Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe

PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy:	7.875386203366202
Filename:	REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Filesize:	194987
MD5:	b9f70f4146b846179fa182ac868d0c15
SHA1:	97cb5de0e0cc2f53cd73552f9d5b4381ab5a5907
SHA256:	ff235029990af0449ce8f82c5546dfe37170d5e27ce1a22b0a43965a980344be
SHA512:	2cc45205394074ddf9a5481a81b89582d84d42a34023329e06cf589c455c2fef144905362b5d1001e26026480d490304b6ac96526ab32f5344b1706d98ceff48
SSDEEP:	3072:MRD+3q3NxPTNuY/bQZFler2MUPaSa1y8XKdV06k55ohchNqV3AzlbEnJZGqItyWJ:mwq3NpNSFleCMUPVaidHXMNqwlInJ0q8
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..OP.._...P...s...P...V...P..Rich.P..........PE..L...8.MX.................b...*......J4............@

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Access Token Manipulation Credentials in Registry
Tries to detect Any.run	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information
Machine Learning detection for sample	AV Detection
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Uses 32bit PE files	Compliance, System Summary	Masquerading
One or more processes crash	System Summary
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Detected potential crypto function	System Summary	Access Token Manipulation Archive Collected Data
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Contains functionality to call native functions	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging
Enables debug privileges	Anti Debugging
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Checks if the current process is being debugged	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Sample is known by Antivirus	System Summary	Windows Service Access Token Manipulation
Sample reads its own file content	System Summary	Access Token Manipulation
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Reads ini files	System Summary	File and Directory Discovery
Contains functionality to check free disk space	System Summary
Queries a list of all running drivers	Malware Analysis System Evasion	System Information Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Creates mutexes	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion	Windows Service
URLs found in memory or binary data	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Checks if Microsoft Office is installed	System Summary	Access Token Manipulation
Creates a software uninstall entry	Compliance, System Summary	Windows Service

C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\AsOpenFile.exe

PE32+ executable (GUI) x86-64, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\AsOpenFile.exe
Category:	dropped
Dump:	AsOpenFile.exe.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	5.840976252158136
Encrypted:	false
Ssdeep:	768:tba0g4rhVUkxIIaPrd6cMCP1diTLmz1BeeKH2X98VwhH:HPUkxIIaPrsCPXK6z1Bee3+k
Size:	38632
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\Tusindtallig.Syn

data

dropped

Details

File:	C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\Tusindtallig.Syn
Category:	dropped
Dump:	Tusindtallig.Syn.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Type:	data
Entropy:	7.9930541941014255
Encrypted:	true
Ssdeep:	768:E49NB/CsjPddY0nfj1fIXSgH0uO7wt1WayrQ0bThetG:nlCsxfVIXHH2wOfKG
Size:	29309
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\prowl.Dgn

data

dropped

Details

File:	C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\prowl.Dgn
Category:	dropped
Dump:	prowl.Dgn.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Type:	data
Entropy:	7.124693631306355
Encrypted:	false
Ssdeep:	3072:COxlLD2mpgf8pOxNjQzNUflgAG63+OAyam6kxnv:COxlmcg5EzuNG6MyaJSv
Size:	141909
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\nsq493.tmp\System.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

modified

Details

File:	C:\Users\user\AppData\Local\Temp\nsq493.tmp\System.dll
Category:	modified
Dump:	System.dll.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	5.656065698421856
Encrypted:	false
Ssdeep:	192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
Size:	11776
Whitelisted:	true
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior

C:\Users\user\AppData\Roaming\5D4ACB\B73EF6.lck

very short file (no magic)

dropped

Details

File:	C:\Users\user\AppData\Roaming\5D4ACB\B73EF6.lck
Category:	dropped
Dump:	B73EF6.lck.5.dr
ID:	dr_5
Target ID:	5
Process:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Type:	very short file (no magic)
Entropy:	0.0
Encrypted:	false
Ssdeep:	3:U:U
Size:	1
Whitelisted:	true
Reputation:	timeout

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3425316567-2969588382-3778222414-1001\1b1d0082738e9f9011266f86ab9723d2_11389406-0377-47ed-98c7-d564e683c6eb

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3425316567-2969588382-3778222414-1001\1b1d0082738e9f9011266f86ab9723d2_11389406-0377-47ed-98c7-d564e683c6eb
Category:	dropped
Dump:	1b1d0082738e9f9011266f86ab9723d2_11389406-0377-47ed-98c7-d564e683c6eb.5.dr
ID:	dr_4
Target ID:	5
Process:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Type:	data
Entropy:	1.1262763721961973
Encrypted:	false
Ssdeep:	3:/lSllIEXln:AWE1
Size:	47
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe

Details

Is windows:	false
Is dropped:	false
PID:	4112
Target ID:	2
Parent PID:	4652
Name:	REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Path:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Commandline:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Size:	194987
MD5:	B9F70F4146B846179FA182AC868D0C15
Time:	00:31:01
Date:	30/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	434176
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe

Details

Is windows:	false
Is dropped:	false
PID:	7568
Target ID:	5
Parent PID:	4112
Name:	REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Path:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Commandline:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Size:	194987
MD5:	B9F70F4146B846179FA182AC868D0C15
Time:	00:31:18
Date:	30/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	19214336
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 1980

Details

Is windows:	true
Is dropped:	false
PID:	1144
Target ID:	8
Parent PID:	7568
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 1980
Size:	482640
MD5:	40A149513D721F096DDF50C04DA2F01F
Time:	00:31:37
Date:	30/11/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x520000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://157.245.36.27/~dokterpol/?page=2874

157.245.36.27

https://doc-0g-8k-docs.googleusercontent.com/%%doc-0g-8k-docs.googleusercontent.com

unknown

http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd

unknown

https://doc-0g-8k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/65eu063p0f9eoc2qkjfmonuuk5gkqmq4/1669764675000/03238822727237126472/*/1ZppbncXCwboWfcBo0A5zlqzevMjFwzpW?e=download&uuid=c4bc146b-22c6-4e17-89b8-c96a6eb96fab

142.250.185.161

https://drive.google.com/

unknown

https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214

unknown

https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external

unknown

http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.

unknown

http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd

unknown

https://doc-0g-8k-docs.googleusercontent.com/)

unknown

http://nsis.sf.net/NSIS_ErrorError

unknown

http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD

unknown

http://www.gopher.ftp://ftp.

unknown

https://doc-0g-8k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/65eu063p

unknown

https://doc-0g-8k-docs.googleusercontent.com/

unknown

There are 5 hidden URLs, click here to show them.

Domains

Name

Malicious

drive.google.com

142.250.185.238

Details

Name:	drive.google.com
IP:	142.250.185.238
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

googlehosted.l.googleusercontent.com

142.250.185.161

doc-0g-8k-docs.googleusercontent.com

unknown

Details

Name:	doc-0g-8k-docs.googleusercontent.com
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

157.245.36.27

unknown

United States

Details

IP:	157.245.36.27
TargetID:	5
Current Path:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Country:	United States
Countrycode:	USA
ASN number:	14061
ASN name:	DIGITALOCEAN-ASNUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

142.250.185.161

googlehosted.l.googleusercontent.com

United States

Details

IP:	142.250.185.161
TargetID:	5
Current Path:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	googlehosted.l.googleusercontent.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

142.250.185.238

drive.google.com

United States

Details

IP:	142.250.185.238
TargetID:	5
Current Path:	C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	drive.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Procentuelles232\Frafaldsprocents\Forarbejdendes\Inceration

Pythius

HKEY_CURRENT_USER\SOFTWARE\Sammenlgningens\Tjurunga\Pakkeforsendelserne\Thiophthene

Etaper

HKEY_LOCAL_MACHINE\SOFTWARE\Compoundedness

Caballo

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bekvemmeligheder

Hovedbibliotekerne

Memdumps

Base Address

Regiontype

Protect

Malicious

7CC000

heap

page read and write

32D0000

direct allocation

page execute and read and write

1660000

remote allocation

page execute and read and write

2510000

trusted library allocation

page read and write

469000

unkown

page readonly

3420000

heap

page read and write

1984000

heap

page read and write

2295000

heap

page read and write

1F117D13000

heap

page read and write

1D49D000

stack

page read and write

401000

unkown

page execute read

1D4A6000

direct allocation

page read and write

400000

unkown

page readonly

1A70000

trusted library allocation

page read and write

3AA0000

trusted library allocation

page read and write

5F2000

unkown

page write copy

1930000

heap

page read and write

3560000

trusted library allocation

page read and write

1F117D00000

heap

page read and write

427000

unkown

page read and write

408000

unkown

page readonly

1D50E000

stack

page read and write

1F117A13000

unkown

page read and write

401000

unkown

page execute read

23B0000

heap

page read and write

1981000

heap

page read and write

1F117A02000

unkown

page read and write

3B20000

trusted library allocation

page read and write

2299000

heap

page read and write

1F117B00000

trusted library allocation

page read and write

1D04F000

stack

page read and write

1BF0000

trusted library allocation

page read and write

2564000

heap

page read and write

1C50000

heap

page read and write

1985000

heap

page read and write

1F117D13000

heap

page read and write

1D4A0000

direct allocation

page read and write

1D26D000

stack

page read and write

57E000

stack

page read and write

3421000

heap

page read and write

20000

unclassified section

page readonly

226E000

stack

page read and write

469000

unkown

page readonly

1F117A2A000

heap

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportREQUEST FOR OFFER 30-12-2022#U00b7pdf.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe