Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

G47wmLn8uy.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.9046699069840765
Filename:	G47wmLn8uy.exe
Filesize:	167936
MD5:	9a1518ed709f916360e56b5ac7d76995
SHA1:	7c85312d66edf5b02ebd6c25cfe9c036a3471263
SHA256:	2a0878c196278384aab473c92977d236680c788b4e5ae0cc1f415a075a6fa9e2
SHA512:	8f99b5b19d72548340c8bfc3ce6460d73c055b556daa956739cdeb67c2d0db56688e9f017deb2a94f29a298da959d479f3c8dc20123eac6762c69103cd004b13
SSDEEP:	1536:FrdvP8OOzT80mFxgs0HtyWPK0xljCwioDoWjJNa+I37KTqPRzV5pkNXuUAnq:ddvP81zTGUjKWMoDhjJNS7hPHUAnq
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.x.....................\.......%.......Rich............................PE..L.....pV.................`...P......\........p....@

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
Hides threads from debuggers	Anti Debugging
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Tries to detect Any.run	Malware Analysis System Evasion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Abnormal high CPU Usage	System Summary
Sample file is different than original file name gathered from version info	System Summary
PE file contains strange resources	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Checks if the current process is being debugged	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Sample is known by Antivirus	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)	System Summary
Uses an in-process (OLE) Automation server	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Queries a list of all running drivers	Malware Analysis System Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Temp\~DF81F8B836C10D3FC0.TMP

Composite Document File V2 Document, Cannot read section info

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\~DF81F8B836C10D3FC0.TMP
Category:	dropped
Dump:	~DF81F8B836C10D3FC0.TMP.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Users\user\Desktop\G47wmLn8uy.exe
Type:	Composite Document File V2 Document, Cannot read section info
Entropy:	0.9730200708513237
Encrypted:	false
Ssdeep:	24:r/hDKifA3RuOH/3+aVR4J5lBefVYyDnKoKgQBX2:rJKifAhx5853weyDKoKgQB
Size:	16384
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.19.dr
ID:	dr_1
Target ID:	19
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.964735178725505
Encrypted:	false
Ssdeep:	3:IBVFBWAGRHneyy:ITqAGRHner
Size:	30
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\G47wmLn8uy.exe

"C:\Users\user\Desktop\G47wmLn8uy.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2128
Target ID:	2
Parent PID:	8932
Name:	G47wmLn8uy.exe
Path:	C:\Users\user\Desktop\G47wmLn8uy.exe
Commandline:	"C:\Users\user\Desktop\G47wmLn8uy.exe"
Size:	167936
MD5:	9A1518ED709F916360E56B5AC7D76995
Time:	16:11:54
Date:	14/12/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	180224
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file contains strange resources	System Summary
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Users\user\Desktop\G47wmLn8uy.exe"

Details

Is windows:	true
Is dropped:	false
PID:	4828
Target ID:	17
Parent PID:	2128
Name:	CasPol.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Commandline:	"C:\Users\user\Desktop\G47wmLn8uy.exe"
Size:	108664
MD5:	914F728C04D3EDDD5FBA59420E74E56B
Time:	16:12:43
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x1e0000
Modulesize:	114688
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Users\user\Desktop\G47wmLn8uy.exe"

Details

Is windows:	true
Is dropped:	false
PID:	4708
Target ID:	18
Parent PID:	2128
Name:	CasPol.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Commandline:	"C:\Users\user\Desktop\G47wmLn8uy.exe"
Size:	108664
MD5:	914F728C04D3EDDD5FBA59420E74E56B
Time:	16:12:44
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x130000
Modulesize:	114688
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Users\user\Desktop\G47wmLn8uy.exe"

Details

Is windows:	true
Is dropped:	false
PID:	4712
Target ID:	19
Parent PID:	2128
Name:	CasPol.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Commandline:	"C:\Users\user\Desktop\G47wmLn8uy.exe"
Size:	108664
MD5:	914F728C04D3EDDD5FBA59420E74E56B
Time:	16:12:44
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x950000
Modulesize:	114688
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4904
Target ID:	20
Parent PID:	4712
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	875008
MD5:	81CA40085FC75BABD2C91D18AA9FFA68
Time:	16:12:44
Date:	14/12/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6e34f0000
Modulesize:	901120
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://127.0.0.1:HTTP/1.1

unknown

http://DynDns.comDynDNS

unknown

http://repository.certum.pl/ctnca.cer09

unknown

https://doc-08-0o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/g955ofpf

unknown

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

unknown

http://crl.certum.pl/ctnca.crl0k

unknown

https://doc-08-0o-docs.googleusercontent.com/

unknown

http://yandex.crl.certum.pl/ycasha2.crl0q

unknown

https://api.ipify.org%4

unknown

https://doc-08-0o-docs.googleusercontent.com/%%doc-08-0o-docs.googleusercontent.com

unknown

http://oQCcllY8wcJ5yZF5.orgt-

unknown

https://support.google.com/chrome/?p=plugin_flash

unknown

https://www.certum.pl/CPS0

unknown

http://oQCcllY8wcJ5yZF5.org

unknown

http://smtp.yandex.com

unknown

http://yandex.ocsp-responder.com03

unknown

http://subca.ocsp-certum.com0.

unknown

https://doc-08-0o-docs.googleusercontent.com/P~K

unknown

http://repository.certum.pl/ca.cer09

unknown

http://uYFyNj.com

unknown

http://crls.yandex.net/certum/ycasha2.crl0-

unknown

https://drive.google.com/

unknown

http://subca.ocsp-certum.com01

unknown

https://api.ipify.org%GETMozilla/5.0

unknown

https://doc-08-0o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/g955ofpf5ri5rpdjdcedlr3l5sifs0gg/1639494750000/08820895400503972853/*/1rvzmbX5uh5tlf4YLxhmc756C1SkQ0vOB?e=download

142.250.185.65

http://crl.certum.pl/ca.crl0h

unknown

http://www.certum.pl/CPS0

unknown

https://doc-08-0o-docs.googleusercontent.com/BQG

unknown

http://repository.certum.pl/ycasha2.cer0

unknown

https://csp.withgoogle.com/csp/report-to/gse_l9ocaq

unknown

There are 20 hidden URLs, click here to show them.

Domains

Name

Malicious

smtp.yandex.ru

77.88.21.158

Details

Name:	smtp.yandex.ru
IP:	77.88.21.158
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses SMTP (mail sending)	Networking	Application Layer Protocol

drive.google.com

142.250.181.238

Details

Name:	drive.google.com
IP:	142.250.181.238
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

googlehosted.l.googleusercontent.com

142.250.185.65

Details

Name:	googlehosted.l.googleusercontent.com
IP:	142.250.185.65
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

doc-08-0o-docs.googleusercontent.com

unknown

Details

Name:	doc-08-0o-docs.googleusercontent.com
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

smtp.yandex.com

unknown

IPs

Domain

Country

Malicious

142.250.181.238

drive.google.com

United States

Details

IP:	142.250.181.238
TargetID:	19
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	drive.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

77.88.21.158

smtp.yandex.ru

Russian Federation

Details

IP:	77.88.21.158
TargetID:	19
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Country:	Russian Federation
Countrycode:	RUS
ASN number:	13238
ASN name:	YANDEXRU
Private:	false
Domain:	smtp.yandex.ru

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses SMTP (mail sending)	Networking	Application Layer Protocol

142.250.185.65

googlehosted.l.googleusercontent.com

United States

Details

IP:	142.250.185.65
TargetID:	19
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	googlehosted.l.googleusercontent.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\subideal\Eyeliners

HARNISKKLDT

Memdumps

Base Address

Regiontype

Protect

Malicious

1DE51000

unkown

page read and write

D30000

unkown

page execute and read and write

2AB0000

unkown

page execute and read and write

FE0000

stack

page read and write

7FF528F37000

unkown image

page readonly

1DE30000

unkown

page read and write

7FF5B7FE9000

unkown image

page readonly

1DE30000

unkown

page read and write

2802528A000

unkown

page read and write

179E7540000

unkown

page read and write

179E6CA5000

unkown

page read and write

1CDB1000

unkown

page read and write

20A19119000

unkown

page read and write

179E6CC8000

unkown

page read and write

20A19819000

unkown

page read and write

20A198ED000

unkown

page read and write

FD5000

stack

page read and write

1E1E0EA4000

unkown

page read and write

590000

unkown image

page readonly

7FB40000

unkown image

page readonly

1AB024CD000

unkown

page read and write

7DF588BA0000

unkown image

page readonly

1CDB1000

unkown

page read and write

2252D802000

unkown

page read and write

2252D02A000

unkown

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs

Registry

Memdumps