Edit tour

Windows Analysis Report
New shipment AWB NO - 09804480383.exe

Overview

General Information

Sample name:	New shipment AWB NO - 09804480383.exe
Analysis ID:	1562198
MD5:	9cc05f64e356b945babe74affd290f68
SHA1:	a68db5877b42bfc24c6772f19e168fd7fb50a2c1
SHA256:	252e7708de6bd7a39023a8a45d04bf5beddde51eeddc5782465b00c115d3a98e
Tags:	exeuser-cocaman
Infos:

Detection

Snake Keylogger

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

New shipment AWB NO - 09804480383.exe (PID: 6976 cmdline: "C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe" MD5: 9CC05F64E356B945BABE74AFFD290F68)

New shipment AWB NO - 09804480383.exe (PID: 2012 cmdline: "C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe" MD5: 9CC05F64E356B945BABE74AFFD290F68)

WerFault.exe (PID: 3460 cmdline: C:\Windows\system32\WerFault.exe -u -p 2012 -s 12 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7399492470:AAF1Q52TLq6uEICFiCVrLu9dpROnjh2wukI/sendMessage?chat_id=1443320838", "Token": "7399492470:AAF1Q52TLq6uEICFiCVrLu9dpROnjh2wukI", "Chat_id": "1443320838", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1b6b44:$a1: get_encryptedPassword 0x1d7584:$a1: get_encryptedPassword 0x1f7dbc:$a1: get_encryptedPassword 0x1b6e30:$a2: get_encryptedUsername 0x1d7870:$a2: get_encryptedUsername 0x1f80a8:$a2: get_encryptedUsername 0x1b6950:$a3: get_timePasswordChanged 0x1d7390:$a3: get_timePasswordChanged 0x1f7bc8:$a3: get_timePasswordChanged 0x1b6a4b:$a4: get_passwordField 0x1d748b:$a4: get_passwordField 0x1f7cc3:$a4: get_passwordField 0x1b6b5a:$a5: set_encryptedPassword 0x1d759a:$a5: set_encryptedPassword 0x1f7dd2:$a5: set_encryptedPassword 0x1b81f5:$a7: get_logins 0x1d8c35:$a7: get_logins 0x1f946d:$a7: get_logins 0x1b8158:$a10: KeyLoggerEventArgs 0x1d8b98:$a10: KeyLoggerEventArgs 0x1f93d0:$a10: KeyLoggerEventArgs
00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1bbb08:$x1: $%SMTPDV$ 0x1dc548:$x1: $%SMTPDV$ 0x1fcd80:$x1: $%SMTPDV$ 0x1ba4ec:$x2: $#TheHashHere%& 0x1daf2c:$x2: $#TheHashHere%& 0x1fb764:$x2: $#TheHashHere%& 0x1bbab0:$x3: %FTPDV$ 0x1dc4f0:$x3: %FTPDV$ 0x1fcd28:$x3: %FTPDV$ 0x1ba48c:$x4: $%TelegramDv$ 0x1daecc:$x4: $%TelegramDv$ 0x1fb704:$x4: $%TelegramDv$ 0x1b7dc3:$x5: KeyLoggerEventArgs 0x1b8158:$x5: KeyLoggerEventArgs 0x1d8803:$x5: KeyLoggerEventArgs 0x1d8b98:$x5: KeyLoggerEventArgs 0x1f903b:$x5: KeyLoggerEventArgs 0x1f93d0:$x5: KeyLoggerEventArgs 0x1bbad4:$m2: Clipboard Logs ID 0x1bbd12:$m2: Screenshot Logs ID 0x1bbe22:$m2: keystroke Logs ID
Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x445ec:$a1: get_encryptedPassword 0x448ce:$a2: get_encryptedUsername 0x44402:$a3: get_timePasswordChanged 0x444fd:$a4: get_passwordField 0x44602:$a5: set_encryptedPassword 0x46ae2:$a7: get_logins 0x46a45:$a10: KeyLoggerEventArgs 0x466b0:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x466b0:$x5: KeyLoggerEventArgs 0x46a45:$x5: KeyLoggerEventArgs 0x4701b:$x5: KeyLoggerEventArgs 0x4737c:$x5: KeyLoggerEventArgs 0x48c74:$m2: Clipboard Logs ID 0x48d7a:$m2: Screenshot Logs ID 0x48dd0:$m2: keystroke Logs ID 0x48f05:$m3: SnakePW 0x48d66:$m4: \SnakeKeylogger\
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c84:$a1: get_encryptedPassword 0x12f70:$a2: get_encryptedUsername 0x12a90:$a3: get_timePasswordChanged 0x12b8b:$a4: get_passwordField 0x12c9a:$a5: set_encryptedPassword 0x14335:$a7: get_logins 0x14298:$a10: KeyLoggerEventArgs 0x13f03:$a11: KeyLoggerEventArgsEventHandler
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a5fe:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19830:$a3: \Google\Chrome\User Data\Default\Login Data 0x19c63:$a4: \Orbitum\User Data\Default\Login Data 0x1aca2:$a5: \Kometa\User Data\Default\Login Data
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1386f:$s1: UnHook 0x13876:$s2: SetHook 0x1387e:$s3: CallNextHook 0x1388b:$s4: _hook
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c48:$x1: $%SMTPDV$ 0x1662c:$x2: $#TheHashHere%& 0x17bf0:$x3: %FTPDV$ 0x165cc:$x4: $%TelegramDv$ 0x13f03:$x5: KeyLoggerEventArgs 0x14298:$x5: KeyLoggerEventArgs 0x17c14:$m2: Clipboard Logs ID 0x17e52:$m2: Screenshot Logs ID 0x17f62:$m2: keystroke Logs ID 0x1823c:$m3: SnakePW 0x17e2a:$m4: \SnakeKeylogger\
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c84:$a1: get_encryptedPassword 0x12f70:$a2: get_encryptedUsername 0x12a90:$a3: get_timePasswordChanged 0x12b8b:$a4: get_passwordField 0x12c9a:$a5: set_encryptedPassword 0x14335:$a7: get_logins 0x14298:$a10: KeyLoggerEventArgs 0x13f03:$a11: KeyLoggerEventArgsEventHandler
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a5fe:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19830:$a3: \Google\Chrome\User Data\Default\Login Data 0x19c63:$a4: \Orbitum\User Data\Default\Login Data 0x1aca2:$a5: \Kometa\User Data\Default\Login Data
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1386f:$s1: UnHook 0x13876:$s2: SetHook 0x1387e:$s3: CallNextHook 0x1388b:$s4: _hook
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c48:$x1: $%SMTPDV$ 0x1662c:$x2: $#TheHashHere%& 0x17bf0:$x3: %FTPDV$ 0x165cc:$x4: $%TelegramDv$ 0x13f03:$x5: KeyLoggerEventArgs 0x14298:$x5: KeyLoggerEventArgs 0x17c14:$m2: Clipboard Logs ID 0x17e52:$m2: Screenshot Logs ID 0x17f62:$m2: keystroke Logs ID 0x1823c:$m3: SnakePW 0x17e2a:$m4: \SnakeKeylogger\
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a84:$a1: get_encryptedPassword 0x352bc:$a1: get_encryptedPassword 0x14d70:$a2: get_encryptedUsername 0x355a8:$a2: get_encryptedUsername 0x14890:$a3: get_timePasswordChanged 0x350c8:$a3: get_timePasswordChanged 0x1498b:$a4: get_passwordField 0x351c3:$a4: get_passwordField 0x14a9a:$a5: set_encryptedPassword 0x352d2:$a5: set_encryptedPassword 0x16135:$a7: get_logins 0x3696d:$a7: get_logins 0x16098:$a10: KeyLoggerEventArgs 0x368d0:$a10: KeyLoggerEventArgs 0x15d03:$a11: KeyLoggerEventArgsEventHandler 0x3653b:$a11: KeyLoggerEventArgsEventHandler
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c3fe:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cc36:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b630:$a3: \Google\Chrome\User Data\Default\Login Data 0x3be68:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba63:$a4: \Orbitum\User Data\Default\Login Data 0x3c29b:$a4: \Orbitum\User Data\Default\Login Data 0x1caa2:$a5: \Kometa\User Data\Default\Login Data 0x3d2da:$a5: \Kometa\User Data\Default\Login Data
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1566f:$s1: UnHook 0x35ea7:$s1: UnHook 0x15676:$s2: SetHook 0x35eae:$s2: SetHook 0x1567e:$s3: CallNextHook 0x35eb6:$s3: CallNextHook 0x1568b:$s4: _hook 0x35ec3:$s4: _hook
0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a48:$x1: $%SMTPDV$ 0x3a280:$x1: $%SMTPDV$ 0x1842c:$x2: $#TheHashHere%& 0x38c64:$x2: $#TheHashHere%& 0x199f0:$x3: %FTPDV$ 0x3a228:$x3: %FTPDV$ 0x183cc:$x4: $%TelegramDv$ 0x38c04:$x4: $%TelegramDv$ 0x15d03:$x5: KeyLoggerEventArgs 0x16098:$x5: KeyLoggerEventArgs 0x3653b:$x5: KeyLoggerEventArgs 0x368d0:$x5: KeyLoggerEventArgs 0x19a14:$m2: Clipboard Logs ID 0x19c52:$m2: Screenshot Logs ID 0x19d62:$m2: keystroke Logs ID 0x3a24c:$m2: Clipboard Logs ID 0x3a48a:$m2: Screenshot Logs ID 0x3a59a:$m2: keystroke Logs ID 0x1a03c:$m3: SnakePW 0x3a874:$m3: SnakePW 0x19c2a:$m4: \SnakeKeylogger\
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a84:$a1: get_encryptedPassword 0x354c4:$a1: get_encryptedPassword 0x55cfc:$a1: get_encryptedPassword 0x14d70:$a2: get_encryptedUsername 0x357b0:$a2: get_encryptedUsername 0x55fe8:$a2: get_encryptedUsername 0x14890:$a3: get_timePasswordChanged 0x352d0:$a3: get_timePasswordChanged 0x55b08:$a3: get_timePasswordChanged 0x1498b:$a4: get_passwordField 0x353cb:$a4: get_passwordField 0x55c03:$a4: get_passwordField 0x14a9a:$a5: set_encryptedPassword 0x354da:$a5: set_encryptedPassword 0x55d12:$a5: set_encryptedPassword 0x16135:$a7: get_logins 0x36b75:$a7: get_logins 0x573ad:$a7: get_logins 0x16098:$a10: KeyLoggerEventArgs 0x36ad8:$a10: KeyLoggerEventArgs 0x57310:$a10: KeyLoggerEventArgs
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c3fe:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ce3e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5d676:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b630:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c070:$a3: \Google\Chrome\User Data\Default\Login Data 0x5c8a8:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba63:$a4: \Orbitum\User Data\Default\Login Data 0x3c4a3:$a4: \Orbitum\User Data\Default\Login Data 0x5ccdb:$a4: \Orbitum\User Data\Default\Login Data 0x1caa2:$a5: \Kometa\User Data\Default\Login Data 0x3d4e2:$a5: \Kometa\User Data\Default\Login Data 0x5dd1a:$a5: \Kometa\User Data\Default\Login Data
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1566f:$s1: UnHook 0x360af:$s1: UnHook 0x568e7:$s1: UnHook 0x15676:$s2: SetHook 0x360b6:$s2: SetHook 0x568ee:$s2: SetHook 0x1567e:$s3: CallNextHook 0x360be:$s3: CallNextHook 0x568f6:$s3: CallNextHook 0x1568b:$s4: _hook 0x360cb:$s4: _hook 0x56903:$s4: _hook
0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a48:$x1: $%SMTPDV$ 0x3a488:$x1: $%SMTPDV$ 0x5acc0:$x1: $%SMTPDV$ 0x1842c:$x2: $#TheHashHere%& 0x38e6c:$x2: $#TheHashHere%& 0x596a4:$x2: $#TheHashHere%& 0x199f0:$x3: %FTPDV$ 0x3a430:$x3: %FTPDV$ 0x5ac68:$x3: %FTPDV$ 0x183cc:$x4: $%TelegramDv$ 0x38e0c:$x4: $%TelegramDv$ 0x59644:$x4: $%TelegramDv$ 0x15d03:$x5: KeyLoggerEventArgs 0x16098:$x5: KeyLoggerEventArgs 0x36743:$x5: KeyLoggerEventArgs 0x36ad8:$x5: KeyLoggerEventArgs 0x56f7b:$x5: KeyLoggerEventArgs 0x57310:$x5: KeyLoggerEventArgs 0x19a14:$m2: Clipboard Logs ID 0x19c52:$m2: Screenshot Logs ID 0x19d62:$m2: keystroke Logs ID
Click to see the 21 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7399492470:AAF1Q52TLq6uEICFiCVrLu9dpROnjh2wukI/sendMessage?chat_id=1443320838", "Token": "7399492470:AAF1Q52TLq6uEICFiCVrLu9dpROnjh2wukI", "Chat_id": "1443320838", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: New shipment AWB NO - 09804480383.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: New shipment AWB NO - 09804480383.exe

Joe Sandbox ML: detected

Source: New shipment AWB NO - 09804480383.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: ZEcP.pdbSHA256i source: New shipment AWB NO - 09804480383.exe
Source:	Binary string: ZEcP.pdb source: New shipment AWB NO - 09804480383.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE

Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: New shipment AWB NO - 09804480383.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Code function: 0_2_00007FFD34569118	0_2_00007FFD34569118
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Code function: 0_2_00007FFD34561388	0_2_00007FFD34561388
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Code function: 0_2_00007FFD3456B7F9	0_2_00007FFD3456B7F9

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2012 -s 12

Source: New shipment AWB NO - 09804480383.exe

Static PE information: No import functions for PE file found

Source: New shipment AWB NO - 09804480383.exe, 00000000.00000000.2105943659.00000000008A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZEcP.exe@ vs New shipment AWB NO - 09804480383.exe
Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2151639003.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs New shipment AWB NO - 09804480383.exe
Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2151639003.0000000003A91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs New shipment AWB NO - 09804480383.exe
Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs New shipment AWB NO - 09804480383.exe
Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGreenEnergy.dll@ vs New shipment AWB NO - 09804480383.exe
Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2151639003.0000000003AE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameReactionDiffusion.dll0 vs New shipment AWB NO - 09804480383.exe
Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2155892347.000000001DF40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameReactionDiffusion.dll0 vs New shipment AWB NO - 09804480383.exe
Source: New shipment AWB NO - 09804480383.exe, 00000000.00000002.2156016920.000000001E0E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGreenEnergy.dll@ vs New shipment AWB NO - 09804480383.exe
Source: New shipment AWB NO - 09804480383.exe	Binary or memory string: OriginalFilenameZEcP.exe@ vs New shipment AWB NO - 09804480383.exe

Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: New shipment AWB NO - 09804480383.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, 2-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, 2-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, 2-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, 2-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, ---.cs	Base64 encoded string: 'tPa5k5FJD4dSXw0EqQ2lIcLtrXnSHhm60gt1D+3WpsNqPxTv3g1y5+EIwUawZGy8'
Source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, ---.cs	Base64 encoded string: 'tPa5k5FJD4dSXw0EqQ2lIcLtrXnSHhm60gt1D+3WpsNqPxTv3g1y5+EIwUawZGy8'

Source: classification engine

Classification label: mal92.troj.evad.winEXE@4/1@0/0

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\New shipment AWB NO - 09804480383.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2012

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\5ad194e3-0cf3-4158-b813-a317b73e3a41

Jump to behavior

Source: New shipment AWB NO - 09804480383.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: New shipment AWB NO - 09804480383.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New shipment AWB NO - 09804480383.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe "C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe"
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process created: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe "C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe"
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2012 -s 12
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process created: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe "C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: New shipment AWB NO - 09804480383.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: New shipment AWB NO - 09804480383.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: New shipment AWB NO - 09804480383.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: New shipment AWB NO - 09804480383.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ZEcP.pdbSHA256i source: New shipment AWB NO - 09804480383.exe
Source:	Binary string: ZEcP.pdb source: New shipment AWB NO - 09804480383.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: New shipment AWB NO - 09804480383.exe, LogInGUI.cs

.Net Code: InitializeComponent contains xor as well as GetObject

Source: New shipment AWB NO - 09804480383.exe

Static PE information: 0xC5438A5D [Thu Nov 15 20:04:45 2074 UTC]

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Code function: 0_2_00007FFD345600BD pushad ; iretd

0_2_00007FFD345600C1

Source: New shipment AWB NO - 09804480383.exe

Static PE information: section name: .text entropy: 7.935227027452769

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	File created: \new shipment awb no - 09804480383.exe
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	File created: \new shipment awb no - 09804480383.exe
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	File created: \new shipment awb no - 09804480383.exe	Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Memory allocated: 1B70000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Memory allocated: 1BA90000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe TID: 5852

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Thread register set: target process: 2012

Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Process created: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe "C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe"

Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Queries volume information: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976, type: MEMORYSTR

Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1567bb00.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New shipment AWB NO - 09804480383.exe.1565b0c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New shipment AWB NO - 09804480383.exe PID: 6976, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	41 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New shipment AWB NO - 09804480383.exe	29%	ReversingLabs
New shipment AWB NO - 09804480383.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
http://checkip.dyndns.org/q	New shipment AWB NO - 09804480383.exe, 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/DataSet1.xsd	New shipment AWB NO - 09804480383.exe	false	high
https://reallyfreegeoip.org/xml/	New shipment AWB NO - 09804480383.exe, 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562198
Start date and time:	2024-11-25 10:36:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New shipment AWB NO - 09804480383.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@4/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 51% Number of executed functions: 4 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
VT rate limit hit for: New shipment AWB NO - 09804480383.exe

Simulations

Behavior and APIs

Time	Type	Description
04:36:53	API Interceptor	1x Sleep call for process: New shipment AWB NO - 09804480383.exe modified

Process:	C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	5.380493107040482
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNl+84xp3/VclT:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAA
MD5:	3C7E5782E6C100B90932CBDED08ADE42
SHA1:	D498EE0833BB8C85592FB3B1E482267362DB3F74
SHA-256:	361A6FF160343A2400F7D3FA4A009EA20C994B9788C190EB9D53E544BB376490
SHA-512:	3A90D61631F4DC920860AEA31FDB5E56A102206311705D5D084E809D364F680B4E95F19CE9849D3F9CB3C2C273393FD2F2C67720BAAA885125EE358D59462B0A
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.928156581458441
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	New shipment AWB NO - 09804480383.exe
File size:	653'824 bytes
MD5:	9cc05f64e356b945babe74affd290f68
SHA1:	a68db5877b42bfc24c6772f19e168fd7fb50a2c1
SHA256:	252e7708de6bd7a39023a8a45d04bf5beddde51eeddc5782465b00c115d3a98e
SHA512:	6be8949d64562a86ed6d09e11d7a5ce89786b4d0c375bde549c2e715fdf67eeeeb5fc19c9d38c34883c5f0193bd06de1e61ddeb3a321348e0be90c8677801077
SSDEEP:	12288:XaoRh3o4DPX9ule6XSP8a3NcVuf0Kcs6sZO42ixZEVcD3476jJDQT:XVRh3oCshXS8a3NyusKcYj2ixGVc076m
TLSH:	D5D41212367C5F63C67D03F6AA29E34403F351139276F6980EC674EA1A53F128A52FA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...].C..........."...0.................. .....@..... .......................@............@...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC5438A5D [Thu Nov 15 20:04:45 2074 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa2000	0x628	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9e550	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9ef9c	0x9f000	efaee6b22300a2c6c0cc2236f846797a	False	0.9427098688089622	data	7.935227027452769	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa2000	0x628	0x800	71f9091570a1383d9d991606bfe73793	False	0.337890625	data	3.4596349237634496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa2090	0x398	OpenPGP Public Key			0.42282608695652174
RT_MANIFEST	0xa2438	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Target ID:	0
Start time:	04:36:53
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe"
Imagebase:	0x800000
File size:	653'824 bytes
MD5 hash:	9CC05F64E356B945BABE74AFFD290F68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2152724106.00000000154B9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:36:57
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\New shipment AWB NO - 09804480383.exe"
Imagebase:	0x160000
File size:	653'824 bytes
MD5 hash:	9CC05F64E356B945BABE74AFFD290F68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:36:57
Start date:	25/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2012 -s 12
Imagebase:	0x7ff6131a0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD34569118 Relevance: 3.1, Strings: 2, Instructions: 577
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`M`4, xrefs: 00007FFD34569109
pM`4, xrefs: 00007FFD34569119

Memory Dump Source

Source File: 00000000.00000002.2156955688.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34560000_New shipment AWB NO - 09804480383.jbxd

Similarity

API ID:
String ID: `M`4$pM`4
API String ID: 0-2145051569
Opcode ID: 8a04fafd69f41e8fe78ddb203d67a5db3ab549e17e1b2c43b0de0b90472f01ea
Instruction ID: a8715ec20e68cd9a2df066bf7c747172b266140232273310689363bcedb6a9b5
Opcode Fuzzy Hash: 8a04fafd69f41e8fe78ddb203d67a5db3ab549e17e1b2c43b0de0b90472f01ea
Instruction Fuzzy Hash: 0512BF71E0C5598FDB66DF6898A52E9B7E0FF5A320F0441BAC14CE7292DE3C69858F40

Function 00007FFD3456B7F9 Relevance: 3.0, Strings: 2, Instructions: 492
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2!D4, xrefs: 00007FFD3456BBE3
2!D4, xrefs: 00007FFD3456BDC0

Memory Dump Source

Source File: 00000000.00000002.2156955688.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34560000_New shipment AWB NO - 09804480383.jbxd

Similarity

API ID:
String ID: 2!D4$2!D4
API String ID: 0-519070062
Opcode ID: d443a6cd57f42d42a91870e91d4d3a8a5023bcacf95e4640da7078f0276f4591
Instruction ID: 9ada3a49ea52fcb969cf9f168dc76ad9eea6d0222fe05460a35474ef333ce9c6
Opcode Fuzzy Hash: d443a6cd57f42d42a91870e91d4d3a8a5023bcacf95e4640da7078f0276f4591
Instruction Fuzzy Hash: 9FF10561D0D2964FEB2BD72888A16643FB0EF53310F1855BBC189CB1E3EE2C550A8792

Function 00007FFD34561388 Relevance: .6, Instructions: 633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2156955688.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34560000_New shipment AWB NO - 09804480383.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa922380de199c75dc4e682923851a07ac99828eefed2f5448f320a53b6e22e
Instruction ID: c7e85e64914465bd8ede867e434eb2ff0aeed1b966d064a90996572c83812920
Opcode Fuzzy Hash: baa922380de199c75dc4e682923851a07ac99828eefed2f5448f320a53b6e22e
Instruction Fuzzy Hash: A032EB30E18A1D8FDB99EF58C499AA9B7B1FF59304F1001B9D04DE7296CF39A981CB40

Function 00007FFD3457B75C Relevance: 1.8, APIs: 1, Instructions: 295
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FFD3457B9D6

Memory Dump Source

Source File: 00000000.00000002.2156955688.00007FFD34560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34560000_New shipment AWB NO - 09804480383.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 077286ea488cac8a42d7336c1fb385e87249d6087aff1ebed49fb2ab398e668f
Instruction ID: 7b4ceb9ec4adfbb5479c8466ca80b234378df2b185557cdf2a04b4e29b042687
Opcode Fuzzy Hash: 077286ea488cac8a42d7336c1fb385e87249d6087aff1ebed49fb2ab398e668f
Instruction Fuzzy Hash: 3AA13C70A18A8D8FEBB8DF18C894BE877E1FB59305F10412ED84EDB691CB789584CB45

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New shipment AWB NO - 09804480383.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\New shipment AWB NO - 09804480383.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: New shipment AWB NO - 09804480383.exePID: 6976, Parent PID: 4004

Windows Analysis Report
New shipment AWB NO - 09804480383.exe

Function 00007FFD34569118 Relevance: 3.1, Strings: 2, Instructions: 577
COMMON

Function 00007FFD3456B7F9 Relevance: 3.0, Strings: 2, Instructions: 492
COMMON

Function 00007FFD34561388 Relevance: .6, Instructions: 633
COMMON

Function 00007FFD3457B75C Relevance: 1.8, APIs: 1, Instructions: 295
processCOMMON