YOpwgmfVfQUfI
MD5:	F69380B8A8C56D4CA569B4B0039086F7
SHA1:	F586EDFBEFD7EC811DA9DD9DAAC0C1F68B070CC4
SHA-256:	F970C472B887E6067460C67609B2178F06773F1AFE85CC6895B1C12EB0CCCE43
SHA-512:	0C0924E06DE5B2BF330113AB39E1305B2FBFB2E595FF80554E0544C661F8CEC23043ECB3D24422AB3FC9ED5A9510DB98421267B5C98C11F3195C3FDBAB60F509
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.2.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4904.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4910
Entropy (8bit):	4.574338788124597
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg771I9ADWpW8VYnYm8M4JfE6F4yq8vAEThHoc/DwMqd:uIjf1I7Hy7VnJ8TWdT1oSLqd
MD5:	CB2A8BA39ECA3BB037A7135B9153AD50
SHA1:	14426A1D024E99588EF0DF03E38BDBF883F7D64C
SHA-256:	532EAD34BFEB6C3F8DC6014FA99DA22D254600A28A7112F77C63EAFCD9193A11
SHA-512:	903DDEB0AD9DC849A8DA8D86F5FEE245E6C99C5C62AF89ECE1CCD7EAC423E922ABE41561D896A25161C94F0E61D4D0256FF9BD37953FC41F4481ED23D26BAC23
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="608207" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469035319914591
Encrypted:	false
SSDEEP:	6144:UzZfpi6ceLPx9skLmb0fMZWSP3aJG8nAgeiJRMMhA2zX4WABluuNVjDH5S:aZHtMZWOKnMM6bFpjj4
MD5:	B719F60062959989CA0B94F6E5A67A92
SHA1:	7D01880BB724F9858572E9B244178E810DB8D31A
SHA-256:	8A2104E24AB31646E079CCECD5AECDFD23B5084A1FC257FF73390905F3262106
SHA-512:	97EC1A49B7DCD76CF7F94A627B5DD60DF8ADF01E37B673D57BFCD6CD90D971E4E044BC120681ADBD1A1A8C185E4E1A6D46CBA72B34159C4A120223146826DA52
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmv.@.A..............................................................................................................................................................................................................................................................................................................................................m.t........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	1.4139562841996458
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	RE ADVANCE REMITTANCE-INV000567.exe
File size:	376'832 bytes
MD5:	8a31fa0f31962fab9d6b1beecd8b9131
SHA1:	aa7615b1cde0c581b6a4f652c1c0bbcd51a40e7f
SHA256:	10798d4e3848b23917bc722df57e303db30bec2d231c83f0107e9cb64979eb20
SHA512:	37e9874286cd5a6fec3e9486fa3979710ce747999cc5679563a4e7024a76b13e40bee2fd429604f7b486f6f878b48790688824e4c27f1ecfec5bd2f75c83d34a
SSDEEP:	384:TSH4jlE3nyEVPTHWKtL2H0VuM35zlQEew+yTzSf4JM54iICSCr4H444uiiiL1CQ5:1onyAWkaHRQMwdz+4H4447iiL1b
TLSH:	A6846890AF6494B4E921FDB12799E735D25B6CA236202F426DC0339B75F36D0BF07268
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...>..f.........."...................... ....@...... ....................................`...@......@............... .....

File Icon


Icon Hash:	98306c8c8eb282c4

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CE9F3E [Wed Aug 28 03:53:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x5ad72	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe74	0x1000	fe46e0980ef17bcff03fb74ae4bba198	False	0.55224609375	data	5.177862292537011	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x5ad72	0x5ae00	14d50c06ba03e7f06db39391d42b6f57	False	0.03850101014442916	data	1.3326020388294126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4220	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 2835 x 2835 px/m	0.026130277835310828
RT_ICON	0x46248	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.26861702127659576
RT_ICON	0x466b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.11275933609958506
RT_ICON	0x48c58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.13930581613508441
RT_ICON	0x49d00	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.04588607594936709
RT_ICON	0x5a528	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.08384506376948513
RT_GROUP_ICON	0x5e750	0x5a	data	0.7555555555555555
RT_VERSION	0x5e7ac	0x3da	data	0.4127789046653144
RT_MANIFEST	0x5eb88	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 18:44:58.701725960 CET	49705	80	192.168.2.6	104.21.13.139
Nov 28, 2024 18:44:58.822479010 CET	80	49705	104.21.13.139	192.168.2.6
Nov 28, 2024 18:44:58.822680950 CET	49705	80	192.168.2.6	104.21.13.139
Nov 28, 2024 18:44:58.826380968 CET	49705	80	192.168.2.6	104.21.13.139
Nov 28, 2024 18:44:58.947400093 CET	80	49705	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:00.227221012 CET	80	49705	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:00.264785051 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:00.264838934 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:00.264898062 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:00.279614925 CET	49705	80	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:00.291753054 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:00.291773081 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:01.615047932 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:01.615135908 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:01.620482922 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:01.620496035 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:01.621211052 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:01.670243025 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:01.677897930 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:01.723330021 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.502832890 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.503350973 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.503386974 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.503416061 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:02.503427982 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.503460884 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.503488064 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:02.503494024 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.503532887 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:02.503537893 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.519701004 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.519784927 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.519804955 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:02.519818068 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.519865990 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:02.528114080 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.532279968 CET	443	49706	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.532381058 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:02.567995071 CET	49706	443	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:02.568332911 CET	49705	80	192.168.2.6	104.21.13.139
Nov 28, 2024 18:45:02.695588112 CET	80	49705	104.21.13.139	192.168.2.6
Nov 28, 2024 18:45:02.695669889 CET	49705	80	192.168.2.6	104.21.13.139

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 18:44:58.542534113 CET	49331	53	192.168.2.6	1.1.1.1
Nov 28, 2024 18:44:58.686438084 CET	53	49331	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 18:44:58.542534113 CET	192.168.2.6	1.1.1.1	0x33a	Standard query (0)	filetransfer.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 18:44:58.686438084 CET	1.1.1.1	192.168.2.6	0x33a	No error (0)	filetransfer.io		104.21.13.139	A (IP address)	IN (0x0001)	false
Nov 28, 2024 18:44:58.686438084 CET	1.1.1.1	192.168.2.6	0x33a	No error (0)	filetransfer.io		172.67.200.96	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

filetransfer.io

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49705	104.21.13.139	80	1292	C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 18:44:58.826380968 CET	95	OUT	GET /data-package/YL4bsZ4V/download HTTP/1.1 Host: filetransfer.io Connection: Keep-Alive
Nov 28, 2024 18:45:00.227221012 CET	1027	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 28 Nov 2024 17:45:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://filetransfer.io/data-package/YL4bsZ4V/download cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lp4f3CA7B%2FBp7mSiIxuWW7yD%2ByMz2SkddQo803RpXz%2BvCNisruJ2AeflQcqyOf7JEZmunTzvn5gHK%2Btw4qY8nKy%2B4vyyeYu44pRrkf6%2B6e%2BYwWhjYy1Tmzy2Q7YbAUGSSkk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9c2b4df85e7c69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1788&rtt_var=894&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=95&delivery_rate=0&cwnd=169&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49706	104.21.13.139	443	1292	C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 17:45:01 UTC	95	OUT	GET /data-package/YL4bsZ4V/download HTTP/1.1 Host: filetransfer.io Connection: Keep-Alive
2024-11-28 17:45:02 UTC	1234	IN	HTTP/1.1 430 Unknown status Date: Thu, 28 Nov 2024 17:45:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Nette Framework 3 X-Frame-Options: SAMEORIGIN Set-Cookie: nette-samesite=1; path=/; SameSite=Strict; HttpOnly Set-Cookie: PHPSESSID=6o3ap85fpn4t6ru12nt7lt6jcc; expires=Thu, 12-Dec-2024 17:45:02 GMT; Max-Age=1209600; path=/; SameSite=Lax; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: X-Requested-With Vary: X-Requested-With cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c0pJ8WDl%2FWUyj7yGoExQ5X9osKLRfk%2B8pCHbrCG6GIxZhEufnBsehUf7Q8A0GwZRw9fDhk%2Bu5wKJeAICydu08VaQoWjfKJveAboMwypndQoX%2F%2FS9ZptyjZRRkKZ71HTksQo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e9c2b5acf618cbd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1821&min_rtt=1807&rtt_var=707&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=709&delivery_rate=1516095&cwnd=163&unsent_bytes=0&cid=9aa8600342697f13&ts=905&x=0"
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 33 33 64 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 33dc<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d Data Ascii: <link rel="apple-touch-icon" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel=
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 6e 79 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d Data Ascii: -name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/tiny.png"><meta name="m
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 69 6e 20 74 68 65 20 66 6f 72 6d 61 74 20 6d 61 69 6c 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 41 6d 62 69 67 75 6f 75 73 20 3d 20 22 44 69 64 6e 27 74 20 79 6f 75 20 6d 61 6b 65 20 61 20 74 79 70 6f 20 61 74 20 74 68 65 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 3f 20 49 66 20 74 68 69 73 20 72 65 61 6c 6c 79 20 69 73 20 74 68 65 20 63 6f 72 72 65 63 74 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 Data Ascii: alerts.emailRequired = "Please enter an e-mail address in the format mail@example.com"; MESSAGES.alerts.emailAmbiguous = "Didn't you make a typo at the beginning of you e-mail address? If this really is the correct beginning of you e-mail, press enter
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 6c 6f 61 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 65 72 72 6f 72 4f 63 63 75 72 72 65 64 20 3d 20 22 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 62 61 73 65 54 69 74 6c 65 20 3d 20 22 20 2d 20 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 64 61 79 73 20 3d 20 22 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a Data Ascii: "; MESSAGES.titles.uploadProblem = "Problem with upload"; MESSAGES.titles.errorOccurred = "An error occurred"; MESSAGES.titles.baseTitle = " - FileTransfer.io"; MESSAGES.time.shortcuts.days = "d"; MESSAGES.time.shortcuts.hours = "h";
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 2d 6c 61 62 65 6c 20 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 20 78 73 2d 76 69 73 69 62 6c 65 22 3e 0a 09 09 09 09 09 4c 6f 67 20 69 6e 0a 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 61 3e 0a 09 09 09 3c 21 2d 2d 20 2e 61 63 63 6f 75 6e 74 20 2d 2d 3e 0a 0a 09 09 3c 6e 61 76 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 74 72 69 67 67 65 72 20 6d 64 2d 69 6e 76 69 73 Data Ascii: unt underline" data-authenticated="false"><span class="icon-user circle"></span><span class="account-label underline-item xs-visible">Log in</span></a>... .account --><nav><div class="navigation-trigger md-invis
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 63 6b 61 67 65 20 64 65 6c 65 74 65 64 3c 2f 68 31 3e 0a 0a 09 09 09 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 63 6f 6c 6f 72 2d 6e 65 67 61 74 69 76 65 22 3e 0a 09 09 09 09 09 09 09 54 68 69 73 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 64 6f 77 6e 6c 6f 61 64 65 64 20 61 6e 79 6d 6f 72 65 20 62 65 63 61 75 73 65 20 69 74 73 20 6f 77 6e 65 72 20 68 61 73 20 64 65 6c 65 74 65 64 20 69 74 20 66 72 6f 6d 20 74 68 65 20 73 65 72 76 65 72 2e 0a 09 09 09 09 09 09 3c 2f 70 3e 0a 0a 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 21 2d 2d 20 2e 63 6f 6e 74 65 6e 74 2d 68 65 61 64 65 72 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 09 09 09 09 0a 0a 09 09 09 09 09 09 3c 2f 73 65 63 74 69 6f 6e 3e 0a 09 09 09 09 09 09 3c 21 2d 2d 20 2e 63 Data Ascii: ckage deleted</h1><p class="color-negative">This data package cannot be downloaded anymore because its owner has deleted it from the server.</p></div>... .content-header --></section>... .c
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 74 68 65 20 66 69 6c 65 73 20 66 6f 72 26 6e 62 73 70 3b 32 31 26 6e 62 73 70 3b 64 61 79 73 3c 2f 68 32 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 21 2d 2d 20 2e 69 6e 66 6f 2d 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 21 2d 2d 20 2e 69 6e 66 6f 20 2d 2d 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 21 2d 2d 20 2e 63 6f 6c 75 6d 6e 20 2d 2d 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 21 2d 2d 20 2e 63 6f 6c 75 6d 6e 73 20 2d 2d 3e 0a 0a 0a 09 09 09 3c 6e 61 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 2d 6e 61 76 69 67 61 74 69 6f 6e 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 43 6f 6e 74 61 63 74 22 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 63 6f 6e 74 61 63 74 Data Ascii: the files for 21 days</h2></div>... .info-content --></div>... .info --></div>... .column --></div>... .columns --><nav class="footer-navigation"><a title="Contact" class="underline" href="/contact
2024-11-28 17:45:02 UTC	1369	IN	Data Raw: 09 09 09 09 26 6d 69 64 64 6f 74 3b 0a 09 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 41 6c 74 65 72 6e 61 74 69 76 65 20 74 6f 20 53 65 6e 64 73 70 61 63 65 22 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 73 65 6e 64 73 70 61 63 65 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 53 65 6e 64 73 70 61 63 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 26 6d 69 64 64 6f 74 3b 0a 09 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 41 6c 74 65 72 6e 61 74 69 76 65 20 74 6f 20 57 65 73 65 6e 64 69 74 22 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 77 65 73 65 6e 64 69 74 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 Data Ascii: ·<a title="Alternative to Sendspace" class="underline" href="/sendspace"><span class="underline-item">Sendspace</span></a>·<a title="Alternative to Wesendit" class="underline" href="/wesendit"><span
2024-11-28 17:45:02 UTC	963	IN	Data Raw: 61 73 65 20 63 6c 69 63 6b 20 09 09 09 3c 61 20 64 61 74 61 2d 72 6f 6c 65 3d 22 63 6f 6e 74 61 63 74 2d 75 72 6c 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 68 72 65 66 3d 22 2f 63 6f 6e 74 61 63 74 2f 32 2f 43 51 6b 4a 43 58 64 6f 61 57 78 6c 49 48 56 7a 61 57 35 6e 49 45 5a 70 62 47 56 55 63 6d 46 75 63 32 5a 6c 63 69 35 70 62 79 42 68 62 69 42 6c 63 6e 4a 76 63 69 41 69 4a 57 56 79 63 6d 39 79 53 57 51 6c 49 69 42 76 59 32 4e 31 63 6e 4a 6c 5a 43 34 67 55 47 78 6c 59 58 4e 6c 49 47 6c 75 5a 6d 39 79 62 53 42 74 5a 53 42 68 59 6d 39 31 64 43 42 30 61 47 55 67 63 48 4a 76 59 32 56 7a 63 79 42 76 5a 69 42 6d 61 58 68 70 62 6d 63 67 64 47 68 70 63 79 42 6c 63 6e 4a 76 63 69 34 4b 22 3e 0a 09 09 68 65 72 65 3c 2f 61 3e 2e 0a 09 09 09 09 3c 2f 70 3e Data Ascii: ase click <a data-role="contact-url" rel="nofollow" href="/contact/2/CQkJCXdoaWxlIHVzaW5nIEZpbGVUcmFuc2Zlci5pbyBhbiBlcnJvciAiJWVycm9ySWQlIiBvY2N1cnJlZC4gUGxlYXNlIGluZm9ybSBtZSBhYm91dCB0aGUgcHJvY2VzcyBvZiBmaXhpbmcgdGhpcyBlcnJvci4K">here</a>.</p>

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: RE ADVANCE REMITTANCE-INV000567.exePID: 1292, Parent PID: 4004

General

Target ID:	0
Start time:	12:44:57
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RE ADVANCE REMITTANCE-INV000567.exe"
Imagebase:	0x21889780000
File size:	376'832 bytes
MD5 hash:	8A31FA0F31962FAB9D6B1BEECD8B9131
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5644, Parent PID: 1292

General

Target ID:	4
Start time:	12:45:02
Start date:	28/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1292 -s 2284
Imagebase:	0x7ff7ad530000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: RE ADVANCE REMITTANCE-INV000567.exePID: 1292, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD345508C1 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

p\D4, xrefs: 00007FFD345508EB

Memory Dump Source

Source File: 00000000.00000002.3131961973.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_RE ADVANCE REMITTANCE-INV000567.jbxd

Similarity

API ID:
String ID: p\D4
API String ID: 0-2591872736
Opcode ID: cce61ffdaa6dbad849ebe51cff97769ea5cc233f21731b9b7df2348638cd0395
Instruction ID: 7626eee735cca93f9ef5520b85c7ef3c2b1bc221b72c9d62df472ace80f38bed
Opcode Fuzzy Hash: cce61ffdaa6dbad849ebe51cff97769ea5cc233f21731b9b7df2348638cd0395
Instruction Fuzzy Hash: 5BF02843F0DE860FEB95A6B814EA5B427D0DBA921074406BBD10AC7183EC1CEC465340

Function 00007FFD3455184D Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3131961973.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_RE ADVANCE REMITTANCE-INV000567.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde1048308216359ac4990629f5829333e6d05eb42fb17c05152e857a690c48e
Instruction ID: 414b8cafcce1242f896022ebe3c1af05126eacf8e8c545dc76666e233d6e412b
Opcode Fuzzy Hash: bde1048308216359ac4990629f5829333e6d05eb42fb17c05152e857a690c48e
Instruction Fuzzy Hash: 5551AE3190CB5C4FDB59DF98D8566EDBBF1EF99310F0042ABD449D7252CA34A845CB82

Function 00007FFD345517ED Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3131961973.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_RE ADVANCE REMITTANCE-INV000567.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8402b5b605bc83ba483ff00aac99d601a6b6efdc6325c54415bf07a436c8a9cf
Instruction ID: fb354177667498be01ef8a88464b358a5fc9b513058132d79615cf3e1c7274b5
Opcode Fuzzy Hash: 8402b5b605bc83ba483ff00aac99d601a6b6efdc6325c54415bf07a436c8a9cf
Instruction Fuzzy Hash: CF516D31E18B1C8FDB58DF98D8566EDBBF1FF99311F00826AD409D7252CA34A845CB82

Function 00007FFD34550B06 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3131961973.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_RE ADVANCE REMITTANCE-INV000567.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2a4a893d9be89a01272af6f404af2cdd4ec640a4d4ba43e8ba09bdbabf8a71
Instruction ID: 548a87a0befdcf03cdb79436f532e13da014c1d830c702d407cb63aadb79c198
Opcode Fuzzy Hash: 9e2a4a893d9be89a01272af6f404af2cdd4ec640a4d4ba43e8ba09bdbabf8a71
Instruction Fuzzy Hash: 7F51F822A0DB894FEB96D77484643B97FE1EF47750F0900FBD18ACB293C9299C468381

Function 00007FFD34550939 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3131961973.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_RE ADVANCE REMITTANCE-INV000567.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33dac8aa4f9a1bcf485b49b6dd2fd328bccae48d5648c0088dc90684d4da293e
Instruction ID: 185838e0e6c49a4a3a49408b59684491bf7d5d6ca87a0f5f89a12b574340c776
Opcode Fuzzy Hash: 33dac8aa4f9a1bcf485b49b6dd2fd328bccae48d5648c0088dc90684d4da293e
Instruction Fuzzy Hash: F521E422A1DB8D0FF796E77844752B97BE2EF9A650B0500EBD48AC72A3DD285C468341

Function 00007FFD345509E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3131961973.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_RE ADVANCE REMITTANCE-INV000567.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4e737fa0d9e42aed6470ae50f7821b5578d1a8c7f839b1aef5ec7bed0e691b
Instruction ID: 5235097dae9d3c908574eb34438530ee4b6a5ec62b5f5ae6a542a492b132b01e
Opcode Fuzzy Hash: ac4e737fa0d9e42aed6470ae50f7821b5578d1a8c7f839b1aef5ec7bed0e691b
Instruction Fuzzy Hash: 07018461F1890D0FEB84FB5CE4E16FC73E1EB99710F400179E10ED3286CD28A8418740

Function 00007FFD34550A64 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3131961973.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_RE ADVANCE REMITTANCE-INV000567.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4bc52d5fefe91ac282d795486d727b6838f741092def267f3f49032cfcbe45
Instruction ID: 6a48a0e8e0634a01ec0f0d5965615c4430cf3efa046d9f32233a4ee09b09f910
Opcode Fuzzy Hash: ba4bc52d5fefe91ac282d795486d727b6838f741092def267f3f49032cfcbe45
Instruction Fuzzy Hash: F2E0263390AA4C1BCF04AA5AAC404C63B98FBDA31CB00016BF04CC3141D2159911C302

Function 00007FFD34550CD3 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3131961973.00007FFD34550000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34550000_RE ADVANCE REMITTANCE-INV000567.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4172851b181197bfe0718baa8e2d5d431a257276209e7c19a7b1edc83eccd5
Instruction ID: 4fbfbaf45247687c335ff29bd24d3ce61edeaa0dc1ea0a7e53f01ba628c1ba72
Opcode Fuzzy Hash: 8a4172851b181197bfe0718baa8e2d5d431a257276209e7c19a7b1edc83eccd5
Instruction Fuzzy Hash: 16E07D36A0DA8C0BDF00EA5CAC104D5B7A0FB8A30CF0001EAE95CC3191C6299412C342

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RE ADVANCE REMITTANCE-INV000567.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RE ADVANCE REMIT_feae7abc6e75625f7773a299423f8bb881cfb_d3bc5aaf_27517a76-553c-427c-a63c-ad1753464821\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46FF.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER48C5.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4904.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

Windows Analysis Report
RE ADVANCE REMITTANCE-INV000567.exe