Windows Analysis Report
Ordene 501527,pdf.exe

Overview

General Information

Sample Name: Ordene 501527,pdf.exe
Analysis ID: 680367
MD5: 5162b6782f86f1f24e8610544d159ae9
SHA1: 0d1ead84c74ee462976928783c1f733aa859bc94
SHA256: 6730e52c8075c7e044c2bbaf9f7ad8c0f7f8d03fb23adbd2331adc8b591caec7
Infos:

Detection

AgentTesla, GuLoader
Score: 92
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected AgentTesla
Yara detected GuLoader
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to detect Any.run
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Yara detected Credential Stealer
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Uses SMTP (mail sending)
PE / OLE file has an invalid certificate
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Dropped file seen in connection with other malware

Classification

Source: flex.exe.7436.14.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "ventas@merian.com.arofven1mail.merian.com.arkagawabunch869@gmail.com"}
Uses 32bit PE files
Source: Ordene 501527,pdf.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Ordene 501527,pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\FanControlWrapper.pdb source: FanControlWrapper.dll.1.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\FanControlWrapper.pdb source: FanControlWrapper.dll.1.dr
Source: Binary string: caspol.pdb source: flex.exe, 0000000E.00000000.40096279867.00000000002F2000.00000002.00000001.01000000.00000008.sdmp, flex.exe.9.dr
Source: Binary string: Microsoft.Office.Tools.Common.v9.0.pdb source: Microsoft.Office.Tools.Common.v9.0.dll.1.dr
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 1_2_004065A2 FindFirstFileW,FindClose, 1_2_004065A2
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 1_2_0040596D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_0040596D
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 141.98.6.239 141.98.6.239
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /zeaveZtePRlRbWLesj75.dwp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 141.98.6.239Cache-Control: no-cache
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.11.20:49796 -> 69.61.116.42:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.11.20:49796 -> 69.61.116.42:587
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: unknown TCP traffic detected without corresponding DNS query: 141.98.6.239
Source: CasPol.exe, 00000009.00000002.44519707198.000000001DAE8000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000003.40142393670.0000000020F9F000.00000004.00000800.00020000.00000000.sdmp, Cookies.9.dr String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: CasPol.exe, 00000009.00000003.40142393670.0000000020F9F000.00000004.00000800.00020000.00000000.sdmp, Cookies.9.dr String found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)
Source: CasPol.exe, 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 00000009.00000002.44498847642.00000000014D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://141.98.6.239/zeaveZtePRlRbWLesj75.dwp
Source: CasPol.exe, 00000009.00000002.44498847642.00000000014D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://141.98.6.239/zeaveZtePRlRbWLesj75.dwplh
Source: CasPol.exe, 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: CasPol.exe, 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://FvewWS.com
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: CasPol.exe, 00000009.00000002.44498847642.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519232973.000000001DA9D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44529629703.0000000020F90000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519910229.000000001DB05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: CasPol.exe, 00000009.00000002.44519232973.000000001DA9D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44529629703.0000000020F90000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519910229.000000001DB05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: CasPol.exe, 00000009.00000002.44519232973.000000001DA9D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44529629703.0000000020F90000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519910229.000000001DB05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: CasPol.exe, 00000009.00000002.44519232973.000000001DA9D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519910229.000000001DB05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.merian.com.ar
Source: CasPol.exe, 00000009.00000002.44519232973.000000001DA9D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519910229.000000001DB05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://merian.com.ar
Source: Ordene 501527,pdf.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: CasPol.exe, 00000009.00000002.44498847642.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519232973.000000001DA9D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44529629703.0000000020F90000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519910229.000000001DB05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Ordene 501527,pdf.exe String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Ordene 501527,pdf.exe String found in binary or memory: http://s.symcd.com06
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: Ordene 501527,pdf.exe String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Ordene 501527,pdf.exe String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Ordene 501527,pdf.exe String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: FanControlWrapper.dll.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: CasPol.exe, 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%appdata
Source: CasPol.exe, 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%t-
Source: Ordene 501527,pdf.exe String found in binary or memory: https://d.symcb.com/cps0%
Source: Ordene 501527,pdf.exe String found in binary or memory: https://d.symcb.com/rpa0
Source: Ordene 501527,pdf.exe String found in binary or memory: https://d.symcb.com/rpa0.
Source: CasPol.exe, 00000009.00000002.44518397705.000000001DA13000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/
Source: CasPol.exe, 00000009.00000002.44518397705.000000001DA13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com//
Source: CasPol.exe, 00000009.00000002.44518397705.000000001DA13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/https://login.live.com/
Source: CasPol.exe, 00000009.00000002.44518397705.000000001DA13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/v104
Source: CasPol.exe, 00000009.00000002.44518958056.000000001DA75000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000003.40043700714.000000001C831000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519232973.000000001DA9D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519545264.000000001DAD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rwUCPncwlnlg0H1LG.net
Source: CasPol.exe, 00000009.00000002.44518958056.000000001DA75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rwUCPncwlnlg0H1LG.nett-
Source: CasPol.exe, 00000009.00000002.44529629703.0000000020F90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com
Source: CasPol.exe, 00000009.00000002.44519232973.000000001DA9D000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44529629703.0000000020F90000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44519910229.000000001DB05000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: CasPol.exe, 00000009.00000002.44518397705.000000001DA13000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: FanControlWrapper.dll.1.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: FanControlWrapper.dll.1.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: CasPol.exe, 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: mail.merian.com.ar
Source: global traffic HTTP traffic detected: GET /zeaveZtePRlRbWLesj75.dwp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 141.98.6.239Cache-Control: no-cache
Uses 32bit PE files
Source: Ordene 501527,pdf.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 1_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403350
Detected potential crypto function
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 9_2_01312168 9_2_01312168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 9_2_0131233B 9_2_0131233B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 9_2_01312366 9_2_01312366
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 9_2_1D7B9F18 9_2_1D7B9F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 9_2_1D7B9648 9_2_1D7B9648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 9_2_1D7B9300 9_2_1D7B9300
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Code function: 14_2_026E0D60 14_2_026E0D60
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Code function: 16_2_02610D60 16_2_02610D60
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: String function: 1D7BCF00 appears 54 times
Sample file is different than original file name gathered from version info
Source: Ordene 501527,pdf.exe, 00000001.00000002.39986768717.0000000000789000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameMicrosoft.Office.Tools.Common.v9.0.dlll% vs Ordene 501527,pdf.exe
PE file contains strange resources
Source: Ordene 501527,pdf.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Section loaded: edgegdi.dll Jump to behavior
PE / OLE file has an invalid certificate
Source: Ordene 501527,pdf.exe Static PE information: invalid certificate
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\flex\flex.exe 7D3BDB5B7EE9685C7C18C0C3272DA2A593F6C5C326F1EA67F22AAE27C57BA1E6
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File read: C:\Users\user\Desktop\Ordene 501527,pdf.exe Jump to behavior
Source: Ordene 501527,pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Ordene 501527,pdf.exe "C:\Users\user\Desktop\Ordene 501527,pdf.exe"
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Ordene 501527,pdf.exe"
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Ordene 501527,pdf.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\flex\flex.exe "C:\Users\user\AppData\Roaming\flex\flex.exe"
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\flex\flex.exe "C:\Users\user\AppData\Roaming\flex\flex.exe"
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 1_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Local\Temp\nsz2213.tmp Jump to behavior
Source: classification engine Classification label: mal92.troj.spyw.evad.winEXE@8/12@1/2
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File read: C:\Users\desktop.ini Jump to behavior
Source: flex.exe.9.dr, Microsoft.Tools.Caspol/caspol.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: flex.exe.9.dr, Microsoft.Tools.Caspol/caspol.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 14.0.flex.exe.2f0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 14.0.flex.exe.2f0000.0.unpack, Microsoft.Tools.Caspol/caspol.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4596:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8164:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4596:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8164:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Ordene 501527,pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\FanControlWrapper.pdb source: FanControlWrapper.dll.1.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\FanControlWrapper.pdb source: FanControlWrapper.dll.1.dr
Source: Binary string: caspol.pdb source: flex.exe, 0000000E.00000000.40096279867.00000000002F2000.00000002.00000001.01000000.00000008.sdmp, flex.exe.9.dr
Source: Binary string: Microsoft.Office.Tools.Common.v9.0.pdb source: Microsoft.Office.Tools.Common.v9.0.dll.1.dr

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000001.00000002.39990186767.00000000037B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.39838910204.0000000001300000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 9_2_013122B2 pushfd ; iretd 9_2_013122E8
PE file contains sections with non-standard names
Source: FanControlWrapper.dll.1.dr Static PE information: section name: .nep
Drops PE files
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Local\Temp\nsd84B6.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\Microsoft.Office.Tools.Common.v9.0.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File created: C:\Users\user\AppData\Roaming\flex\flex.exe Jump to dropped file
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\FanControlWrapper.dll Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4 Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform\Selskabelig Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform\Selskabelig\Hjemmeopgaven Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform\Selskabelig\Hjemmeopgaven\vrkstedsbygninger Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Perciform\Selskabelig\Hjemmeopgaven\vrkstedsbygninger\Ricciaceae185.Inc Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209 Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\FanControlWrapper.dll Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\Microsoft.Office.Tools.Common.v9.0.dll Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\edit-cut-symbolic.svg Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run flex Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run flex Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\flex\flex.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect Any.run
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990362848.00000000038B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOKERNELBASE.DLLSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990362848.00000000038B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: Ordene 501527,pdf.exe, 00000001.00000002.39988097728.0000000000928000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEP
Source: Ordene 501527,pdf.exe, 00000001.00000002.39988097728.0000000000928000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 2560 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe TID: 5948 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe TID: 7612 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd84B6.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\Microsoft.Office.Tools.Common.v9.0.dll Jump to dropped file
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Misundes\Caesural4\Kvalitative209\FanControlWrapper.dll Jump to dropped file
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Window / User API: threadDelayed 9410 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 1_2_004065A2 FindFirstFileW,FindClose, 1_2_004065A2
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 1_2_0040596D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_0040596D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe API call chain: ExitProcess graph end node
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990362848.00000000038B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoKERNELBASE.DLLshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dll
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: CasPol.exe, 00000009.00000002.44498257269.0000000001498000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000009.00000002.44499138063.00000000014F8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990362848.00000000038B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: Ordene 501527,pdf.exe, 00000001.00000002.39988097728.0000000000928000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exep
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: Ordene 501527,pdf.exe, 00000001.00000002.39988097728.0000000000928000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: Ordene 501527,pdf.exe, 00000001.00000002.39990823877.0000000010059000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process token adjusted: Debug Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Queries volume information: C:\Users\user\AppData\Roaming\flex\flex.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\flex\flex.exe Queries volume information: C:\Users\user\AppData\Roaming\flex\flex.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\Ordene 501527,pdf.exe Code function: 1_2_00403350 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403350

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4428, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4428, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000009.00000002.44517603260.000000001D981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 4428, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 680367 Sample: Ordene 501527,pdf.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 92 36 merian.com.ar 2->36 38 mail.merian.com.ar 2->38 56 Yara detected GuLoader 2->56 58 Yara detected AgentTesla 2->58 60 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->60 8 Ordene 501527,pdf.exe 23 2->8         started        11 flex.exe 2 2->11         started        13 flex.exe 1 2->13         started        signatures3 process4 file5 30 C:\...\Microsoft.Office.Tools.Common.v9.0.dll, PE32 8->30 dropped 32 C:\Users\user\...\FanControlWrapper.dll, PE32+ 8->32 dropped 34 C:\Users\user\AppData\Local\...\System.dll, PE32 8->34 dropped 15 CasPol.exe 2 21 8->15         started        20 CasPol.exe 8->20         started        22 conhost.exe 11->22         started        24 conhost.exe 13->24         started        process6 dnsIp7 40 merian.com.ar 69.61.116.42, 49796, 49797, 587 GLOBALCOMPASSUS United States 15->40 42 141.98.6.239, 49793, 80 CMCSUS Germany 15->42 28 C:\Users\user\AppData\Roaming\flex\flex.exe, PE32 15->28 dropped 44 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->44 46 Tries to steal Mail credentials (via file / registry access) 15->46 48 Tries to harvest and steal ftp login credentials 15->48 54 3 other signatures 15->54 26 conhost.exe 15->26         started        50 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->50 52 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 20->52 file8 signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
69.61.116.42
 merian.com.ar United States
22653 GLOBALCOMPASSUS false
141.98.6.239
 unknown Germany
33657 CMCSUS false

Contacted Domains

Name IP Active
merian.com.ar 69.61.116.42 true
mail.merian.com.ar unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://141.98.6.239/zeaveZtePRlRbWLesj75.dwp false
  • Avira URL Cloud: safe
 unknown