EFT-Remittance for Overdue Invoice.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (2)

• C:\Users\researcher\AppData\Local\Okeghem\subbasaltic.exe
• C:\argus-vr-agent\quarantine\0d53d6f713a2b7f20008c3652da422c6293c63ba3ba72fce0cb526e69d39d57d_7z\EFT-Remittance for Overdue Invoice.exe

Dropped files (2)

• C:\Users\researcher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\subbasaltic.vbs
• C:\Users\researcher\AppData\Local\Okeghem\subbasaltic.exe

MITRE ATT&CK

YARA matches

Indicators of Compromise (defanged)

• 174bffb9781b6f4e455bba193a6921f57bc7f079
• 4356632cd55a6b5f7b9f49dc17ccee00
• C:\Users\researcher\AppData\Local\Okeghem\subbasaltic.exe
• C:\Users\researcher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\subbasaltic.vbs

IOCs (JSON)Copy

{
  "sha256": "62c6436c72f6e31fe3598b4e79600f6262a5fcce63fe6a780e6644669f2b5e63",
  "verdict": "suspicious",
  "confidence": 95,
  "signals": [
    "yara-match",
    "executable-drop",
    "child-processes"
  ],
  "attack": [
    "T1105",
    "T1059"
  ],
  "dropped": [
    "C:\\Users\\researcher\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\subbasaltic.vbs",
    "C:\\Users\\researcher\\AppData\\Local\\Okeghem\\subbasaltic.exe"
  ],
  "children": [
    "C:\\Users\\researcher\\AppData\\Local\\Okeghem\\subbasaltic.exe",
    "C:\\argus-vr-agent\\quarantine\\0d53d6f713a2b7f20008c3652da422c6293c63ba3ba72fce0cb526e69d39d57d_7z\\EFT-Remittance for Overdue Invoice.exe"
  ]
}