Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

JULY SOA.exe

Status: finished
Submission Time: 2022-08-08 18:19:04 +02:00
Malicious
Trojan
Adware
Spyware
Evader
AgentTesla

Comments

Tags

  • agenttesla
  • exe

Details

  • Analysis ID:
    680518
  • API (Web) ID:
    1048024
  • Analysis Started:
    2022-08-08 18:19:05 +02:00
  • Analysis Finished:
    2022-08-08 18:29:27 +02:00
  • MD5:
    c059fd1e2ec2df2b8e4af62359868b1b
  • SHA1:
    5cfadf7c20971459dadeae535e61bcc6b6175df0
  • SHA256:
    6c9947dd57c1a90267929341ffb0a7ff7f225156748160852a78dd83d6943578
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 42/71
malicious
Score: 16/41

IPs

IP Country Detection
174.136.29.110
 United States

Domains

Name IP Detection
mail.palumalimited.com
 0.0.0.0
palumalimited.com
 174.136.29.110
windowsupdatebg.s.llnwi.net
 178.79.225.128

URLs

Name Detection
http://www.fonts.com
http://ocsp.accv.es0
https://api.ipify.org%appdata
Click to see the 97 hidden entries
http://www.fontbureau.comTTFq
http://www.ancert.com/cps0
http://www.oaticerts.com/repository.
http://www.founder.com.cn/cnLog
http://www.fontbureau.comsiva
http://www.anf.es/AC/RC/ocsp0c
http://www.fonts.comx
http://certs.oaticerts.com/repository/OATICA2.crt08
http://www.urwpp.de
http://www.sandoll.co.kr
http://www.founder.com.cn/cni:
http://DynDns.comDynDNSnamejidpasswordPsi/Psi
http://x1.i.lencr.org/0
http://x1.c.lencr.org/0
http://www.quovadisglobal.com/cps0
http://www.carterandcone.comyle
https://web.certicamara.com/marco-legal0Z
http://www.fontbureau.comF6
http://fontfabrik.com
http://www.typography.netD
http://www.rcsc.lt/repository0
http://www.agesic.gub.uy/acrn/acrn.crl0)
http://crl.defence.gov.au/pki0
http://www.e-me.lv/repository0
http://127.0.0.1:HTTP/1.1
http://www.comsign.co.il/cps0
http://www.founder.com.cn/cnu-e
http://www.datev.de/zertifikat-policy-bt0
http://www.cert.fnmt.es/dpcs/0
http://www.pki.gva.es/cps0%
http://www.fontbureau.comdsed
http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
https://www.catcert.net/verarrel05
http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
http://www.firmaprofesional.com/cps0
http://www.monotype.
http://www.fontbureau.com/designers/cabarga.html
http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/cabarga.htmlN
http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
http://www.datev.de/zertifikat-policy-std0
http://eca.hinet.net/repository/CRL2/CA.crl0
http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
http://www.echoworx.com/ca/root2/cps.pdf0
http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
http://www.disig.sk/ca/crl/ca_disig.crl0
http://www.sandoll.co.krt
http://cps.letsencrypt.org0
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
https://www.anf.es/address/)1(0&
http://www.anf.es/es/address-direccion.html
http://policy.camerfirma.com0
http://pki.registradores.org/normativa/index.htm0
https://api.ipify.org%
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.zhongyicts.com.cn
http://www.galapagosdesign.com/DPlease
http://www.tiro.comco
http://crl.ssc.lt/root-b/cacrl.crl0
http://www.suscerte.gob.ve/dpc0
http://ca.disig.sk/ca/crl/ca_disig.crl0
http://crl.ssc.lt/root-c/cacrl.crl0
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
http://www.fontbureau.com/designers
http://repository.swisssign.com/0
http://www.chambersign.org1
http://crl.dhimyotis.com/certignarootca.crl0
http://www.fontbureau.comd=
http://ocsp.suscerte.gob.ve0
http://www.certplus.com/CRL/class3.crl0
http://www.fontbureau.comcomaF
http://mail.palumalimited.com
http://www.acabogacia.org0
http://www.founder.com.cn/cns-ez
http://www.founder.com.cn/cn/bThe
http://www.datev.de/zertifikat-policy-int0
http://web.ncdc.gov.sa/crl/nrcaparta1.crl
http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
http://www.accv.es00
http://certs.oati.net/repository/OATICA2.crt0
http://certs.oaticerts.com/repository/OATICA2.crl
https://eca.hinet.net/repository0
http://crl.oces.trust2408.com/oces.crl0
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
http://ac.economia.gob.mx/last.crl0G
http://www.carterandcone.coml
http://www.globaltrust.info0
https://www.anf.es/AC/ANFServerCA.crl0
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
https://wwww.certigna.fr/autorites/0m
http://www.sandoll.co.krq
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
http://www.certicamara.com/dpc/0Z

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JULY SOA.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp3EB6.tmp
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Roaming\DnDcR\DnDcR.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
Click to see the 7 hidden entries
C:\Users\user\AppData\Roaming\DnDcR\DnDcR.exe:Zone.Identifier
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Roaming\qOHVWexsnI.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Windows\System32\drivers\etc\hosts
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
 Microsoft Cabinet archive data, 61712 bytes, 1 file
 #
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
 data
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DnDcR.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\tmp158E.tmp
 XML 1.0 document, ASCII text, with CRLF line terminators
 #