Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

FACTURAS.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.04128986675064
Filename:	FACTURAS.exe
Filesize:	147456
MD5:	2332fdde9344114749db5496eef5f5f9
SHA1:	303c40dd112294dc012836be48eb38e8af056432
SHA256:	0e693b9dcb4ccb3e64cb61396447dd4e3871234b4af80c2d57e4fbc9b6268a61
SHA512:	7b3d94fb5e12a09f1b417e8042cbb0abe394a1d577a466cd2394e9aa0068ab276d5da25edf742660edb8bd01611f4680c982d6f14373d80e2896d34a887379c1
SSDEEP:	1536:nVas/8YOk4FOHBbmpBpQr9nV43XExeM0Jw52P3u1D6CqljbW:Is/8YJ4kRmpBpqVC090JS63hN
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L....e`V.....................0............... ....@................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Hides threads from debuggers	Anti Debugging
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Tries to detect Any.run	Malware Analysis System Evasion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Sample file is different than original file name gathered from version info	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Checks if the current process is being debugged	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Sample is known by Antivirus	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)	System Summary
Uses an in-process (OLE) Automation server	System Summary
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries a list of all running drivers	Malware Analysis System Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\M9XgMRXaN30mgEl56ja236

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\M9XgMRXaN30mgEl56ja236
Category:	dropped
Dump:	M9XgMRXaN30mgEl56ja236.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\FACTURAS.exe
Type:	data
Entropy:	0.8112781244591328
Encrypted:	false
Ssdeep:	3:1ln:v
Size:	4
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\~DF503944F8FF7253A1.TMP

Composite Document File V2 Document, Cannot read section info

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DF503944F8FF7253A1.TMP
Category:	dropped
Dump:	~DF503944F8FF7253A1.TMP.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\Desktop\FACTURAS.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	1.365570111635911
Encrypted:	false
Ssdeep:	48:rCXH5P26XpZKfAujEnkmHE+dJ+//iaBnF6UmkM:EHrZedAnjHrMyaL61
Size:	16384
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\FACTURAS.exe

"C:\Users\user\Desktop\FACTURAS.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6316
Target ID:	1
Parent PID:	2636
Name:	FACTURAS.exe
Path:	C:\Users\user\Desktop\FACTURAS.exe
Commandline:	"C:\Users\user\Desktop\FACTURAS.exe"
Size:	147456
MD5:	2332FDDE9344114749DB5496EEF5F5F9
Time:	13:41:51
Date:	14/12/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	151552
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Users\user\Desktop\FACTURAS.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5172
Target ID:	5
Parent PID:	6316
Name:	CasPol.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Commandline:	"C:\Users\user\Desktop\FACTURAS.exe"
Size:	108664
MD5:	914F728C04D3EDDD5FBA59420E74E56B
Time:	13:42:11
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x1d0000
Modulesize:	114688
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Users\user\Desktop\FACTURAS.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5196
Target ID:	6
Parent PID:	6316
Name:	CasPol.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Commandline:	"C:\Users\user\Desktop\FACTURAS.exe"
Size:	108664
MD5:	914F728C04D3EDDD5FBA59420E74E56B
Time:	13:42:12
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xa30000
Modulesize:	114688
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	1360
Target ID:	9
Parent PID:	5196
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	875008
MD5:	81CA40085FC75BABD2C91D18AA9FFA68
Time:	13:42:12
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6064f0000
Modulesize:	901120
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://doc-0g-7s-docs.googleusercontent.com/

unknown

http://127.0.0.1:HTTP/1.1

unknown

http://DynDns.comDynDNS

unknown

https://doc-0g-7s-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/09s7mqju06nhfef03e9jkahgn04c8qp1/1639485750000/01707528263340534167/*/1e3nVGX3LlhNn9Zf6RwTjDw6FKTCAih9T?e=download

142.250.181.225

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

unknown

https://drive.google.com/

unknown

https://drive.google.com/st

unknown

https://doc-0g-7s-docs.googleusercontent.com/e

unknown

https://doc-0g-7s-docs.googleusercontent.com/1

unknown

http://kFWRbv.com

unknown

https://doc-0g-7s-docs.googleusercontent.com/u

unknown

https://doc-0g-7s-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/09s7mqju

unknown

https://csp.withgoogle.com/csp/report-to/gse_l9ocaq

unknown

There are 3 hidden URLs, click here to show them.

Domains

Name

Malicious

drive.google.com

142.250.181.238

Details

Name:	drive.google.com
IP:	142.250.181.238
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

googlehosted.l.googleusercontent.com

142.250.181.225

Details

Name:	googlehosted.l.googleusercontent.com
IP:	142.250.181.225
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

doc-0g-7s-docs.googleusercontent.com

unknown

Details

Name:	doc-0g-7s-docs.googleusercontent.com
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

142.250.181.238

drive.google.com

United States

Details

IP:	142.250.181.238
TargetID:	6
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	drive.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

142.250.181.225

googlehosted.l.googleusercontent.com

United States

Details

IP:	142.250.181.225
TargetID:	6
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	googlehosted.l.googleusercontent.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Turcize6\Sacrocotyloidean8

SLIDFAST

Memdumps

Base Address

Regiontype

Protect

Malicious

1DF31000

unkown

page read and write

E10000

unkown

page execute and read and write

1EF59000

unkown

page read and write

424000

unkown image

page readonly

1CD51000

unkown

page read and write

1CD51000

unkown

page read and write

2370000

heap private

page read and write

1CD51000

unkown

page read and write

1DEE0000

unkown

page read and write

1CD51000

unkown

page read and write

20265000

unkown

page read and write

201EE000

unkown

page read and write

1CD51000

unkown

page read and write

7F220000

unkown image

page readonly

20400000

heap private

page execute and read and write

7F240000

unkown image

page readonly

B40000

unkown

page read and write

1CD51000

unkown

page read and write

2C50000

heap private

page read and write

1CD51000

unkown

page read and write

1CD51000

unkown

page read and write

B41000

unkown

page read and write

BF0000

unkown image

page readonly

1DFE3000

unkown

page read and write

1DFF6000

unkown

page read and write

BE0000

unkown image

page readonly

1DCC7000

stack

page read and write

7F7E0000

unkown image

page readonly

7F240000

unkown image

page readonly

A10000

unkown image

page readonly

BF0000

unkown image

page readonly

1DF10000

unkown image

page readonly

7FFB0000

unkown image

page readonly

1DED0000

unkown

page execute and read and write

1CD51000

unkown

page read and write

20260000

unkown

page read and write

1CD51000

unkown

page read and write

400000

unkown image

page readonly

1CD51000

unkown

page read and write

1CD51000

unkown

page read and write

1DD26000

unkown

page execute and read and write

3239000

unkown

page read and write

7F222000

unkown image

page readonly

1D2F1000

unkown

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs

Registry

Memdumps