Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

FACTURAS.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.04128986675064
Filename:	FACTURAS.exe
Filesize:	147456
MD5:	2332fdde9344114749db5496eef5f5f9
SHA1:	303c40dd112294dc012836be48eb38e8af056432
SHA256:	0e693b9dcb4ccb3e64cb61396447dd4e3871234b4af80c2d57e4fbc9b6268a61
SHA512:	7b3d94fb5e12a09f1b417e8042cbb0abe394a1d577a466cd2394e9aa0068ab276d5da25edf742660edb8bd01611f4680c982d6f14373d80e2896d34a887379c1
SSDEEP:	1536:nVas/8YOk4FOHBbmpBpQr9nV43XExeM0Jw52P3u1D6CqljbW:Is/8YJ4kRmpBpqVC090JS63hN
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L....e`V.....................0............... ....@................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Hides threads from debuggers	Anti Debugging	Virtualization/Sandbox Evasion Security Software Discovery
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Tries to detect Any.run	Malware Analysis System Evasion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Detected potential crypto function	System Summary	Archive Collected Data
Contains functionality to call native functions	System Summary
Sample file is different than original file name gathered from version info	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Checks if the current process is being debugged	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Sample is known by Antivirus	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)	System Summary
Uses an in-process (OLE) Automation server	System Summary
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries a list of all running drivers	Malware Analysis System Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\M9XgMRXaN30mgEl56ja236

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\M9XgMRXaN30mgEl56ja236
Category:	dropped
Dump:	M9XgMRXaN30mgEl56ja236.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\FACTURAS.exe
Type:	data
Entropy:	0.8112781244591328
Encrypted:	false
Ssdeep:	3:1ln:v
Size:	4
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\~DF03314C855DEECA48.TMP

Composite Document File V2 Document, Cannot read section info

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DF03314C855DEECA48.TMP
Category:	dropped
Dump:	~DF03314C855DEECA48.TMP.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\Desktop\FACTURAS.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.365570111635911
Encrypted:	false
Ssdeep:	48:rCXH5P26XpZKfAujEnkmHE+dJ+//iaBnF6UmkM:EHrZedAnjHrMyaL61
Size:	16384
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.9.dr
ID:	dr_2
Target ID:	9
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.964735178725505
Encrypted:	false
Ssdeep:	3:IBVFBWAGRHneyy:ITqAGRHner
Size:	30
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\FACTURAS.exe

"C:\Users\user\Desktop\FACTURAS.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7984
Target ID:	1
Parent PID:	2748
Name:	FACTURAS.exe
Path:	C:\Users\user\Desktop\FACTURAS.exe
Commandline:	"C:\Users\user\Desktop\FACTURAS.exe"
Size:	147456
MD5:	2332FDDE9344114749DB5496EEF5F5F9
Time:	09:49:43
Date:	14/12/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	151552
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Users\user\Desktop\FACTURAS.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7380
Target ID:	9
Parent PID:	7984
Name:	CasPol.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Commandline:	"C:\Users\user\Desktop\FACTURAS.exe"
Size:	108664
MD5:	914F728C04D3EDDD5FBA59420E74E56B
Time:	09:50:02
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xf20000
Modulesize:	114688
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	1676
Target ID:	10
Parent PID:	7380
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	875008
MD5:	81CA40085FC75BABD2C91D18AA9FFA68
Time:	09:50:03
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6ff680000
Modulesize:	901120
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://doc-0g-7s-docs.googleusercontent.com/

unknown

http://127.0.0.1:HTTP/1.1

unknown

https://NlNlzv83nsnyVe.org

unknown

http://DynDns.comDynDNS

unknown

https://doc-0g-7s-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/gp8euu0g

unknown

https://sectigo.com/CPS0

unknown

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

unknown

https://drive.google.com/

unknown

https://support.google.com/chrome/?p=plugin_flash

unknown

http://furteksdokuma.com.tr

unknown

http://mail.furteksdokuma.com.tr

unknown

https://doc-0g-7s-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/gp8euu0gtvc992oi1h8j40de9a23dlvb/1639471800000/01707528263340534167/*/1e3nVGX3LlhNn9Zf6RwTjDw6FKTCAih9T?e=download

142.250.186.33

http://kFWRbv.com

unknown

https://NlNlzv83nsnyVe.orgt-

unknown

https://csp.withgoogle.com/csp/report-to/gse_l9ocaq

unknown

There are 5 hidden URLs, click here to show them.

Domains

Name

Malicious

furteksdokuma.com.tr

116.202.203.61

Details

Name:	furteksdokuma.com.tr
IP:	116.202.203.61
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses SMTP (mail sending)	Networking	Application Layer Protocol
URLs found in memory or binary data	Networking

mail.furteksdokuma.com.tr

unknown

drive.google.com

142.250.181.238

Details

Name:	drive.google.com
IP:	142.250.181.238
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

googlehosted.l.googleusercontent.com

142.250.186.33

Details

Name:	googlehosted.l.googleusercontent.com
IP:	142.250.186.33
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

doc-0g-7s-docs.googleusercontent.com

unknown

Details

Name:	doc-0g-7s-docs.googleusercontent.com
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

116.202.203.61

furteksdokuma.com.tr

Germany

Details

IP:	116.202.203.61
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Country:	Germany
Countrycode:	DEU
ASN number:	24940
ASN name:	HETZNER-ASDE
Private:	false
Domain:	furteksdokuma.com.tr

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses SMTP (mail sending)	Networking	Application Layer Protocol

142.250.181.238

drive.google.com

United States

Details

IP:	142.250.181.238
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	drive.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

142.250.186.33

googlehosted.l.googleusercontent.com

United States

Details

IP:	142.250.186.33
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	googlehosted.l.googleusercontent.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Turcize6\Sacrocotyloidean8

SLIDFAST

Memdumps

Base Address

Regiontype

Protect

Malicious

1E3C1000

unkown

page read and write

1300000

unkown

page execute and read and write

1D371000

unkown

page read and write

21E9000

heap private

page read and write

206A0000

unkown

page read and write

1490000

stack

page read and write

206A7000

unkown

page read and write

7FF56D4E3000

unkown image

page readonly

7FC12000

unkown image

page readonly

1D371000

unkown

page read and write

1480000

stack

page read and write

1D371000

unkown

page read and write

20661000

unkown

page read and write

17C0000

unkown image

page readonly

206A0000

unkown

page read and write

1D371000

unkown

page read and write

1D371000

unkown

page read and write

1D371000

unkown

page read and write

206B6000

unkown

page read and write

7FC12000

unkown image

page readonly

1D371000

unkown

page read and write

20760000

unkown

page read and write

1D371000

unkown

page read and write

1D371000

unkown

page read and write

1D371000

unkown

page read and write

1A70000

stack

page read and write

1D371000

unkown

page read and write

1D371000

unkown

page read and write

195E000

stack

page read and write

12A0000

stack

page read and write

1210000

unkown

page read and write

1D371000

unkown

page read and write

6AE000

stack

page read and write

1E1D0000

unkown image

page read and write

1470000

stack

page read and write

1E4DE000

unkown

page read and write

1800000

stack

page read and write

1A70000

stack

page read and write

17E0000

stack

page read and write

17C0000

stack

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs

Registry

Memdumps