ScreenShot
| Created | 2021.05.15 10:47 | Machine | s1_win7_x6401 |
| Filename | Mainsetupv1.0.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 15 detected (AIDetect, malware1, Artemis, malicious, confidence, 7zip, AL suspicious, Fsysna, Wacatac, Unsafe) | ||
| md5 | 689b7bfb1424aa69046653e635ecb9ac | ||
| sha256 | 33b321374349db0323465f27465cabc62472c405e2a45638467e32c174d18082 | ||
| ssdeep | 49152:AuUZOlRW++2IqL321m6IxSwdN0ZsCbSq4ijHsBm:AHZOjW+Vt3SiODu/ijM0 | ||
| imphash | 2b914b6fd04316572d777593dc737715 | ||
| impfuzzy | 96:d0+mOVs3df+3sFzqiVbXpqffFSGJZZ+RGIXjqcI/gI:m+hVs3GZgw1ScZZ9IXuT/gI | ||
Network IP location
Signature (16cnts)
| Level | Description |
|---|---|
| watch | Attempts to identify installed AV products by installation directory |
| watch | Checks the CPU name from registry |
| watch | File has been identified by 15 AntiVirus engines on VirusTotal as malicious |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | The executable uses a known packer |
Rules (37cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | memory |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Hijack_Network | Hijack network configuration | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | Persistence | Install itself for autorun at Windows startup | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
| info | Win_Trojan_agentTesla_Zero | Win.Trojan.agentTesla | memory |
PE API
IAT(Import Address Table) Library
COMCTL32.dll
0x419010 None
SHELL32.dll
0x419270 SHGetSpecialFolderPathW
0x419274 ShellExecuteW
0x419278 SHGetMalloc
0x41927c SHGetPathFromIDListW
0x419280 SHBrowseForFolderW
0x419284 SHGetFileInfoW
0x419288 ShellExecuteExW
GDI32.dll
0x419018 CreateCompatibleDC
0x41901c CreateFontIndirectW
0x419020 DeleteObject
0x419024 DeleteDC
0x419028 GetCurrentObject
0x41902c StretchBlt
0x419030 GetDeviceCaps
0x419034 CreateCompatibleBitmap
0x419038 SelectObject
0x41903c SetStretchBltMode
0x419040 GetObjectW
ADVAPI32.dll
0x419000 FreeSid
0x419004 AllocateAndInitializeSid
0x419008 CheckTokenMembership
USER32.dll
0x419290 CreateWindowExW
0x419294 GetDesktopWindow
0x419298 wsprintfA
0x41929c SetWindowPos
0x4192a0 SetTimer
0x4192a4 GetMessageW
0x4192a8 ScreenToClient
0x4192ac KillTimer
0x4192b0 CharUpperW
0x4192b4 SendMessageW
0x4192b8 EndDialog
0x4192bc wsprintfW
0x4192c0 MessageBoxW
0x4192c4 GetParent
0x4192c8 CopyImage
0x4192cc ReleaseDC
0x4192d0 GetWindowDC
0x4192d4 GetMenu
0x4192d8 GetWindowLongW
0x4192dc DispatchMessageW
0x4192e0 GetWindowTextW
0x4192e4 GetWindowTextLengthW
0x4192e8 SetWindowTextW
0x4192ec GetSysColor
0x4192f0 DestroyWindow
0x4192f4 MessageBoxA
0x4192f8 BringWindowToTop
0x4192fc ShowWindow
0x419300 GetKeyState
0x419304 GetDlgItem
0x419308 GetClientRect
0x41930c SetWindowLongW
0x419310 UnhookWindowsHookEx
0x419314 SetFocus
0x419318 GetSystemMetrics
0x41931c SystemParametersInfoW
0x419320 DrawTextW
0x419324 GetDC
0x419328 ClientToScreen
0x41932c GetWindow
0x419330 DialogBoxIndirectParamW
0x419334 DrawIconEx
0x419338 CallWindowProcW
0x41933c DefWindowProcW
0x419340 CallNextHookEx
0x419344 PtInRect
0x419348 SetWindowsHookExW
0x41934c LoadImageW
0x419350 LoadIconW
0x419354 MessageBeep
0x419358 EnableWindow
0x41935c IsWindow
0x419360 EnableMenuItem
0x419364 GetSystemMenu
0x419368 CreateWindowExA
0x41936c wvsprintfW
0x419370 GetClassNameA
0x419374 GetWindowRect
ole32.dll
0x41937c CreateStreamOnHGlobal
0x419380 CoCreateInstance
0x419384 CoInitialize
OLEAUT32.dll
0x419258 SysAllocStringLen
0x41925c VariantClear
0x419260 SysFreeString
0x419264 OleLoadPicture
0x419268 SysAllocString
KERNEL32.dll
0x419048 SetFileTime
0x41904c SetEndOfFile
0x419050 GetFileInformationByHandle
0x419054 VirtualFree
0x419058 GetModuleHandleA
0x41905c WaitForMultipleObjects
0x419060 VirtualAlloc
0x419064 ReadFile
0x419068 SetFilePointer
0x41906c GetFileSize
0x419070 LeaveCriticalSection
0x419074 EnterCriticalSection
0x419078 DeleteCriticalSection
0x41907c FormatMessageW
0x419080 lstrcpyW
0x419084 LocalFree
0x419088 IsBadReadPtr
0x41908c SuspendThread
0x419090 TerminateThread
0x419094 GetSystemDirectoryW
0x419098 GetCurrentThreadId
0x41909c InitializeCriticalSection
0x4190a0 ResetEvent
0x4190a4 SetEvent
0x4190a8 CreateEventW
0x4190ac GetVersionExW
0x4190b0 GetModuleFileNameW
0x4190b4 GetCurrentProcess
0x4190b8 SetProcessWorkingSetSize
0x4190bc GetDriveTypeW
0x4190c0 CreateFileW
0x4190c4 SetEnvironmentVariableW
0x4190c8 GetTempPathW
0x4190cc GetCommandLineW
0x4190d0 GetStartupInfoW
0x4190d4 CreateProcessW
0x4190d8 CreateJobObjectW
0x4190dc ResumeThread
0x4190e0 AssignProcessToJobObject
0x4190e4 CreateIoCompletionPort
0x4190e8 SetInformationJobObject
0x4190ec GetQueuedCompletionStatus
0x4190f0 GetExitCodeProcess
0x4190f4 CloseHandle
0x4190f8 LoadLibraryA
0x4190fc SetThreadLocale
0x419100 lstrlenW
0x419104 GetSystemTimeAsFileTime
0x419108 ExpandEnvironmentStringsW
0x41910c CompareFileTime
0x419110 WideCharToMultiByte
0x419114 FindFirstFileW
0x419118 lstrcmpW
0x41911c DeleteFileW
0x419120 FindNextFileW
0x419124 FindClose
0x419128 SetCurrentDirectoryW
0x41912c RemoveDirectoryW
0x419130 GetEnvironmentVariableW
0x419134 lstrcmpiW
0x419138 GetLocaleInfoW
0x41913c MultiByteToWideChar
0x419140 GetUserDefaultUILanguage
0x419144 GetSystemDefaultUILanguage
0x419148 GetSystemDefaultLCID
0x41914c lstrcmpiA
0x419150 GlobalAlloc
0x419154 GlobalFree
0x419158 MulDiv
0x41915c FindResourceExA
0x419160 SizeofResource
0x419164 LoadResource
0x419168 LockResource
0x41916c GetProcAddress
0x419170 GetModuleHandleW
0x419174 GetStdHandle
0x419178 ExitProcess
0x41917c lstrcatW
0x419180 GetDiskFreeSpaceExW
0x419184 SetLastError
0x419188 SetFileAttributesW
0x41918c Sleep
0x419190 GetExitCodeThread
0x419194 WaitForSingleObject
0x419198 CreateThread
0x41919c GetLastError
0x4191a0 SystemTimeToFileTime
0x4191a4 GetLocalTime
0x4191a8 GetFileAttributesW
0x4191ac CreateDirectoryW
0x4191b0 lstrlenA
0x4191b4 WriteFile
0x4191b8 GetStartupInfoA
MSVCRT.dll
0x4191c0 _purecall
0x4191c4 memcmp
0x4191c8 ??2@YAPAXI@Z
0x4191cc memmove
0x4191d0 memcpy
0x4191d4 _wtol
0x4191d8 strncpy
0x4191dc _controlfp
0x4191e0 _except_handler3
0x4191e4 __set_app_type
0x4191e8 __p__fmode
0x4191ec __p__commode
0x4191f0 _adjust_fdiv
0x4191f4 __setusermatherr
0x4191f8 _initterm
0x4191fc __getmainargs
0x419200 _acmdln
0x419204 exit
0x419208 _XcptFilter
0x41920c _exit
0x419210 ??1type_info@@UAE@XZ
0x419214 _onexit
0x419218 __dllonexit
0x41921c malloc
0x419220 free
0x419224 wcsstr
0x419228 _CxxThrowException
0x41922c wcscmp
0x419230 _beginthreadex
0x419234 _EH_prolog
0x419238 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
0x41923c memset
0x419240 _wcsnicmp
0x419244 strncmp
0x419248 wcsncmp
0x41924c wcsncpy
0x419250 ??3@YAXPAX@Z
EAT(Export Address Table) is none
COMCTL32.dll
0x419010 None
SHELL32.dll
0x419270 SHGetSpecialFolderPathW
0x419274 ShellExecuteW
0x419278 SHGetMalloc
0x41927c SHGetPathFromIDListW
0x419280 SHBrowseForFolderW
0x419284 SHGetFileInfoW
0x419288 ShellExecuteExW
GDI32.dll
0x419018 CreateCompatibleDC
0x41901c CreateFontIndirectW
0x419020 DeleteObject
0x419024 DeleteDC
0x419028 GetCurrentObject
0x41902c StretchBlt
0x419030 GetDeviceCaps
0x419034 CreateCompatibleBitmap
0x419038 SelectObject
0x41903c SetStretchBltMode
0x419040 GetObjectW
ADVAPI32.dll
0x419000 FreeSid
0x419004 AllocateAndInitializeSid
0x419008 CheckTokenMembership
USER32.dll
0x419290 CreateWindowExW
0x419294 GetDesktopWindow
0x419298 wsprintfA
0x41929c SetWindowPos
0x4192a0 SetTimer
0x4192a4 GetMessageW
0x4192a8 ScreenToClient
0x4192ac KillTimer
0x4192b0 CharUpperW
0x4192b4 SendMessageW
0x4192b8 EndDialog
0x4192bc wsprintfW
0x4192c0 MessageBoxW
0x4192c4 GetParent
0x4192c8 CopyImage
0x4192cc ReleaseDC
0x4192d0 GetWindowDC
0x4192d4 GetMenu
0x4192d8 GetWindowLongW
0x4192dc DispatchMessageW
0x4192e0 GetWindowTextW
0x4192e4 GetWindowTextLengthW
0x4192e8 SetWindowTextW
0x4192ec GetSysColor
0x4192f0 DestroyWindow
0x4192f4 MessageBoxA
0x4192f8 BringWindowToTop
0x4192fc ShowWindow
0x419300 GetKeyState
0x419304 GetDlgItem
0x419308 GetClientRect
0x41930c SetWindowLongW
0x419310 UnhookWindowsHookEx
0x419314 SetFocus
0x419318 GetSystemMetrics
0x41931c SystemParametersInfoW
0x419320 DrawTextW
0x419324 GetDC
0x419328 ClientToScreen
0x41932c GetWindow
0x419330 DialogBoxIndirectParamW
0x419334 DrawIconEx
0x419338 CallWindowProcW
0x41933c DefWindowProcW
0x419340 CallNextHookEx
0x419344 PtInRect
0x419348 SetWindowsHookExW
0x41934c LoadImageW
0x419350 LoadIconW
0x419354 MessageBeep
0x419358 EnableWindow
0x41935c IsWindow
0x419360 EnableMenuItem
0x419364 GetSystemMenu
0x419368 CreateWindowExA
0x41936c wvsprintfW
0x419370 GetClassNameA
0x419374 GetWindowRect
ole32.dll
0x41937c CreateStreamOnHGlobal
0x419380 CoCreateInstance
0x419384 CoInitialize
OLEAUT32.dll
0x419258 SysAllocStringLen
0x41925c VariantClear
0x419260 SysFreeString
0x419264 OleLoadPicture
0x419268 SysAllocString
KERNEL32.dll
0x419048 SetFileTime
0x41904c SetEndOfFile
0x419050 GetFileInformationByHandle
0x419054 VirtualFree
0x419058 GetModuleHandleA
0x41905c WaitForMultipleObjects
0x419060 VirtualAlloc
0x419064 ReadFile
0x419068 SetFilePointer
0x41906c GetFileSize
0x419070 LeaveCriticalSection
0x419074 EnterCriticalSection
0x419078 DeleteCriticalSection
0x41907c FormatMessageW
0x419080 lstrcpyW
0x419084 LocalFree
0x419088 IsBadReadPtr
0x41908c SuspendThread
0x419090 TerminateThread
0x419094 GetSystemDirectoryW
0x419098 GetCurrentThreadId
0x41909c InitializeCriticalSection
0x4190a0 ResetEvent
0x4190a4 SetEvent
0x4190a8 CreateEventW
0x4190ac GetVersionExW
0x4190b0 GetModuleFileNameW
0x4190b4 GetCurrentProcess
0x4190b8 SetProcessWorkingSetSize
0x4190bc GetDriveTypeW
0x4190c0 CreateFileW
0x4190c4 SetEnvironmentVariableW
0x4190c8 GetTempPathW
0x4190cc GetCommandLineW
0x4190d0 GetStartupInfoW
0x4190d4 CreateProcessW
0x4190d8 CreateJobObjectW
0x4190dc ResumeThread
0x4190e0 AssignProcessToJobObject
0x4190e4 CreateIoCompletionPort
0x4190e8 SetInformationJobObject
0x4190ec GetQueuedCompletionStatus
0x4190f0 GetExitCodeProcess
0x4190f4 CloseHandle
0x4190f8 LoadLibraryA
0x4190fc SetThreadLocale
0x419100 lstrlenW
0x419104 GetSystemTimeAsFileTime
0x419108 ExpandEnvironmentStringsW
0x41910c CompareFileTime
0x419110 WideCharToMultiByte
0x419114 FindFirstFileW
0x419118 lstrcmpW
0x41911c DeleteFileW
0x419120 FindNextFileW
0x419124 FindClose
0x419128 SetCurrentDirectoryW
0x41912c RemoveDirectoryW
0x419130 GetEnvironmentVariableW
0x419134 lstrcmpiW
0x419138 GetLocaleInfoW
0x41913c MultiByteToWideChar
0x419140 GetUserDefaultUILanguage
0x419144 GetSystemDefaultUILanguage
0x419148 GetSystemDefaultLCID
0x41914c lstrcmpiA
0x419150 GlobalAlloc
0x419154 GlobalFree
0x419158 MulDiv
0x41915c FindResourceExA
0x419160 SizeofResource
0x419164 LoadResource
0x419168 LockResource
0x41916c GetProcAddress
0x419170 GetModuleHandleW
0x419174 GetStdHandle
0x419178 ExitProcess
0x41917c lstrcatW
0x419180 GetDiskFreeSpaceExW
0x419184 SetLastError
0x419188 SetFileAttributesW
0x41918c Sleep
0x419190 GetExitCodeThread
0x419194 WaitForSingleObject
0x419198 CreateThread
0x41919c GetLastError
0x4191a0 SystemTimeToFileTime
0x4191a4 GetLocalTime
0x4191a8 GetFileAttributesW
0x4191ac CreateDirectoryW
0x4191b0 lstrlenA
0x4191b4 WriteFile
0x4191b8 GetStartupInfoA
MSVCRT.dll
0x4191c0 _purecall
0x4191c4 memcmp
0x4191c8 ??2@YAPAXI@Z
0x4191cc memmove
0x4191d0 memcpy
0x4191d4 _wtol
0x4191d8 strncpy
0x4191dc _controlfp
0x4191e0 _except_handler3
0x4191e4 __set_app_type
0x4191e8 __p__fmode
0x4191ec __p__commode
0x4191f0 _adjust_fdiv
0x4191f4 __setusermatherr
0x4191f8 _initterm
0x4191fc __getmainargs
0x419200 _acmdln
0x419204 exit
0x419208 _XcptFilter
0x41920c _exit
0x419210 ??1type_info@@UAE@XZ
0x419214 _onexit
0x419218 __dllonexit
0x41921c malloc
0x419220 free
0x419224 wcsstr
0x419228 _CxxThrowException
0x41922c wcscmp
0x419230 _beginthreadex
0x419234 _EH_prolog
0x419238 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
0x41923c memset
0x419240 _wcsnicmp
0x419244 strncmp
0x419248 wcsncmp
0x41924c wcsncpy
0x419250 ??3@YAXPAX@Z
EAT(Export Address Table) is none