Edit tour

Windows Analysis Report
new shipment.exe

Overview

General Information

Sample name:	new shipment.exe
Analysis ID:	1520580
MD5:	41e96a8eabf31d7b5abbeb15d5307b40
SHA1:	0c406ef15662e8580a724ef05dfb04d76c222c9c
SHA256:	d7ea65fb9c018f20cff23dc97bb8a9a6818e97c333a5485142f2e0210be204e1
Tags:	exeSnakeKeyloggeruser-lowmal3
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Machine Learning detection for sample

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

IP address seen in connection with other malware

May check the online IP address of the machine

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

new shipment.exe (PID: 5476 cmdline: "C:\Users\user\Desktop\new shipment.exe" MD5: 41E96A8EABF31D7B5ABBEB15D5307B40)

new shipment.exe (PID: 1464 cmdline: "C:\Users\user\Desktop\new shipment.exe" MD5: 41E96A8EABF31D7B5ABBEB15D5307B40)

WerFault.exe (PID: 3304 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 1528 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "6836590615:AAFwcOu-vD49QRMuWGekV93uJdtVWmZdWUw", "Chat id": "5007084465", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "6836590615:AAFwcOu-vD49QRMuWGekV93uJdtVWmZdWUw", "Chat_id": "5007084465", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d142:$a1: get_encryptedPassword 0x2d42b:$a2: get_encryptedUsername 0x2cf60:$a3: get_timePasswordChanged 0x2d05b:$a4: get_passwordField 0x2d158:$a5: set_encryptedPassword 0x2e785:$a7: get_logins 0x2e6e8:$a10: KeyLoggerEventArgs 0x2e34d:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x19a952:$a1: get_encryptedPassword 0x1dcd82:$a1: get_encryptedPassword 0x21efa2:$a1: get_encryptedPassword 0x19ac3b:$a2: get_encryptedUsername 0x1dd06b:$a2: get_encryptedUsername 0x21f28b:$a2: get_encryptedUsername 0x19a770:$a3: get_timePasswordChanged 0x1dcba0:$a3: get_timePasswordChanged 0x21edc0:$a3: get_timePasswordChanged 0x19a86b:$a4: get_passwordField 0x1dcc9b:$a4: get_passwordField 0x21eebb:$a4: get_passwordField 0x19a968:$a5: set_encryptedPassword 0x1dcd98:$a5: set_encryptedPassword 0x21efb8:$a5: set_encryptedPassword 0x19bf95:$a7: get_logins 0x1de3c5:$a7: get_logins 0x2205e5:$a7: get_logins 0x19bef8:$a10: KeyLoggerEventArgs 0x1de328:$a10: KeyLoggerEventArgs 0x220548:$a10: KeyLoggerEventArgs
Process Memory Space: new shipment.exe PID: 5476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: new shipment.exe PID: 5476	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: new shipment.exe PID: 5476	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: new shipment.exe PID: 5476	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb2edc:$a1: get_encryptedPassword 0xb311b:$a2: get_encryptedUsername 0xb2d1d:$a3: get_timePasswordChanged 0xb2dff:$a4: get_passwordField 0xb2ef2:$a5: set_encryptedPassword 0xb4b04:$a7: get_logins 0xb4a85:$a10: KeyLoggerEventArgs 0xb47fe:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: new shipment.exe PID: 1464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: new shipment.exe PID: 1464	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: new shipment.exe PID: 1464	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: new shipment.exe PID: 1464	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12516:$a1: get_encryptedPassword 0x127f5:$a2: get_encryptedUsername 0x1233e:$a3: get_timePasswordChanged 0x12439:$a4: get_passwordField 0x1252c:$a5: set_encryptedPassword 0x14766:$a7: get_logins 0x146c9:$a10: KeyLoggerEventArgs 0x14332:$a11: KeyLoggerEventArgsEventHandler
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.new shipment.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.new shipment.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.new shipment.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.new shipment.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.new shipment.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d342:$a1: get_encryptedPassword 0x2d62b:$a2: get_encryptedUsername 0x2d160:$a3: get_timePasswordChanged 0x2d25b:$a4: get_passwordField 0x2d358:$a5: set_encryptedPassword 0x2e985:$a7: get_logins 0x2e8e8:$a10: KeyLoggerEventArgs 0x2e54d:$a11: KeyLoggerEventArgsEventHandler
2.2.new shipment.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ae77:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a51a:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a777:$a4: \Orbitum\User Data\Default\Login Data 0x3b108:$a5: \Kometa\User Data\Default\Login Data
2.2.new shipment.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2df24:$s1: UnHook 0x2df2b:$s2: SetHook 0x2df33:$s3: CallNextHook 0x2df40:$s4: _hook
0.2.new shipment.exe.4250a40.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.new shipment.exe.4250a40.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.new shipment.exe.4250a40.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.new shipment.exe.4250a40.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b542:$a1: get_encryptedPassword 0x2b82b:$a2: get_encryptedUsername 0x2b360:$a3: get_timePasswordChanged 0x2b45b:$a4: get_passwordField 0x2b558:$a5: set_encryptedPassword 0x2cb85:$a7: get_logins 0x2cae8:$a10: KeyLoggerEventArgs 0x2c74d:$a11: KeyLoggerEventArgsEventHandler
0.2.new shipment.exe.4250a40.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39077:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3871a:$a3: \Google\Chrome\User Data\Default\Login Data 0x38977:$a4: \Orbitum\User Data\Default\Login Data 0x39308:$a5: \Kometa\User Data\Default\Login Data
0.2.new shipment.exe.420e610.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.new shipment.exe.420e610.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.new shipment.exe.420e610.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.new shipment.exe.4250a40.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c124:$s1: UnHook 0x2c12b:$s2: SetHook 0x2c133:$s3: CallNextHook 0x2c140:$s4: _hook
0.2.new shipment.exe.420e610.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b542:$a1: get_encryptedPassword 0x2b82b:$a2: get_encryptedUsername 0x2b360:$a3: get_timePasswordChanged 0x2b45b:$a4: get_passwordField 0x2b558:$a5: set_encryptedPassword 0x2cb85:$a7: get_logins 0x2cae8:$a10: KeyLoggerEventArgs 0x2c74d:$a11: KeyLoggerEventArgsEventHandler
0.2.new shipment.exe.420e610.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39077:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3871a:$a3: \Google\Chrome\User Data\Default\Login Data 0x38977:$a4: \Orbitum\User Data\Default\Login Data 0x39308:$a5: \Kometa\User Data\Default\Login Data
0.2.new shipment.exe.420e610.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c124:$s1: UnHook 0x2c12b:$s2: SetHook 0x2c133:$s3: CallNextHook 0x2c140:$s4: _hook
0.2.new shipment.exe.4250a40.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.new shipment.exe.4250a40.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.new shipment.exe.4250a40.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.new shipment.exe.4250a40.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.new shipment.exe.4250a40.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d342:$a1: get_encryptedPassword 0x6f562:$a1: get_encryptedPassword 0x2d62b:$a2: get_encryptedUsername 0x6f84b:$a2: get_encryptedUsername 0x2d160:$a3: get_timePasswordChanged 0x6f380:$a3: get_timePasswordChanged 0x2d25b:$a4: get_passwordField 0x6f47b:$a4: get_passwordField 0x2d358:$a5: set_encryptedPassword 0x6f578:$a5: set_encryptedPassword 0x2e985:$a7: get_logins 0x70ba5:$a7: get_logins 0x2e8e8:$a10: KeyLoggerEventArgs 0x70b08:$a10: KeyLoggerEventArgs 0x2e54d:$a11: KeyLoggerEventArgsEventHandler 0x7076d:$a11: KeyLoggerEventArgsEventHandler
0.2.new shipment.exe.4250a40.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ae77:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7d097:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a51a:$a3: \Google\Chrome\User Data\Default\Login Data 0x7c73a:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a777:$a4: \Orbitum\User Data\Default\Login Data 0x7c997:$a4: \Orbitum\User Data\Default\Login Data 0x3b108:$a5: \Kometa\User Data\Default\Login Data 0x7d328:$a5: \Kometa\User Data\Default\Login Data
0.2.new shipment.exe.4250a40.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2df24:$s1: UnHook 0x70144:$s1: UnHook 0x2df2b:$s2: SetHook 0x7014b:$s2: SetHook 0x2df33:$s3: CallNextHook 0x70153:$s3: CallNextHook 0x2df40:$s4: _hook 0x70160:$s4: _hook
0.2.new shipment.exe.4119770.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.new shipment.exe.4119770.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.new shipment.exe.4119770.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.new shipment.exe.4119770.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.new shipment.exe.4119770.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1221e2:$a1: get_encryptedPassword 0x164612:$a1: get_encryptedPassword 0x1a6832:$a1: get_encryptedPassword 0x1224cb:$a2: get_encryptedUsername 0x1648fb:$a2: get_encryptedUsername 0x1a6b1b:$a2: get_encryptedUsername 0x122000:$a3: get_timePasswordChanged 0x164430:$a3: get_timePasswordChanged 0x1a6650:$a3: get_timePasswordChanged 0x1220fb:$a4: get_passwordField 0x16452b:$a4: get_passwordField 0x1a674b:$a4: get_passwordField 0x1221f8:$a5: set_encryptedPassword 0x164628:$a5: set_encryptedPassword 0x1a6848:$a5: set_encryptedPassword 0x123825:$a7: get_logins 0x165c55:$a7: get_logins 0x1a7e75:$a7: get_logins 0x123788:$a10: KeyLoggerEventArgs 0x165bb8:$a10: KeyLoggerEventArgs 0x1a7dd8:$a10: KeyLoggerEventArgs
0.2.new shipment.exe.4119770.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x122dc4:$s1: UnHook 0x1651f4:$s1: UnHook 0x1a7414:$s1: UnHook 0x122dcb:$s2: SetHook 0x1651fb:$s2: SetHook 0x1a741b:$s2: SetHook 0x122dd3:$s3: CallNextHook 0x165203:$s3: CallNextHook 0x1a7423:$s3: CallNextHook 0x122de0:$s4: _hook 0x165210:$s4: _hook 0x1a7430:$s4: _hook
0.2.new shipment.exe.420e610.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.new shipment.exe.420e610.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.new shipment.exe.420e610.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.new shipment.exe.420e610.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.new shipment.exe.420e610.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d342:$a1: get_encryptedPassword 0x6f772:$a1: get_encryptedPassword 0xb1992:$a1: get_encryptedPassword 0x2d62b:$a2: get_encryptedUsername 0x6fa5b:$a2: get_encryptedUsername 0xb1c7b:$a2: get_encryptedUsername 0x2d160:$a3: get_timePasswordChanged 0x6f590:$a3: get_timePasswordChanged 0xb17b0:$a3: get_timePasswordChanged 0x2d25b:$a4: get_passwordField 0x6f68b:$a4: get_passwordField 0xb18ab:$a4: get_passwordField 0x2d358:$a5: set_encryptedPassword 0x6f788:$a5: set_encryptedPassword 0xb19a8:$a5: set_encryptedPassword 0x2e985:$a7: get_logins 0x70db5:$a7: get_logins 0xb2fd5:$a7: get_logins 0x2e8e8:$a10: KeyLoggerEventArgs 0x70d18:$a10: KeyLoggerEventArgs 0xb2f38:$a10: KeyLoggerEventArgs
0.2.new shipment.exe.420e610.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ae77:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7d2a7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xbf4c7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a51a:$a3: \Google\Chrome\User Data\Default\Login Data 0x7c94a:$a3: \Google\Chrome\User Data\Default\Login Data 0xbeb6a:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a777:$a4: \Orbitum\User Data\Default\Login Data 0x7cba7:$a4: \Orbitum\User Data\Default\Login Data 0xbedc7:$a4: \Orbitum\User Data\Default\Login Data 0x3b108:$a5: \Kometa\User Data\Default\Login Data 0x7d538:$a5: \Kometa\User Data\Default\Login Data 0xbf758:$a5: \Kometa\User Data\Default\Login Data
0.2.new shipment.exe.420e610.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2df24:$s1: UnHook 0x70354:$s1: UnHook 0xb2574:$s1: UnHook 0x2df2b:$s2: SetHook 0x7035b:$s2: SetHook 0xb257b:$s2: SetHook 0x2df33:$s3: CallNextHook 0x70363:$s3: CallNextHook 0xb2583:$s3: CallNextHook 0x2df40:$s4: _hook 0x70370:$s4: _hook 0xb2590:$s4: _hook
Click to see the 34 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://aborters.duckdns.org:8081	URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081	URL Reputation: Label: malware

Found malware configuration

Source: 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "6836590615:AAFwcOu-vD49QRMuWGekV93uJdtVWmZdWUw", "Chat_id": "5007084465", "Version": "4.4"}
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "6836590615:AAFwcOu-vD49QRMuWGekV93uJdtVWmZdWUw", "Chat id": "5007084465", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: new shipment.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: new shipment.exe

Joe Sandbox ML: detected

Source: new shipment.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Users\user\Desktop\new shipment.PDB source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Xml.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.pdbSystem.Core.ni.dll source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: new shipment.exe, 00000000.00000002.2602151937.0000000005BE0000.00000004.08000000.00040000.00000000.sdmp, new shipment.exe, 00000000.00000002.2598678318.0000000003134000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: new shipment.exe, 00000002.00000002.1448853295.00000000011F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: C:\Users\user\Desktop\new shipment.PDB source: new shipment.exe, 00000002.00000002.1448853295.00000000011F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Xml.pdbL0Tw# source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb9\,( source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: HPHo0C:\Windows\mscorlib.pdb source: new shipment.exe, 00000002.00000002.1448853295.00000000011F7000.00000004.00000010.00020000.00000000.sdmp

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

IP Address: 132.226.8.169 132.226.8.169

Source: unknown

DNS query: name: checkip.dyndns.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: checkip.dyndns.org

Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: new shipment.exe, 00000002.00000002.1450342369.00000000036D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: new shipment.exe, 00000002.00000002.1450342369.00000000036D6000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1450342369.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: new shipment.exe PID: 5476, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: new shipment.exe PID: 1464, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\new shipment.exe	Code function: 0_2_06498C80	0_2_06498C80
Source: C:\Users\user\Desktop\new shipment.exe	Code function: 2_2_018939F0	2_2_018939F0
Source: C:\Users\user\Desktop\new shipment.exe	Code function: 2_2_01893E09	2_2_01893E09
Source: C:\Users\user\Desktop\new shipment.exe	Code function: 2_2_018929EC	2_2_018929EC

Source: C:\Users\user\Desktop\new shipment.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 1528

Source: new shipment.exe, 00000000.00000002.2597016395.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs new shipment.exe
Source: new shipment.exe, 00000000.00000002.2602151937.0000000005BE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs new shipment.exe
Source: new shipment.exe, 00000000.00000000.1334745220.0000000000D12000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePvI.exe( vs new shipment.exe
Source: new shipment.exe, 00000000.00000002.2600980391.00000000057A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs new shipment.exe
Source: new shipment.exe, 00000000.00000002.2598678318.0000000003134000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs new shipment.exe
Source: new shipment.exe, 00000000.00000002.2598678318.0000000003134000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs new shipment.exe
Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs new shipment.exe
Source: new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs new shipment.exe
Source: new shipment.exe, 00000002.00000002.1448682843.0000000000444000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs new shipment.exe
Source: new shipment.exe, 00000002.00000002.1448957285.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs new shipment.exe
Source: new shipment.exe	Binary or memory string: OriginalFilenamePvI.exe( vs new shipment.exe

Source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: new shipment.exe PID: 5476, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: new shipment.exe PID: 1464, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.new shipment.exe.57a0000.5.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, mm-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, mm-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, mm-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, mm-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.new shipment.exe.4119770.2.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.new shipment.exe.57a0000.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.new shipment.exe.4250a40.4.raw.unpack, -.cs	Base64 encoded string: 'Po2GZWUhvfUeLnbwmmtuvQoyc0qjrFr4WqeP3QHoVwXCKF0sCMsk3YCon1wvapzc'
Source: 0.2.new shipment.exe.420e610.3.raw.unpack, -.cs	Base64 encoded string: 'Po2GZWUhvfUeLnbwmmtuvQoyc0qjrFr4WqeP3QHoVwXCKF0sCMsk3YCon1wvapzc'
Source: 0.2.new shipment.exe.4119770.2.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/5@1/1

Source: C:\Users\user\Desktop\new shipment.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1464

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\00284efd-9f10-4bf1-82ef-f829a9110eaa

Jump to behavior

Source: new shipment.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: new shipment.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\new shipment.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: new shipment.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\new shipment.exe

File read: C:\Users\user\Desktop\new shipment.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\new shipment.exe "C:\Users\user\Desktop\new shipment.exe"
Source: C:\Users\user\Desktop\new shipment.exe	Process created: C:\Users\user\Desktop\new shipment.exe "C:\Users\user\Desktop\new shipment.exe"
Source: C:\Users\user\Desktop\new shipment.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 1528
Source: C:\Users\user\Desktop\new shipment.exe	Process created: C:\Users\user\Desktop\new shipment.exe "C:\Users\user\Desktop\new shipment.exe"	Jump to behavior

Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\new shipment.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\new shipment.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: new shipment.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: new shipment.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Users\user\Desktop\new shipment.PDB source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Xml.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.pdbSystem.Core.ni.dll source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: new shipment.exe, 00000000.00000002.2602151937.0000000005BE0000.00000004.08000000.00040000.00000000.sdmp, new shipment.exe, 00000000.00000002.2598678318.0000000003134000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: new shipment.exe, 00000002.00000002.1448853295.00000000011F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: C:\Users\user\Desktop\new shipment.PDB source: new shipment.exe, 00000002.00000002.1448853295.00000000011F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Xml.pdbL0Tw# source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb9\,( source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER92DB.tmp.dmp.6.dr
Source:	Binary string: HPHo0C:\Windows\mscorlib.pdb source: new shipment.exe, 00000002.00000002.1448853295.00000000011F7000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: new shipment.exe, ExportProvider.cs

.Net Code: CreateExportFactory

Source: new shipment.exe

Static PE information: 0xEA086D61 [Thu Jun 3 16:27:13 2094 UTC]

Source: new shipment.exe

Static PE information: section name: .text entropy: 7.274277592919608

Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\new shipment.exe	Memory allocated: 1630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Memory allocated: 50A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Memory allocated: 1890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Memory allocated: 3610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Memory allocated: 1CA0000 memory reserve \| memory write watch	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: new shipment.exe, 00000002.00000002.1448957285.00000000014D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgura
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\new shipment.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\new shipment.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\new shipment.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\new shipment.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.new shipment.exe.5be0000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.new shipment.exe.5be0000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.new shipment.exe.5be0000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Source: C:\Users\user\Desktop\new shipment.exe

Process created: C:\Users\user\Desktop\new shipment.exe "C:\Users\user\Desktop\new shipment.exe"

Jump to behavior

Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Users\user\Desktop\new shipment.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Users\user\Desktop\new shipment.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new shipment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\new shipment.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 1464, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 1464, type: MEMORYSTR

Source: Yara match	File source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 1464, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 1464, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 2.2.new shipment.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4250a40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.4119770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.new shipment.exe.420e610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new shipment.exe PID: 1464, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
new shipment.exe	50%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
new shipment.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://aborters.duckdns.org:8081	100%	URL Reputation	malware
http://upx.sf.net	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://anotherarmy.dns.army:8081	100%	URL Reputation	malware
http://varders.kozow.com:8081	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
checkip.dyndns.com	132.226.8.169	true	false		unknown
checkip.dyndns.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://aborters.duckdns.org:8081	new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	new shipment.exe, 00000002.00000002.1450342369.00000000036D6000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1450342369.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	new shipment.exe, 00000002.00000002.1450342369.00000000036D6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anotherarmy.dns.army:8081	new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://varders.kozow.com:8081	new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	new shipment.exe, 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, new shipment.exe, 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States		16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520580
Start date and time:	2024-09-27 16:00:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	new shipment.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/5@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 24 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target new shipment.exe, PID 1464 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: new shipment.exe

Simulations

Behavior and APIs

Time	Type	Description
10:01:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	update SOA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	checkip.dyndns.org/
	Payment Advice.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	REMITTANCE ADVICE.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	VbcXXnmIwPPhh.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	SecuriteInfo.com.Trojan.AutoIt.1503.25057.26595.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	update SOA.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	.05.2024.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	132.226.8.169
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Payment Advice.xls	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UTMEMUS	update SOA.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	132.226.8.169
	Payment Advice.xls	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	REMITTANCE ADVICE.xls	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	VbcXXnmIwPPhh.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_new shipment.exe_cf9e7cdece334ae16e292f86892c8231666c6d1_259f3213_27c3b52c-8e6f-4e02-87e9-458d211d40c1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0843703474055533
Encrypted:	false
SSDEEP:	192:mgLEcuuCv3UcgT0BU/HfSa6ce36izuiF8Z24IO82E:mc/wv3UcgABU/aarVizuiF8Y4IO8N
MD5:	028D597EF713A8579B6453E87F54D6E9
SHA1:	DB14A7F943D203FF56EE23CE38EC73889FAF2BB6
SHA-256:	8838A82BF9A8ACD91E057EA5EAEA65625C8FAA6ADB79AE397FD86FC62A7BA557
SHA-512:	F1F14FCEF208EC283E8161A472B7771AC2FCFD317F91CD6352A6A0FE454D50AB6184A12F113B0EBB62C1B8391DBC32FFF04F035AEE33F3BC28E6DFB92F496157
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.9.1.9.2.6.8.7.5.0.5.1.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.9.1.9.2.6.9.3.5.9.8.9.6.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.c.3.b.5.2.c.-.8.e.6.f.-.4.e.0.2.-.8.7.e.9.-.4.5.8.d.2.1.1.d.4.0.c.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.e.6.c.1.5.d.-.8.3.9.6.-.4.d.2.5.-.a.4.e.1.-.6.3.9.1.6.2.4.f.e.b.f.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.n.e.w. .s.h.i.p.m.e.n.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.v.I...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.b.8.-.0.0.0.1.-.0.0.1.4.-.a.c.5.5.-.e.2.b.0.e.5.1.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.e.f.d.9.6.8.8.c.3.6.5.7.8.3.e.7.8.c.c.b.5.6.4.0.4.4.9.5.8.1.9.0.0.0.0.0.0.0.0.!.0.0.0.0.0.c.4.0.6.e.f.1.5.6.6.2.e.8.5.8.0.a.7.2.4.e.f.0.5.d.f.b.0.4.d.7.6.c.2.2.2.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER92DB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Sep 27 14:01:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	268182
Entropy (8bit):	3.772436485471649
Encrypted:	false
SSDEEP:	3072:cNCxiytMQ1YtS2HMjs4uEqKx16LTgOr1a0yB4D:cNCxiZEkMjs4jx2Tgua0yB4
MD5:	6E34D7D6A69F796ADDB0FEE3B30AE135
SHA1:	D6E53BE64A51C79C8C966D0BA25AB90CE6DF50A0
SHA-256:	3B768256CE08010EFFACCD7910B398246E5EDBD9F3D2BDEC76DB81A101B8367D
SHA-512:	912FA2F3EFA0A22A2EDFEE31A5BEF1E6264DBCD78DD417F809C779D2045EE3E893040B6A4F90B7CC5CF5E1A293C6CF36CBF59BCA80352EAD41FF1F31611F2CF1
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........f............D...............X.......<....#.......%...S..........`.......8...........T............;..............,$...........&..............................................................................eJ.......&......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9434.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.6985867804742534
Encrypted:	false
SSDEEP:	192:R6l7wVeJy16j6Yl06djgmfp40dprt89bXTsfu9m:R6lXJQ6j6YW6Jgmfp40qX4fV
MD5:	D1FF7415033550F3B6E5CD63B104C863
SHA1:	B48EC142E68DC35F027F045066F044D19F174F66
SHA-256:	3636A74B30360628142BFE7D1C760145FCB41472E673A22F2310EA2EF1E934B2
SHA-512:	B06D3D97451B00421FA93BBB40274A49D4F0BE08803AD2E38CD0DBD7A0C53D14EFC48E51C6049163B581443EF426BE6CD65E8D67CF05D6B1C6FB2C5C957FC374
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9464.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4663
Entropy (8bit):	4.4700798782418785
Encrypted:	false
SSDEEP:	48:cvIwWl8zscJg77aI9ALWpW8VYjQTYm8M4JPjF/T+q8rwPIUkd:uIjfaI7267VCJFTjgUkd
MD5:	E4D1A2DE5823EFFE467F1827142D4580
SHA1:	CD0D96D9D7520DD31FC743EFD6E2C685B0FE26DE
SHA-256:	1917E949ADBCD291721B4E7A6DCE99D85010652079628C21D64DE2646F468EEE
SHA-512:	1D82CDC90933F89D5E047A249499F14214D0412CEAFC16B928F6E94063164A2AA4F6772C7F5D1FAEB0ED3B716CDA1E15C23C96ABB12B2D451BA26B9C077C7F11
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="518703" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.3941029139287515
Encrypted:	false
SSDEEP:	6144:Rl4fiJoH0ncNXiUjt10qHG/gaocYGBoaUMMhA2NX4WABlBuNAUOBSqa:H4vFHMYQUMM6VFYSUU
MD5:	6583820EEBBDD3487F801682ADCC110F
SHA1:	6A30CDCFAAF3BE368D7B3D80437D1269B6FE74C8
SHA-256:	90ECB12764A60C5E8909CDFB6149FEB6412664A1C2D805C5B4555ECEA151332A
SHA-512:	12983F1E096DE49EFDA4B430C8345686BEFEA068107F9E4D53A1C2508FB580F37E2B2D75D395497A0E86992C5A084A63C3295D4B022F819886A08BF83244289E
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.W..................................................................................................................................................................................................................................................................................................................................................YM..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.267261742054411
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	new shipment.exe
File size:	918'528 bytes
MD5:	41e96a8eabf31d7b5abbeb15d5307b40
SHA1:	0c406ef15662e8580a724ef05dfb04d76c222c9c
SHA256:	d7ea65fb9c018f20cff23dc97bb8a9a6818e97c333a5485142f2e0210be204e1
SHA512:	9912ba11bef1e1b084d88e852e538e054c61878300993a35de859d44c35600d262c43432a76ba72ec087258fcdd20624bdf9faf3f87c34e5dfe17b3d3c824ed4
SSDEEP:	12288:uQTfJcX7m2QriOBq7bP7BqHwd//AulzaeNhmXGj4qTOU:+Xi2DgqBqQhAulzi1yOU
TLSH:	D015BF0537FC022AE9FF4B78E4B12528CABAF845A51FF78D2485A1FD09B37559A50332
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...am............"...0.................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4e18ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEA086D61 [Thu Jun 3 16:27:13 2094 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe1874	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe2000	0x576	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdf8d4	0xdfa00	138ab11e6b6fea585a1b58b8ec615be7	False	0.5358953587898267	data	7.274277592919608	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe2000	0x576	0x600	6bdba2d938cec3a01da651a16db3d6cd	False	0.4088541666666667	data	3.994648161937343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe4000	0xc	0x200	394bd0892562eceabfcf66069ab94f81	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe20a0	0x2ec	data			0.43716577540106955
RT_MANIFEST	0xe238c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 16:01:05.212923050 CEST	49706	80	192.168.2.9	132.226.8.169
Sep 27, 2024 16:01:05.220846891 CEST	80	49706	132.226.8.169	192.168.2.9
Sep 27, 2024 16:01:05.220967054 CEST	49706	80	192.168.2.9	132.226.8.169
Sep 27, 2024 16:01:05.221200943 CEST	49706	80	192.168.2.9	132.226.8.169
Sep 27, 2024 16:01:05.227756023 CEST	80	49706	132.226.8.169	192.168.2.9
Sep 27, 2024 16:01:09.217171907 CEST	80	49706	132.226.8.169	192.168.2.9
Sep 27, 2024 16:01:09.266669035 CEST	49706	80	192.168.2.9	132.226.8.169
Sep 27, 2024 16:01:15.989561081 CEST	49706	80	192.168.2.9	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 16:01:05.197922945 CEST	57994	53	192.168.2.9	1.1.1.1
Sep 27, 2024 16:01:05.206494093 CEST	53	57994	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 16:01:05.197922945 CEST	192.168.2.9	1.1.1.1	0xbac0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 16:01:05.206494093 CEST	1.1.1.1	192.168.2.9	0xbac0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 16:01:05.206494093 CEST	1.1.1.1	192.168.2.9	0xbac0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:01:05.206494093 CEST	1.1.1.1	192.168.2.9	0xbac0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:01:05.206494093 CEST	1.1.1.1	192.168.2.9	0xbac0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:01:05.206494093 CEST	1.1.1.1	192.168.2.9	0xbac0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:01:05.206494093 CEST	1.1.1.1	192.168.2.9	0xbac0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	132.226.8.169	80	1464	C:\Users\user\Desktop\new shipment.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:01:05.221200943 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 27, 2024 16:01:09.217171907 CEST	697	IN	HTTP/1.1 504 Gateway Time-out Date: Fri, 27 Sep 2024 14:01:09 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Target ID:	0
Start time:	10:01:03
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\new shipment.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\new shipment.exe"
Imagebase:	0xd10000
File size:	918'528 bytes
MD5 hash:	41E96A8EABF31D7B5ABBEB15D5307B40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2599288668.00000000040A1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:01:03
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\new shipment.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\new shipment.exe"
Imagebase:	0xf80000
File size:	918'528 bytes
MD5 hash:	41E96A8EABF31D7B5ABBEB15D5307B40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.1448682843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.1450342369.0000000003611000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:01:08
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 1528
Imagebase:	0x140000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.7%
Total number of Nodes:	52
Total number of Limit Nodes:	5

Executed Functions

Function 06498C80 Relevance: .4, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2602514948.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_new shipment.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b4da462863d4447b34520f2f5843eea5b42cc739cfd11cf03cbd0fc4f70efb8e
Instruction ID: b84550306c0af4f9602590b363904b3bff7771736abb49935a94e9c45e1d4533
Opcode Fuzzy Hash: b4da462863d4447b34520f2f5843eea5b42cc739cfd11cf03cbd0fc4f70efb8e
Instruction Fuzzy Hash: 27F15B30A40209CFEF55CFA9C848B9EBBF2BF89304F19855AE405AF355DB71A945CB90

Function 064988E9 Relevance: 1.6, APIs: 1, Instructions: 61
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,06498FA7), ref: 06499A45

Memory Dump Source

Source File: 00000000.00000002.2602514948.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_new shipment.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 07d64483ac02e8c1bfe2290d631a971a53926e37569bd38bc27c84eb360713e0
Instruction ID: 4fb81ce6c743eaeced460c8d509a5839547e269c7438f615a4521f2a98ef1cc7
Opcode Fuzzy Hash: 07d64483ac02e8c1bfe2290d631a971a53926e37569bd38bc27c84eb360713e0
Instruction Fuzzy Hash: AA2153B4C043898FDB11CFAAD840ADEBFF4AB4A214F04845AD458A7201C338A944CFA6

Function 06497030 Relevance: 1.6, APIs: 1, Instructions: 55
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,06498E62,00000000,00000000,040A60D8,0317CAD4), ref: 064992B0

Memory Dump Source

Source File: 00000000.00000002.2602514948.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_new shipment.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 95069f099d5db1128df95f331cd0c8a34b6858b349dfbd4a936df1dffecf769d
Instruction ID: eb47d2355bdc986fa2c0348cb79717595bcaa429649e5c1016a673dbac8a07f6
Opcode Fuzzy Hash: 95069f099d5db1128df95f331cd0c8a34b6858b349dfbd4a936df1dffecf769d
Instruction Fuzzy Hash: 5311E7B5C002499FDB10CF9AD444BDEBBF4EB48310F14846AE954A7251D378A944CFA5

Function 06499240 Relevance: 1.6, APIs: 1, Instructions: 53
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,06498E62,00000000,00000000,040A60D8,0317CAD4), ref: 064992B0

Memory Dump Source

Source File: 00000000.00000002.2602514948.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_new shipment.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 4cf364348ccbb3a8c62192112fe1b75c041618eb7e2e8b7297944764a3c24960
Instruction ID: 14094a4ba72d7a25cc9f61f3075d236a6716444f37dc2a1487141ec1a6ddab9d
Opcode Fuzzy Hash: 4cf364348ccbb3a8c62192112fe1b75c041618eb7e2e8b7297944764a3c24960
Instruction Fuzzy Hash: 201123B5C002499FDB10CF9AD884BDEBBF4EB08320F14842AE958A3251C378A944CFA1

Function 02F8E398 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F8E3FE

Memory Dump Source

Source File: 00000000.00000002.2598562040.0000000002F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f80000_new shipment.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f8439a723a0e706edd8d8e58b5ab796078fb2dfe020468bdb31914cf60ab3016
Instruction ID: 5ff4da89d341bd8dd6037194b5081bc68f71770789ae1ca5d11e3626603ff979
Opcode Fuzzy Hash: f8439a723a0e706edd8d8e58b5ab796078fb2dfe020468bdb31914cf60ab3016
Instruction Fuzzy Hash: 16111DB6C003498FDB10DF9AC544BDEFBF4AB88224F10846AE929A7600C379A545CFA1

Function 064988AC Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,06498FA7), ref: 06499A45

Memory Dump Source

Source File: 00000000.00000002.2602514948.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_new shipment.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: e16f86c57ddac14d65422beaf71075ec11588e86882954c118d01117568365c5
Instruction ID: e0b6024b18d1f409bdf7e893a805425b716dad6ad91b853fdf2bbe276c515708
Opcode Fuzzy Hash: e16f86c57ddac14d65422beaf71075ec11588e86882954c118d01117568365c5
Instruction Fuzzy Hash: 9F111DB0C006898FDB10CF9AD844BDEFBF4EB48210F14842AE818A3300D378A944CFA5

Function 064914D0 Relevance: 1.5, APIs: 1, Instructions: 45
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32 ref: 0649152D

Memory Dump Source

Source File: 00000000.00000002.2602514948.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_new shipment.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e98d9b7dcc1719bfa15908629385195343a2aa02c9077c1eea9ec89033074c29
Instruction ID: 07754f617e930639dc91ca873464c0c750928b8c3042136103939ea0c5a2e8d6
Opcode Fuzzy Hash: e98d9b7dcc1719bfa15908629385195343a2aa02c9077c1eea9ec89033074c29
Instruction Fuzzy Hash: CF1130B1C003498FDB20DF9AD848BCEBBF4AB48220F20845AD419A3300D378A940CFA5

Function 064999E1 Relevance: 1.5, APIs: 1, Instructions: 45
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,06498FA7), ref: 06499A45

Memory Dump Source

Source File: 00000000.00000002.2602514948.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_new shipment.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f02baf2a56e049936b998affff7f815e6505d36e852c224332d4f6def8e61742
Instruction ID: 6b70a6495f133a8f6a16fbe39820002204048a8e26cca5c57c6c0cb658e93f63
Opcode Fuzzy Hash: f02baf2a56e049936b998affff7f815e6505d36e852c224332d4f6def8e61742
Instruction Fuzzy Hash: C511FEB5C006898FCB10CF9AD844BCEFBF8EB48314F14842AE418B7640D378A544CFA5

Function 064914D8 Relevance: 1.5, APIs: 1, Instructions: 43
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32 ref: 0649152D

Memory Dump Source

Source File: 00000000.00000002.2602514948.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_new shipment.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f2fb5d43524be7db7cb2714e160cf39c7d3a53a4c09d48fa7a21fc29d7d690ef
Instruction ID: 2223d71a9f0c1d83962beb7fa3a21b3b22c4e2c82fd03ee6fa8121922145e6de
Opcode Fuzzy Hash: f2fb5d43524be7db7cb2714e160cf39c7d3a53a4c09d48fa7a21fc29d7d690ef
Instruction Fuzzy Hash: 98111EB58003498FDB20DF9AD444BDEBBF8AB48320F20845AD519A7340D379AA44CFA5

Function 015CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2597909175.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18f0b174d3d2b6ac3f38427b3e905c5074d57d16ef903cbd70b21f6b0a3319f
Instruction ID: 0368dff18e8aa7bc8d47800f1bef51dfa3541090b2ec61dc034e7fc9ad7de6d8
Opcode Fuzzy Hash: d18f0b174d3d2b6ac3f38427b3e905c5074d57d16ef903cbd70b21f6b0a3319f
Instruction Fuzzy Hash: 2621F1755042449FDB15DF98D4C0B2ABBA5FB84614F24C96DD80A9F282D33AD407CAA2

Function 015CD2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2597909175.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b6eebc5dad5aff561c5e712581f13195f56f36c8069ccb86a93b1826082b8a
Instruction ID: bd8aaff30e74d22b3dde55564bcb2a35872b00239cb29fa22d74b61cef6a266e
Opcode Fuzzy Hash: e8b6eebc5dad5aff561c5e712581f13195f56f36c8069ccb86a93b1826082b8a
Instruction Fuzzy Hash: 2021D1715042449FDB01DF94D9C0B2ABBB5FB84A24F24C97ED8498F282C33AD446CAE2

Function 015CD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2597909175.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d51e70442da87f56c3df077ec59028e18b4f7e9ee2ec9749fe098bc3c1aeb80
Instruction ID: c9a38181cb4f7b46d45c8104a8e7be333200f52da643ff4b93f48a46848a0ee9
Opcode Fuzzy Hash: 6d51e70442da87f56c3df077ec59028e18b4f7e9ee2ec9749fe098bc3c1aeb80
Instruction Fuzzy Hash: 0F2180755093808FCB12CF68D594715BF71FB46214F28C5EED8498F6A7C33A980ACBA2

Function 015CD2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2597909175.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d692a0047d57c856fe9c281bc03ca2a8a9bd8913fa11d24a2e87d76695bbbe94
Instruction ID: 2df0a56f1bc5659500aea7841593146cf023252b29ee17aa275fa7cf8ffe1e72
Opcode Fuzzy Hash: d692a0047d57c856fe9c281bc03ca2a8a9bd8913fa11d24a2e87d76695bbbe94
Instruction Fuzzy Hash: DD11D075504680CFCB02CF54D5C0B19BB71FB84624F28C6AED8494B642C33AD406CBA1

Analysis Process: new shipment.exePID: 1464, Parent PID: 5476COMMON

Executed Functions

Function 018929EC Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541584cd8b8ca34abff7d2b1ae8db0d20ec1e627ac37afb245ad760b1b632591
Instruction ID: 24fa1cb05976d839d8dce2a63aeaa260742f513c73582ae2fbee611aa8f89ac5
Opcode Fuzzy Hash: 541584cd8b8ca34abff7d2b1ae8db0d20ec1e627ac37afb245ad760b1b632591
Instruction Fuzzy Hash: 6F02EE71906795CFCB628F78C45469ABFF1FF4A318B2844EDC445DB222E73A8952CB42

Function 018939F0 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5ae17c56af7723832c1ce9dfd2b3ed43d646c6f72417645b63ea6ebbfaf2b8
Instruction ID: ce34892a399d5bdb810292cd2418f45da657dba2d24a50f0b02ebd7b7e513e7e
Opcode Fuzzy Hash: 5b5ae17c56af7723832c1ce9dfd2b3ed43d646c6f72417645b63ea6ebbfaf2b8
Instruction Fuzzy Hash: 5FB1C13160A7C1DBC7668F38C8552A6BFB1FF4631832C04EDC882CF256DA3A8955DB46

Function 01893E09 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bfe1e679f760e205a6fc4b9267fa6cff355ab146de514546634287db03a8277
Instruction ID: 95dcb64174e8c84d7547067fb1a065855791da862ae5f4965052a862953eff73
Opcode Fuzzy Hash: 0bfe1e679f760e205a6fc4b9267fa6cff355ab146de514546634287db03a8277
Instruction Fuzzy Hash: ED91A334B04219DBDF58EBB4996427E7BB7BFC8700B08856DE542E7388CE3589028B95

Function 01890C8F Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97df7f1ebbaa701d6e10c9e901577de6bced6e528c25e1cd28965acda462154
Instruction ID: af48d5d2c6f96fe0f00b6ce1696367799d88831eca1743d0eb954e5faad90b98
Opcode Fuzzy Hash: f97df7f1ebbaa701d6e10c9e901577de6bced6e528c25e1cd28965acda462154
Instruction Fuzzy Hash: 5B520E74A00219CFDB64DF64E994B9DB7B2FF88301F1495A6D80AA7364EB345E81CF81

Function 01890CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2459a18b7a18b01da9357cf29b37fb335de00abf2dc13e475e19cc75554cc098
Instruction ID: a2445e68fa5677a3ea65144de69f0b6ab0fed1f4cfea5b775d5cb1696494b82f
Opcode Fuzzy Hash: 2459a18b7a18b01da9357cf29b37fb335de00abf2dc13e475e19cc75554cc098
Instruction Fuzzy Hash: 23520074A00219CFDB64DF64E994B9DB7B2FF88301F1495A6D80AA7364EB345E81CF81

Function 01892790 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3dd96fdcc1ce35b72662e2f1931067119b1912b65d6adcf34ba5689c8042225
Instruction ID: 0d4987af188ba80f88036d1a104b4352603290ad2f2a4f608d7d3429695c6c12
Opcode Fuzzy Hash: b3dd96fdcc1ce35b72662e2f1931067119b1912b65d6adcf34ba5689c8042225
Instruction Fuzzy Hash: B5312674D093498FCB05DFB8D8546EDBFB1EF4A304F1441AAC445AB265EB310A45CBA2

Function 018928F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552fd1f3e16949f38da935576ad14a246a5b2abbaa17752b5aa1c046b898bcd2
Instruction ID: 7b805119f8b4d6f65426d8a871c1777120b230ed7a198cbca3905551cd540c40
Opcode Fuzzy Hash: 552fd1f3e16949f38da935576ad14a246a5b2abbaa17752b5aa1c046b898bcd2
Instruction Fuzzy Hash: 45219035A00105AFDF15DF68C890DAE77AAEB9D3A0B14C059E809DB250DB31EE06CBD1

Function 01894285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a4950c45c75db51be0a22099d75e98a393741795f0134e56d5d33089d7d5ff
Instruction ID: d2d9eb4fe809c906ba1412c9e701d1850e4271f81fd0f62720f69b72f3f8c39e
Opcode Fuzzy Hash: a6a4950c45c75db51be0a22099d75e98a393741795f0134e56d5d33089d7d5ff
Instruction Fuzzy Hash: F731B478E01308DFCB44DFA8E59489DBBB2FF49305B2490AAE819AB364D735AD41CF50

Function 018927F0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84aba784e8da7d964fe5b3036276d6e2e96385a74898f085994311375d348c0d
Instruction ID: 166b4fe59a4fe9396c8be176feab15f667fa316840a949e45b7c73e467d1e3c9
Opcode Fuzzy Hash: 84aba784e8da7d964fe5b3036276d6e2e96385a74898f085994311375d348c0d
Instruction Fuzzy Hash: 5421E074C0524A8FCB05EFA9D8545EEBFF0BF4A300F1451AAD845F6224EB305A95CBA1

Function 018928A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8e8529d9f494e58489d9429517e606a2ab031663add1fce758a8c01a44ebf3
Instruction ID: 58a0a8639b4622ddf01ee8b10308f30448b84a80deead6eae9b013be1937afa0
Opcode Fuzzy Hash: 6f8e8529d9f494e58489d9429517e606a2ab031663add1fce758a8c01a44ebf3
Instruction Fuzzy Hash: 20E02632D54366CBCB02E7F49C040EEBF34ADD2221B08869BC0A037090EF30221AC3A1

Function 018928B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449692973.0000000001890000.00000040.00000800.00020000.00000000.sdmp, Offset: 01890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1890000_new shipment.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597cc4fb2efa8076280a7e927ea6b37c7d1adbdcdc63a71976004f76a5d58e09
Instruction ID: a7925a47f84833d748cca345b0d4b124d72dd65a835aba162b19291c4699523a
Opcode Fuzzy Hash: 597cc4fb2efa8076280a7e927ea6b37c7d1adbdcdc63a71976004f76a5d58e09
Instruction Fuzzy Hash: D8D01732D2022A979B10AAA9DC048EEBB38EE96621B908626D52437140EB70265986B1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report new shipment.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_new shipment.exe_cf9e7cdece334ae16e292f86892c8231666c6d1_259f3213_27c3b52c-8e6f-4e02-87e9-458d211d40c1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER92DB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9434.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9464.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
new shipment.exe

Function 06498C80 Relevance: .4, Instructions: 396
COMMON

Function 064988E9 Relevance: 1.6, APIs: 1, Instructions: 61
windowCOMMON

Function 06497030 Relevance: 1.6, APIs: 1, Instructions: 55
windowCOMMON

Function 06499240 Relevance: 1.6, APIs: 1, Instructions: 53
windowCOMMON

Function 02F8E398 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 064988AC Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Function 064914D0 Relevance: 1.5, APIs: 1, Instructions: 45
comCOMMON

Function 064999E1 Relevance: 1.5, APIs: 1, Instructions: 45
windowCOMMON

Function 064914D8 Relevance: 1.5, APIs: 1, Instructions: 43
comCOMMON