Windows Analysis Report Purchase Order PO20211027STK.exe

Overview

General Information

Sample Name: Purchase Order PO20211027STK.exe
Analysis ID: 531732
MD5: 2f2102ec5776497950e89e419515efee
SHA1: 1d3dd4ed88af22c3de29c918b37db6f0b73c94c4
SHA256: 7768da29cc4ef93cb4790f664e139d1d8c2972e22fe8840b6b86c50e15dba347
Infos:

Most interesting Screenshot:

Detection

AgentTesla GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected GuLoader
Hides threads from debuggers
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to detect Any.run
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Executable has a suspicious name (potential lure to open the executable)
C2 URLs / IPs found in malware configuration
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Dropped file seen in connection with other malware
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000000A.00000000.214269025674.0000000000F00000.00000040.00000001.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://onedrive.live.com/download?cid=5A15FDA1AE98540B&r"}
Source: SPORENE.exe.2100.4.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "qualitat@construccionsjpallas.comzXHR1YDJL5smtp.construccionsjpallas.comfrankkeneth01@gmail.com"}
Multi AV Scanner detection for submitted file
Source: Purchase Order PO20211027STK.exe ReversingLabs: Detection: 15%

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013D92D0 CryptUnprotectData, 10_2_013D92D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013D99A8 CryptUnprotectData, 10_2_013D99A8

Compliance:

barindex
Uses 32bit PE files
Source: Purchase Order PO20211027STK.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Purchase Order PO20211027STK.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\SPORENE.pdb source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_00406873 FindFirstFileW,FindClose, 2_2_00406873
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 2_2_00405C49
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_0040290B FindFirstFileW, 2_2_0040290B

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.11.20:49839 -> 134.0.9.148:587
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://onedrive.live.com/download?cid=5A15FDA1AE98540B&r
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CDMONsistemescdmoncomES CDMONsistemescdmoncomES
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.11.20:49839 -> 134.0.9.148:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.11.20:49839 -> 134.0.9.148:587
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: CasPol.exe, 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: CasPol.exe, 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp String found in binary or memory: http://SukKLs.com
Source: CasPol.exe, 0000000A.00000002.219005375157.00000000010E9000.00000004.00000020.sdmp, CasPol.exe, 0000000A.00000003.214542533887.00000000010EB000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.214536706012.00000000010EB000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.214542972543.00000000010ED000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.214536282271.00000000010F0000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 0000000A.00000002.219005375157.00000000010E9000.00000004.00000020.sdmp, CasPol.exe, 0000000A.00000003.214542533887.00000000010EB000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.214536706012.00000000010EB000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.214542972543.00000000010ED000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.214536282271.00000000010F0000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Purchase Order PO20211027STK.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr String found in binary or memory: http://s.symcd.com06
Source: CasPol.exe, 0000000A.00000002.219017335150.000000001E078000.00000004.00000001.sdmp String found in binary or memory: http://smtp.construccionsjpallas.com
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: CasPol.exe, 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%4
Source: CasPol.exe, 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: CasPol.exe, 0000000A.00000002.219017335150.000000001E078000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.215446466845.000000001CDB1000.00000004.00000001.sdmp String found in binary or memory: https://bBdyMHz8DHQmQ5qFFNz.net
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr String found in binary or memory: https://d.symcb.com/cps0%
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr String found in binary or memory: https://d.symcb.com/rpa0
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr String found in binary or memory: https://d.symcb.com/rpa0.
Source: CasPol.exe, 0000000A.00000003.214542972543.00000000010ED000.00000004.00000001.sdmp String found in binary or memory: https://ervtqq.bl.files.1drv.com/
Source: CasPol.exe, 0000000A.00000003.214536706012.00000000010EB000.00000004.00000001.sdmp String found in binary or memory: https://ervtqq.bl.files.1drv.com/.
Source: CasPol.exe, 0000000A.00000002.219005375157.00000000010E9000.00000004.00000020.sdmp, CasPol.exe, 0000000A.00000003.214542533887.00000000010EB000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.214542972543.00000000010ED000.00000004.00000001.sdmp String found in binary or memory: https://ervtqq.bl.files.1drv.com/y4mRWRDE7pcrW6w0EUTN84QjMAtO1dpCLEwXIJU8OszKkAmv-_nhkZHLAvXSNrUdeon
Source: CasPol.exe, 0000000A.00000003.214542972543.00000000010ED000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000003.214536282271.00000000010F0000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219005034724.00000000010A4000.00000004.00000020.sdmp String found in binary or memory: https://ervtqq.bl.files.1drv.com/y4mjsZiy6S_ONFJ1Il5BkM5ipQEe7rgpRSJNcHXx-eH9OxEQcwqSz5uJCiVh7AEhgFP
Source: CasPol.exe, 0000000A.00000002.219004779835.000000000106B000.00000004.00000020.sdmp String found in binary or memory: https://onedrive.live.com/
Source: CasPol.exe, 0000000A.00000002.219005034724.00000000010A4000.00000004.00000020.sdmp String found in binary or memory: https://onedrive.live.com/download?cid=5A15FDA1AE98540B&resid=5A15FDA1AE98540B%21126&authkey=AMKTKwd
Source: CasPol.exe, 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: onedrive.live.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 2_2_004056DE

System Summary:

barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Purchase Order PO20211027STK.exe
Executable has a suspicious name (potential lure to open the executable)
Source: Purchase Order PO20211027STK.exe Static file information: Suspicious name
Uses 32bit PE files
Source: Purchase Order PO20211027STK.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_0040352D
Detected potential crypto function
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_0040755C 2_2_0040755C
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_00406D85 2_2_00406D85
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Code function: 4_2_00401724 4_2_00401724
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00BA0040 10_2_00BA0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00BA6908 10_2_00BA6908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00BA13B8 10_2_00BA13B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00E41130 10_2_00E41130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00E43A50 10_2_00E43A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00E44320 10_2_00E44320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00E4CC90 10_2_00E4CC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00E4BF30 10_2_00E4BF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00E43708 10_2_00E43708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_0103DB50 10_2_0103DB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_01035BC8 10_2_01035BC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_0103BEF8 10_2_0103BEF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_010344F8 10_2_010344F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_01036610 10_2_01036610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013D5D18 10_2_013D5D18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013DBD40 10_2_013DBD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013DE808 10_2_013DE808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013D0040 10_2_013D0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013D6E40 10_2_013D6E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013DB808 10_2_013DB808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_013DBCE2 10_2_013DBCE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_014C8780 10_2_014C8780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_014C1B85 10_2_014C1B85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_014C0C08 10_2_014C0C08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_014C4E28 10_2_014C4E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_014CA308 10_2_014CA308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_014C0FB8 10_2_014C0FB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_1DED5E48 10_2_1DED5E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_1DED470C 10_2_1DED470C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_1DED6B30 10_2_1DED6B30
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: String function: 00E46280 appears 52 times
Sample file is different than original file name gathered from version info
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameSPORENE.exePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDNB10 vs Purchase Order PO20211027STK.exe
Source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameSPORENE.exePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDNB10 vs Purchase Order PO20211027STK.exe
PE file contains strange resources
Source: SPORENE.exe.2.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: edgegdi.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\SPORENE.exe 361DEDDF3E436753730DBB20842FBD6D1EF2EC27C56CD9DA99E87751C3BBE890
Source: Purchase Order PO20211027STK.exe ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe File read: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Jump to behavior
Source: Purchase Order PO20211027STK.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe "C:\Users\user\Desktop\Purchase Order PO20211027STK.exe"
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Process created: C:\Users\user\AppData\Local\Temp\SPORENE.exe C:\Users\user\AppData\Local\Temp\SPORENE.exe
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\AppData\Local\Temp\SPORENE.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Process created: C:\Users\user\AppData\Local\Temp\SPORENE.exe C:\Users\user\AppData\Local\Temp\SPORENE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\AppData\Local\Temp\SPORENE.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_0040352D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe File created: C:\Users\user\AppData\Local\Temp\nsu61C.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@6/2@3/1
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_004021AA CoCreateInstance, 2_2_004021AA
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 2_2_0040498A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1720:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1720:120:WilError_03
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Purchase Order PO20211027STK.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Program Files (x86)\Administrator-Cloud\Projects\SPORENE.pdb source: Purchase Order PO20211027STK.exe, 00000002.00000002.213979895058.0000000000411000.00000004.00020000.sdmp, Purchase Order PO20211027STK.exe, 00000002.00000002.213979976030.0000000000426000.00000004.00020000.sdmp, SPORENE.exe.2.dr

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 0000000A.00000000.214269025674.0000000000F00000.00000040.00000001.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Code function: 4_2_03F23DE9 push edi; iretd 4_2_03F23E03
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Code function: 4_2_03F21993 push 00000049h; retf 4_2_03F219D3
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Code function: 4_2_03F2279C push ss; ret 4_2_03F227C2
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Code function: 4_2_03F2307C push edi; iretd 4_2_03F23085
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Code function: 4_2_03F23E5B push edi; iretd 4_2_03F23E03
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Code function: 4_2_03F21936 push 00000049h; retf 4_2_03F219D3

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe File created: C:\Users\user\AppData\Local\Temp\SPORENE.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect Any.run
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SPORENE.exe, 00000004.00000002.214566939150.0000000004080000.00000004.00000001.sdmp Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32APPDATA=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXE\SYSWOW64\MSVBVM60.DLL
Source: CasPol.exe, 0000000A.00000002.219005991038.0000000001290000.00000004.00000001.sdmp Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32APPDATA=HTTPS://ONEDRIVE.LIVE.COM/DOWNLOAD?CID=5A15FDA1AE98540B&RESID=5A15FDA1AE98540B%21126&AUTHKEY=AMKTKWDFSBDEH_E
Source: SPORENE.exe, 00000004.00000002.214566939150.0000000004080000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219005991038.0000000001290000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: SPORENE.exe, 00000004.00000002.214565667753.0000000001AE3000.00000004.00000020.sdmp Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1860 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Window / User API: threadDelayed 9946 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_00406873 FindFirstFileW,FindClose, 2_2_00406873
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 2_2_00405C49
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_0040290B FindFirstFileW, 2_2_0040290B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe System information queried: ModuleInformation Jump to behavior
Source: SPORENE.exe, 00000004.00000002.214568115742.00000000054F9000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: SPORENE.exe, 00000004.00000002.214568115742.00000000054F9000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: vmicshutdown
Source: SPORENE.exe, 00000004.00000002.214568115742.00000000054F9000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: SPORENE.exe, 00000004.00000002.214566939150.0000000004080000.00000004.00000001.sdmp Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32APPDATA=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exe\syswow64\msvbvm60.dll
Source: SPORENE.exe, 00000004.00000002.214568115742.00000000054F9000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: SPORENE.exe, 00000004.00000002.214568115742.00000000054F9000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: vmicvss
Source: CasPol.exe, 0000000A.00000002.219004779835.000000000106B000.00000004.00000020.sdmp, CasPol.exe, 0000000A.00000002.219005284552.00000000010D8000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: CasPol.exe, 0000000A.00000002.219005991038.0000000001290000.00000004.00000001.sdmp Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32APPDATA=https://onedrive.live.com/download?cid=5A15FDA1AE98540B&resid=5A15FDA1AE98540B%21126&authkey=AMKTKwdfsBDEH_E
Source: SPORENE.exe, 00000004.00000002.214566939150.0000000004080000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219005991038.0000000001290000.00000004.00000001.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SPORENE.exe, 00000004.00000002.214568115742.00000000054F9000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: SPORENE.exe, 00000004.00000002.214568115742.00000000054F9000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: SPORENE.exe, 00000004.00000002.214565667753.0000000001AE3000.00000004.00000020.sdmp Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SPORENE.exe, 00000004.00000002.214568115742.00000000054F9000.00000004.00000001.sdmp, CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: CasPol.exe, 0000000A.00000002.219007696569.0000000002CF9000.00000004.00000001.sdmp Binary or memory string: vmicheartbeat

Anti Debugging:

barindex
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread information set: HideFromDebugger Jump to behavior
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process token adjusted: Debug Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 10_2_00E46EA0 LdrInitializeThunk, 10_2_00E46EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: F00000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\SPORENE.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\user\AppData\Local\Temp\SPORENE.exe Jump to behavior
Source: CasPol.exe, 0000000A.00000002.219007283940.00000000018A1000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: CasPol.exe, 0000000A.00000002.219007283940.00000000018A1000.00000002.00020000.sdmp Binary or memory string: Progman
Source: CasPol.exe, 0000000A.00000002.219007283940.00000000018A1000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: CasPol.exe, 0000000A.00000002.219007283940.00000000018A1000.00000002.00020000.sdmp Binary or memory string: Program ManagerT/

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order PO20211027STK.exe Code function: 2_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 2_2_0040352D

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 528, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 528, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 0000000A.00000002.219015661495.000000001DF51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 528, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 531732 Sample: Purchase Order PO20211027STK.exe Startdate: 01/12/2021 Architecture: WINDOWS Score: 100 23 smtp.construccionsjpallas.com 2->23 25 onedrive.live.com 2->25 27 2 other IPs or domains 2->27 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 6 other signatures 2->45 9 Purchase Order PO20211027STK.exe 9 2->9         started        signatures3 process4 file5 21 C:\Users\user\AppData\Local\...\SPORENE.exe, PE32 9->21 dropped 12 SPORENE.exe 9->12         started        process6 signatures7 47 Writes to foreign memory regions 12->47 49 Tries to detect Any.run 12->49 51 Hides threads from debuggers 12->51 15 CasPol.exe 11 12->15         started        process8 dnsIp9 29 smtp.construccionsjpallas.com 134.0.9.148, 49839, 587 CDMONsistemescdmoncomES Spain 15->29 31 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->31 33 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->33 35 Tries to steal Mail credentials (via file / registry access) 15->35 37 5 other signatures 15->37 19 conhost.exe 15->19         started        signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
134.0.9.148
 smtp.construccionsjpallas.com Spain
197712 CDMONsistemescdmoncomES true

Contacted Domains

Name IP Active
smtp.construccionsjpallas.com 134.0.9.148 true
onedrive.live.com unknown unknown
ervtqq.bl.files.1drv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://onedrive.live.com/download?cid=5A15FDA1AE98540B&r false
    		high