ScreenShot
| Created | 2021.04.08 09:39 | Machine | s1_win7_x6402 |
| Filename | tett.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 20 detected (AIDetect, malware2, malicious, high confidence, Artemis, Save, FileRepMalware, Static AI, Malicious PE, kcloud, Wacapew, score, ZexaF, Hq0@a4hXcMck, ET#85%, RDMK, cmRtazqgcE3, aQH9SzUIXm6g7WK9, Unsafe, confidence) | ||
| md5 | 2939f396d5b175b2e1f28b05c09e812b | ||
| sha256 | 088d508c5f4509185682108b422dcce6d1ca6ce82258f1340ab4e330da067b22 | ||
| ssdeep | 6144:H4Qq8J8SuK1ypY23lAF3oUooua2TXOGUIQ33wodqrxWWYwPPydyqBh+hF62S:HB1J8Su7bgYbDkrErxQ1y/pS | ||
| imphash | f9b1213ff998546e2cafbc29182e1fe5 | ||
| impfuzzy | 24:XqE0k6dS+fcWeluGHOov3J3qD+tgwHRnlyv0T4cZArjMZuU:XKdS+fcyGuAntgUK0ccZP | ||
Network IP location
Signature (23cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | Executed a process and injected code into it |
| warning | File has been identified by 20 AntiVirus engines on VirusTotal as malicious |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Looks up the external IP address |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Terminates another process |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Collects information to fingerprint the system (MachineGuid |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | This executable has a PDB path |
Rules (17cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (upload) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | HasDebugData | DebugData Check | binaries (upload) |
| info | HasRichSignature | Rich Signature Check | binaries (upload) |
| info | IsPacked | Entropy Check | binaries (upload) |
| info | IsWindowsGUI | (no description) | binaries (upload) |
| info | win_files_operation | Affect private profile | binaries (upload) |
| info | win_files_operation | Affect private profile | memory |
Network (35cnts) ?
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41a000 lstrlenA
0x41a004 LockResource
0x41a008 SizeofResource
0x41a00c LoadResource
0x41a010 FindResourceW
0x41a014 Sleep
0x41a018 VirtualAlloc
0x41a01c WideCharToMultiByte
0x41a020 InterlockedIncrement
0x41a024 InterlockedDecrement
0x41a028 InterlockedExchange
0x41a02c MultiByteToWideChar
0x41a030 InitializeCriticalSection
0x41a034 DeleteCriticalSection
0x41a038 EnterCriticalSection
0x41a03c LeaveCriticalSection
0x41a040 EncodePointer
0x41a044 DecodePointer
0x41a048 GetLastError
0x41a04c HeapFree
0x41a050 RaiseException
0x41a054 RtlUnwind
0x41a058 GetCommandLineA
0x41a05c HeapSetInformation
0x41a060 GetStartupInfoW
0x41a064 GetCPInfo
0x41a068 HeapAlloc
0x41a06c LCMapStringW
0x41a070 HeapCreate
0x41a074 IsProcessorFeaturePresent
0x41a078 TlsAlloc
0x41a07c TlsGetValue
0x41a080 TlsSetValue
0x41a084 TlsFree
0x41a088 GetModuleHandleW
0x41a08c SetLastError
0x41a090 GetCurrentThreadId
0x41a094 GetProcAddress
0x41a098 UnhandledExceptionFilter
0x41a09c SetUnhandledExceptionFilter
0x41a0a0 IsDebuggerPresent
0x41a0a4 TerminateProcess
0x41a0a8 GetCurrentProcess
0x41a0ac ExitProcess
0x41a0b0 WriteFile
0x41a0b4 GetStdHandle
0x41a0b8 GetModuleFileNameW
0x41a0bc GetModuleFileNameA
0x41a0c0 FreeEnvironmentStringsW
0x41a0c4 GetEnvironmentStringsW
0x41a0c8 SetHandleCount
0x41a0cc InitializeCriticalSectionAndSpinCount
0x41a0d0 GetFileType
0x41a0d4 QueryPerformanceCounter
0x41a0d8 GetTickCount
0x41a0dc GetCurrentProcessId
0x41a0e0 GetSystemTimeAsFileTime
0x41a0e4 GetStringTypeW
0x41a0e8 GetLocaleInfoW
0x41a0ec HeapSize
0x41a0f0 GetACP
0x41a0f4 GetOEMCP
0x41a0f8 IsValidCodePage
0x41a0fc GetUserDefaultLCID
0x41a100 GetLocaleInfoA
0x41a104 EnumSystemLocalesA
0x41a108 IsValidLocale
0x41a10c GetConsoleCP
0x41a110 GetConsoleMode
0x41a114 FlushFileBuffers
0x41a118 ReadFile
0x41a11c SetFilePointer
0x41a120 CloseHandle
0x41a124 HeapReAlloc
0x41a128 LoadLibraryW
0x41a12c WriteConsoleW
0x41a130 SetStdHandle
0x41a134 CreateFileW
EAT(Export Address Table) is none
KERNEL32.dll
0x41a000 lstrlenA
0x41a004 LockResource
0x41a008 SizeofResource
0x41a00c LoadResource
0x41a010 FindResourceW
0x41a014 Sleep
0x41a018 VirtualAlloc
0x41a01c WideCharToMultiByte
0x41a020 InterlockedIncrement
0x41a024 InterlockedDecrement
0x41a028 InterlockedExchange
0x41a02c MultiByteToWideChar
0x41a030 InitializeCriticalSection
0x41a034 DeleteCriticalSection
0x41a038 EnterCriticalSection
0x41a03c LeaveCriticalSection
0x41a040 EncodePointer
0x41a044 DecodePointer
0x41a048 GetLastError
0x41a04c HeapFree
0x41a050 RaiseException
0x41a054 RtlUnwind
0x41a058 GetCommandLineA
0x41a05c HeapSetInformation
0x41a060 GetStartupInfoW
0x41a064 GetCPInfo
0x41a068 HeapAlloc
0x41a06c LCMapStringW
0x41a070 HeapCreate
0x41a074 IsProcessorFeaturePresent
0x41a078 TlsAlloc
0x41a07c TlsGetValue
0x41a080 TlsSetValue
0x41a084 TlsFree
0x41a088 GetModuleHandleW
0x41a08c SetLastError
0x41a090 GetCurrentThreadId
0x41a094 GetProcAddress
0x41a098 UnhandledExceptionFilter
0x41a09c SetUnhandledExceptionFilter
0x41a0a0 IsDebuggerPresent
0x41a0a4 TerminateProcess
0x41a0a8 GetCurrentProcess
0x41a0ac ExitProcess
0x41a0b0 WriteFile
0x41a0b4 GetStdHandle
0x41a0b8 GetModuleFileNameW
0x41a0bc GetModuleFileNameA
0x41a0c0 FreeEnvironmentStringsW
0x41a0c4 GetEnvironmentStringsW
0x41a0c8 SetHandleCount
0x41a0cc InitializeCriticalSectionAndSpinCount
0x41a0d0 GetFileType
0x41a0d4 QueryPerformanceCounter
0x41a0d8 GetTickCount
0x41a0dc GetCurrentProcessId
0x41a0e0 GetSystemTimeAsFileTime
0x41a0e4 GetStringTypeW
0x41a0e8 GetLocaleInfoW
0x41a0ec HeapSize
0x41a0f0 GetACP
0x41a0f4 GetOEMCP
0x41a0f8 IsValidCodePage
0x41a0fc GetUserDefaultLCID
0x41a100 GetLocaleInfoA
0x41a104 EnumSystemLocalesA
0x41a108 IsValidLocale
0x41a10c GetConsoleCP
0x41a110 GetConsoleMode
0x41a114 FlushFileBuffers
0x41a118 ReadFile
0x41a11c SetFilePointer
0x41a120 CloseHandle
0x41a124 HeapReAlloc
0x41a128 LoadLibraryW
0x41a12c WriteConsoleW
0x41a130 SetStdHandle
0x41a134 CreateFileW
EAT(Export Address Table) is none