popup

Report - setup.exe

Emotet Gen1 Gen2 Generic Malware PE File PE64 OS Processor Check DLL .NET DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.06.21 13:12 Machine s1_win7_x6402
Filename setup.exe
Type PE32+ executable (console) x86-64, for MS Windows
AI Score Not founds Behavior Score
4.2
ZERO API file : clean
VT API (file) 26 detected (Artemis, IRCBot, WGJV, Python, Malicious, R002C0DFJ21, ai score=100, Remoteshell)
md5 ed070e82321e34aca28364015919f78e
sha256 d1483b3180344ec09555db148cc7c21439fef002124bfd7ee74150f0be138375
ssdeep 393216:s0SLhn+DwBPwcaVSLo8phZ0K0LzSuEpdTs1Y5nXQz8:HRDwBP68o8phK7hEpdT3XQ
imphash 7aa1951517b3b8d38b12f874b66196c9
impfuzzy 24:mDaODu9Wu9T/2bjwp9UVS02tMS1hUJnc+pl3rOovbKlvUTNUTlONoEqMo6iMuEZO:ckR9ltMS1hEc+ppaRNUT0ONfiQhA1b
  Network IP location

Signature (9cnts)

Level Description
warning File has been identified by 26 AntiVirus engines on VirusTotal as malicious
watch Appends a known multi-family ransomware file extension to files that have been encrypted
watch Communicates with host for which no DNS query was performed
watch Deletes a large number of files from the system indicative of ransomware
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (12cnts)

Level Name Description Collection
danger Win32_Trojan_Emotet_1_Zero Win32 Trojan Emotet binaries (download)
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
info Is_DotNET_DLL (no description) binaries (download)
info IsDLL (no description) binaries (download)
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info Win32_Trojan_Gen_2_0904B0_Zero Win32 Trojan Gen binaries (download)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x140023010 GetModuleFileNameW
 0x140023018 GetProcAddress
 0x140023020 GetCommandLineW
 0x140023028 GetEnvironmentVariableW
 0x140023030 SetEnvironmentVariableW
 0x140023038 ExpandEnvironmentStringsW
 0x140023040 GetTempPathW
 0x140023048 WaitForSingleObject
 0x140023050 Sleep
 0x140023058 SetDllDirectoryW
 0x140023060 CreateProcessW
 0x140023068 GetStartupInfoW
 0x140023070 LoadLibraryExW
 0x140023078 CreateDirectoryW
 0x140023080 GetShortPathNameW
 0x140023088 FormatMessageW
 0x140023090 LoadLibraryA
 0x140023098 MultiByteToWideChar
 0x1400230a0 WideCharToMultiByte
 0x1400230a8 GetExitCodeProcess
 0x1400230b0 GetLastError
 0x1400230b8 SetEndOfFile
 0x1400230c0 HeapReAlloc
 0x1400230c8 RtlCaptureContext
 0x1400230d0 RtlLookupFunctionEntry
 0x1400230d8 RtlVirtualUnwind
 0x1400230e0 UnhandledExceptionFilter
 0x1400230e8 SetUnhandledExceptionFilter
 0x1400230f0 GetCurrentProcess
 0x1400230f8 TerminateProcess
 0x140023100 IsProcessorFeaturePresent
 0x140023108 QueryPerformanceCounter
 0x140023110 GetCurrentProcessId
 0x140023118 GetCurrentThreadId
 0x140023120 GetSystemTimeAsFileTime
 0x140023128 InitializeSListHead
 0x140023130 IsDebuggerPresent
 0x140023138 GetModuleHandleW
 0x140023140 RtlUnwindEx
 0x140023148 SetLastError
 0x140023150 EnterCriticalSection
 0x140023158 LeaveCriticalSection
 0x140023160 DeleteCriticalSection
 0x140023168 InitializeCriticalSectionAndSpinCount
 0x140023170 TlsAlloc
 0x140023178 TlsGetValue
 0x140023180 TlsSetValue
 0x140023188 TlsFree
 0x140023190 FreeLibrary
 0x140023198 GetCommandLineA
 0x1400231a0 ReadFile
 0x1400231a8 CreateFileW
 0x1400231b0 GetDriveTypeW
 0x1400231b8 GetFileType
 0x1400231c0 CloseHandle
 0x1400231c8 PeekNamedPipe
 0x1400231d0 SystemTimeToTzSpecificLocalTime
 0x1400231d8 FileTimeToSystemTime
 0x1400231e0 GetFullPathNameW
 0x1400231e8 GetFullPathNameA
 0x1400231f0 RemoveDirectoryW
 0x1400231f8 FindClose
 0x140023200 FindFirstFileExW
 0x140023208 FindNextFileW
 0x140023210 SetStdHandle
 0x140023218 SetConsoleCtrlHandler
 0x140023220 DeleteFileW
 0x140023228 GetStdHandle
 0x140023230 WriteFile
 0x140023238 ExitProcess
 0x140023240 GetModuleHandleExW
 0x140023248 GetACP
 0x140023250 HeapFree
 0x140023258 HeapAlloc
 0x140023260 GetConsoleMode
 0x140023268 ReadConsoleW
 0x140023270 SetFilePointerEx
 0x140023278 GetConsoleCP
 0x140023280 CompareStringW
 0x140023288 LCMapStringW
 0x140023290 GetCurrentDirectoryW
 0x140023298 FlushFileBuffers
 0x1400232a0 SetEnvironmentVariableA
 0x1400232a8 GetFileAttributesExW
 0x1400232b0 IsValidCodePage
 0x1400232b8 GetOEMCP
 0x1400232c0 GetCPInfo
 0x1400232c8 GetEnvironmentStringsW
 0x1400232d0 FreeEnvironmentStringsW
 0x1400232d8 GetStringTypeW
 0x1400232e0 GetProcessHeap
 0x1400232e8 WriteConsoleW
 0x1400232f0 GetTimeZoneInformation
 0x1400232f8 HeapSize
 0x140023300 RaiseException
ADVAPI32.dll
 0x140023000 ConvertStringSecurityDescriptorToSecurityDescriptorW
WS2_32.dll
 0x140023310 ntohl

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure