Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

PURCHASE ORDER.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.888370004294712
Filename:	PURCHASE ORDER.exe
Filesize:	600576
MD5:	a55b4bb09398659d69f1b8b37541e621
SHA1:	975f7c38780d00ae497fcb6addf31f5ad8cdb090
SHA256:	ea45a2032eebe69d32b15d3ea505330eb00b5026107e8e123fb9fb9e2bf87496
SHA512:	a5eb89b7b07ad51b747ba5c003d50ae8aa53c11adb23034da977e8ab25373a81c3c7216cda025c25a0d55f9cab989f93794d2512fb16a8998dfa8d58c5210590
SSDEEP:	12288:7gkzrbETClvHskFgFwIyXCD1vmAMDfJ0/IegnS1onhj6W4ytrRpMf:/76CVskFgqIyXFhS/ngSWhxROf
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c.............................5... ...@....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Machine Learning detection for sample	AV Detection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Encrypted Channel
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging
Sample file is different than original file name gathered from version info	System Summary
Drops PE files	Persistence and Installation Behavior
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Found malware configuration	AV Detection
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Uses an in-process (OLE) Automation server	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Reads ini files	System Summary	File and Directory Discovery
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PURCHASE ORDER.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PURCHASE ORDER.exe.log
Category:	dropped
Dump:	PURCHASE ORDER.exe.log.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\PURCHASE ORDER.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.355304211458859
Encrypted:	false
Ssdeep:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
Size:	1216
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\tmpF89B.tmp

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\tmpF89B.tmp
Category:	dropped
Dump:	tmpF89B.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\PURCHASE ORDER.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.177923914853658
Encrypted:	false
Ssdeep:	24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGQBtn:cbhK79lNQR/rydbz9I3YODOLNdq31
Size:	1642
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Scheduled temp file as task from temp location	Persistence and Installation Behavior
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\PAyWOGoRT.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\PAyWOGoRT.exe
Category:	dropped
Dump:	PAyWOGoRT.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\PURCHASE ORDER.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.888370004294712
Encrypted:	false
Ssdeep:	12288:7gkzrbETClvHskFgFwIyXCD1vmAMDfJ0/IegnS1onhj6W4ytrRpMf:/76CVskFgqIyXFhS/ngSWhxROf
Size:	600576
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for dropped file	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe
Category:	dropped
Dump:	yGbzOMp.exe.3.dr
ID:	dr_3
Target ID:	3
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.149629800481177
Encrypted:	false
Ssdeep:	768:bBbSoy+SdIBf0k2dsYyV6Iq87PiU9FViaLmf:EoOIBf0ddsYy8LUjVBC
Size:	45152
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PAyWOGoRT.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PAyWOGoRT.exe.log
Category:	dropped
Dump:	PAyWOGoRT.exe.log.4.dr
ID:	dr_5
Target ID:	4
Process:	C:\Users\user\AppData\Roaming\PAyWOGoRT.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.355304211458859
Encrypted:	false
Ssdeep:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
Size:	1216
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yGbzOMp.exe.log

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yGbzOMp.exe.log
Category:	modified
Dump:	yGbzOMp.exe.log.5.dr
ID:	dr_7
Target ID:	5
Process:	C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.090621108356562
Encrypted:	false
Ssdeep:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
Size:	142
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\tmp6AED.tmp

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\tmp6AED.tmp
Category:	dropped
Dump:	tmp6AED.tmp.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Users\user\AppData\Roaming\PAyWOGoRT.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.177923914853658
Encrypted:	false
Ssdeep:	24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGQBtn:cbhK79lNQR/rydbz9I3YODOLNdq31
Size:	1642
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.7.dr
ID:	dr_8
Target ID:	7
Process:	C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.44831826838854
Encrypted:	false
Ssdeep:	24:zKLXkb4DObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0b4DQntKKH1MqJC
Size:	1141
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\PURCHASE ORDER.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PAyWOGoRT" /XML "C:\Users\user\AppData\Local\Temp\tmpF89B.tmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

{path}

C:\Users\user\AppData\Roaming\PAyWOGoRT.exe

C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe

"C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe"

C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe

"C:\Users\user\AppData\Roaming\yGbzOMp\yGbzOMp.exe"

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PAyWOGoRT" /XML "C:\Users\user\AppData\Local\Temp\tmp6AED.tmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

{path}

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

{path}

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

There are 3 hidden processes, click here to show them.

URLs

Name

Malicious

http://127.0.0.1:HTTP/1.1

unknown

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

http://www.fontbureau.com/designersG

unknown

https://sectigo.com/CPS0

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.founder.com.cn/cn/bThe

unknown

http://www.fontbureau.com/designers?

unknown

http://mail.orogenicgroup-bd.com

unknown

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

unknown

http://www.tiro.com

unknown

http://www.fontbureau.com/designers

unknown

http://www.goodfont.co.kr

unknown

http://www.carterandcone.coml

unknown

http://www.sajatypeworks.com

unknown

http://www.typography.netD

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

http://fontfabrik.com

unknown

http://www.founder.com.cn/cn

unknown

http://www.fontbureau.com/designers/frere-user.html

unknown

http://www.jiyu-kobo.co.jp/

unknown

http://DynDns.comDynDNSnamejidpasswordPsi/Psi

unknown

http://JXqRNJ.com

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.fontbureau.com/designers8

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://www.urwpp.deDPlease

unknown

http://www.zhongyicts.com.cn

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://www.sakkal.com

unknown

https://0boQaB1sN6dM.org

unknown

There are 24 hidden URLs, click here to show them.

Domains

Name

Malicious

mail.orogenicgroup-bd.com

119.148.27.3

Details

Name:	mail.orogenicgroup-bd.com
IP:	119.148.27.3
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
PURCHASE ORDER.exe

Files

Processes

URLs

Domains

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPURCHASE ORDER.exe

Files

Processes

URLs

Domains

IOC Report
PURCHASE ORDER.exe