Windows Analysis Report Purchase Order No. XIV21623..exe

ID:	532633
Product:	CloudBasic
Start time:	15:18:35
Start date:	02.12.2021
Sample:	Purchase Order No. XIV21623..exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	5e5c83d04f20a03826b8cd80d2c4a0b5
SHA1:	840248f524917151d9b44dda32cbb32ab1fd7d80
SHA256:	62c4b3a0c365726907f0ac94621c85f5c52056eb94653b151144cc841502e916
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Purchase Order No. XIV21623..exe.log	ASCII text, with CRLF line terminators	C8A62E39DE7A3F805D39384E8BABB1E0	B32B1257401F17A2D1D5D3CC1D8C1E072E3FEE31	A7BC127854C5327ABD50C86000BF10586B556A5E085BB23523B07A15DD4C5383

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: Purchase Order No. XIV21623..exe

Avira: detected

Found malware configuration

Source: 0.2.Purchase Order No. XIV21623..exe.13454660.3.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "anjay@peoplesource.in", "Password": "Admin@12345", "Host": "mail.peoplesource.in"}

Multi AV Scanner detection for submitted file

Source: Purchase Order No. XIV21623..exe

ReversingLabs: Detection: 35%

Machine Learning detection for sample

Source: Purchase Order No. XIV21623..exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.0.Purchase Order No. XIV21623..exe.810000.0.unpack

Avira: Label: TR/Dropper.MSIL.Gen

Compliance:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Unpacked PE file: 0.2.Purchase Order No. XIV21623..exe.810000.0.unpack

Uses 32bit PE files

Source: Purchase Order No. XIV21623..exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Purchase Order No. XIV21623..exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: ?????????????c.pdb source: Purchase Order No. XIV21623..exe, 00000000.00000002.248225365.0000000000ED0000.00000004.00020000.sdmp

Networking:

URLs found in memory or binary data

Source: Purchase Order No. XIV21623..exe, 00000000.00000002.250031063.0000000013189000.00000004.00000001.sdmp

String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip

System Summary:

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase Order No. XIV21623..exe

Executable has a suspicious name (potential lure to open the executable)

Source: Purchase Order No. XIV21623..exe

Static file information: Suspicious name

Uses 32bit PE files

Source: Purchase Order No. XIV21623..exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Sample file is different than original file name gathered from version info

Source: Purchase Order No. XIV21623..exe, 00000000.00000002.247943652.0000000000850000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenametaker.exeP vs Purchase Order No. XIV21623..exe
Source: Purchase Order No. XIV21623..exe, 00000000.00000002.248225365.0000000000ED0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilename8l vs Purchase Order No. XIV21623..exe
Source: Purchase Order No. XIV21623..exe, 00000000.00000002.250031063.0000000013189000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenametnCUHxlBGCKFCsHpcbSvLqLWGfKD.exe4 vs Purchase Order No. XIV21623..exe
Source: Purchase Order No. XIV21623..exe, 00000000.00000002.248059960.0000000000D19000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Purchase Order No. XIV21623..exe
Source: Purchase Order No. XIV21623..exe	Binary or memory string: OriginalFilenametaker.exeP vs Purchase Order No. XIV21623..exe

PE file contains strange resources

Source: Purchase Order No. XIV21623..exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Detected potential crypto function

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Code function: 0_2_00007FFA1D941D0D

0_2_00007FFA1D941D0D

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: Purchase Order No. XIV21623..exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Sample is known by Antivirus

Source: Purchase Order No. XIV21623..exe

ReversingLabs: Detection: 35%

PE file has an executable .text section and no other executable section

Source: Purchase Order No. XIV21623..exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe "C:\Users\user\Desktop\Purchase Order No. XIV21623..exe"
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe			Jump to behavior

Creates files inside the user directory

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Purchase Order No. XIV21623..exe.log

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/1@0/0

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: Purchase Order No. XIV21623..exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Purchase Order No. XIV21623..exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: ?????????????c.pdb source: Purchase Order No. XIV21623..exe, 00000000.00000002.248225365.0000000000ED0000.00000004.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Unpacked PE file: 0.2.Purchase Order No. XIV21623..exe.810000.0.unpack

.NET source code contains potential unpacker

Source: Purchase Order No. XIV21623..exe, c5b09415cd7b0c75252f1d37810bcc5d0.cs	.Net Code: c08af4a61b44020d61ee70e0d21a00651 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Purchase Order No. XIV21623..exe.810000.0.unpack, c5b09415cd7b0c75252f1d37810bcc5d0.cs	.Net Code: c08af4a61b44020d61ee70e0d21a00651 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Purchase Order No. XIV21623..exe.810000.0.unpack, c5b09415cd7b0c75252f1d37810bcc5d0.cs	.Net Code: c08af4a61b44020d61ee70e0d21a00651 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Code function: 0_2_00007FFA1D94518E push edx; iretd

0_2_00007FFA1D945191

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.96708162926

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe TID: 2072

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Queries a list of all running processes

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Process information queried: ProcessInformation

Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Purchase Order No. XIV21623..exe, 00000000.00000002.250031063.0000000013189000.00000004.00000001.sdmp

Binary or memory string: !`0QYYJVMcIQ

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Process token adjusted: Debug

Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Jump to behavior

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Queries volume information: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe VolumeInformation

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\Purchase Order No. XIV21623..exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Purchase Order No. XIV21623..exe.13454660.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order No. XIV21623..exe.13454660.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.250031063.0000000013189000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order No. XIV21623..exe PID: 496, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Purchase Order No. XIV21623..exe.13454660.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order No. XIV21623..exe.13454660.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.250031063.0000000013189000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order No. XIV21623..exe PID: 496, type: MEMORYSTR