popup

Report - r104.exe

  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.04.02 10:45 Machine s1_win7_x6402
Filename r104.exe
Type PE32+ executable (console) x86-64, for MS Windows
AI Score Not founds Behavior Score
11.4
ZERO API file : malware
VT API (file) 6 detected (Malicious, FileRepMetagen, kcloud)
md5 d2749c21fa8671e75cd147380ff110e0
sha256 3dbab512123a36954684474e9a9f5502aa9edf0228a4df8f0cb33e328890d33b
ssdeep 6144:BABatTx4LuLbY0xtTZrLRcBDrh15kk5XvI9eNtlhzQKOR64sWkxfkEW5sX2Lg:qc4utt95cBX8ejWT9kvW5s
imphash 2de0725e4eedc6f70b07cc6f3c2e3b4e
impfuzzy 24:bS1o0qtSmlJnc+pl3eDoTs2EOovbOuXhZHuDvB3jM6:bS1YtSkc+pp/sS3bBB
  Network IP location

Signature (23cnts)

Level Description
danger Executed a process and injected code into it
warning Generates some ICMP traffic
watch Allocates execute permission to another process indicative of possible code injection
watch Code injection by writing an executable or DLL to the memory of another process
watch Communicates with host for which no DNS query was performed
watch Drops a binary and executes it
watch Installs itself for autorun at Windows startup
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice File has been identified by 6 AntiVirus engines on VirusTotal as malicious
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Searches running processes potentially to identify processes for sandbox evasion
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Queries for the computername

Rules (23cnts)

Level Name Description Collection
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check Signature Zero binaries (download)
info OS_Processor_Check_Zero OS Processor Check Signature Zero binaries (upload)
info PE_Header_Zero PE File Signature Zero binaries (download)
info PE_Header_Zero PE File Signature Zero binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info create_service Create a windows service memory
info HasDebugData DebugData Check binaries (download)
info HasDebugData DebugData Check binaries (upload)
info HasRichSignature Rich Signature Check binaries (download)
info HasRichSignature Rich Signature Check binaries (upload)
info inject_thread Code injection with CreateRemoteThread in a remote process memory
info IsConsole (no description) binaries (download)
info IsConsole (no description) binaries (upload)
info win_files_operation Affect private profile binaries (download)
info win_files_operation Affect private profile binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://34.212.193.150/kenichi/aura20b/zero21
whois
US AMAZON-02 34.212.193.150 clean
8.8.7.7
whois
US LEVEL3 8.8.7.7 clean
34.212.193.150
whois
US AMAZON-02 34.212.193.150 clean

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x14000f000 QueryPerformanceCounter
 0x14000f008 GetCurrentProcessId
 0x14000f010 GetCurrentThreadId
 0x14000f018 GetSystemTimeAsFileTime
 0x14000f020 InitializeSListHead
 0x14000f028 RtlCaptureContext
 0x14000f030 RtlLookupFunctionEntry
 0x14000f038 RtlVirtualUnwind
 0x14000f040 IsDebuggerPresent
 0x14000f048 UnhandledExceptionFilter
 0x14000f050 SetUnhandledExceptionFilter
 0x14000f058 GetStartupInfoW
 0x14000f060 IsProcessorFeaturePresent
 0x14000f068 GetModuleHandleW
 0x14000f070 RtlUnwindEx
 0x14000f078 GetLastError
 0x14000f080 SetLastError
 0x14000f088 EnterCriticalSection
 0x14000f090 LeaveCriticalSection
 0x14000f098 DeleteCriticalSection
 0x14000f0a0 InitializeCriticalSectionAndSpinCount
 0x14000f0a8 TlsAlloc
 0x14000f0b0 TlsGetValue
 0x14000f0b8 TlsSetValue
 0x14000f0c0 TlsFree
 0x14000f0c8 FreeLibrary
 0x14000f0d0 GetProcAddress
 0x14000f0d8 LoadLibraryExW
 0x14000f0e0 RaiseException
 0x14000f0e8 GetStdHandle
 0x14000f0f0 WriteFile
 0x14000f0f8 GetModuleFileNameA
 0x14000f100 MultiByteToWideChar
 0x14000f108 WideCharToMultiByte
 0x14000f110 GetCurrentProcess
 0x14000f118 ExitProcess
 0x14000f120 TerminateProcess
 0x14000f128 GetModuleHandleExW
 0x14000f130 GetCommandLineA
 0x14000f138 GetCommandLineW
 0x14000f140 GetACP
 0x14000f148 HeapFree
 0x14000f150 HeapAlloc
 0x14000f158 FindClose
 0x14000f160 FindFirstFileExA
 0x14000f168 FindNextFileA
 0x14000f170 IsValidCodePage
 0x14000f178 GetOEMCP
 0x14000f180 GetCPInfo
 0x14000f188 GetEnvironmentStringsW
 0x14000f190 FreeEnvironmentStringsW
 0x14000f198 SetEnvironmentVariableA
 0x14000f1a0 SetStdHandle
 0x14000f1a8 GetFileType
 0x14000f1b0 GetStringTypeW
 0x14000f1b8 CompareStringW
 0x14000f1c0 LCMapStringW
 0x14000f1c8 GetProcessHeap
 0x14000f1d0 HeapSize
 0x14000f1d8 HeapReAlloc
 0x14000f1e0 FlushFileBuffers
 0x14000f1e8 GetConsoleCP
 0x14000f1f0 GetConsoleMode
 0x14000f1f8 SetFilePointerEx
 0x14000f200 CreateFileW
 0x14000f208 CloseHandle
 0x14000f210 WriteConsoleW

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure