Comprobante de pago - Banco BBVA-344556566.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (2)

• C:\WINDOWS\SysWOW64\WerFault.exe
• C:\argus-vr-agent\quarantine\37887878c4725592d59a8784102dcc5355d6303a42d048fab2fb6fce7cb5939d_7z\Comprobante de pago - Banco BBVA-344556566.exe

MITRE ATT&CK

Indicators of Compromise (defanged)

• 0c055a6c37a3bcac283e9aa8815e1e01
• a687f253ecf2e5f82dba73c198c1dc4f436b8588

IOCs (JSON)Copy

{
  "sha256": "c95048957b30f2101720abdcff23a17c52ad35241dcda2fcafab3376015ee882",
  "verdict": "suspicious",
  "confidence": 80,
  "signals": [
    "child-processes",
    "packed"
  ],
  "attack": [
    "T1059",
    "T1027.002"
  ],
  "children": [
    "C:\\WINDOWS\\SysWOW64\\WerFault.exe",
    "C:\\argus-vr-agent\\quarantine\\37887878c4725592d59a8784102dcc5355d6303a42d048fab2fb6fce7cb5939d_7z\\Comprobante de pago - Banco BBVA-344556566.exe"
  ]
}