ScreenShot
| Created | 2021.06.24 19:11 | Machine | s1_win7_x6402 |
| Filename | sfx_123_701.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 20 detected (AIDetect, malware1, Malicious, score, Save, GenericKD, confidence, Qshell, Static AI, Suspicious PE, ai score=83, kcloud, Bunitucrypt, Artemis, Unsafe, Probably Heur, RARAutorun) | ||
| md5 | c8d1263386f7cb98ca1795ba2558a443 | ||
| sha256 | a56fd1905d2af8a3a945ca699d94a4e1dff1759c719284af3ca975e47d150be5 | ||
| ssdeep | 49152:NsrFa7LUfPSDdjfoaanX3Kv24Dpdj0JK3iKrSbc1Qwf:urg7LaSxDjjv2SdguiKrHQwf | ||
| imphash | ae9f6a32bb8b03dce37903edbc855ba1 | ||
| impfuzzy | 48:J9F2OcLKc1XFjRWDYgeBtDX+Kc+pnCHFa:JqFLKc1XF8EdBtDX+Kc+pnMFa | ||
Network IP location
Signature (20cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 20 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops an executable to the user AppData folder |
| notice | Executes one or more WMI queries |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Terminates another process |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (38cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Network_Downloader | File Downloader | memory |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Hijack_Network | Hijack network configuration | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | Persistence | Install itself for autorun at Windows startup | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x427000 GetLastError
0x427004 SetLastError
0x427008 FormatMessageW
0x42700c GetFileType
0x427010 GetStdHandle
0x427014 WriteFile
0x427018 ReadFile
0x42701c FlushFileBuffers
0x427020 SetEndOfFile
0x427024 SetFilePointer
0x427028 SetFileTime
0x42702c CloseHandle
0x427030 CreateFileW
0x427034 CreateDirectoryW
0x427038 SetFileAttributesW
0x42703c GetFileAttributesW
0x427040 DeleteFileW
0x427044 MoveFileW
0x427048 FindClose
0x42704c FindFirstFileW
0x427050 FindNextFileW
0x427054 GetVersionExW
0x427058 GetCurrentDirectoryW
0x42705c GetFullPathNameW
0x427060 FoldStringW
0x427064 GetModuleFileNameW
0x427068 GetModuleHandleW
0x42706c FindResourceW
0x427070 FreeLibrary
0x427074 GetProcAddress
0x427078 GetCurrentProcessId
0x42707c ExitProcess
0x427080 SetThreadExecutionState
0x427084 Sleep
0x427088 LoadLibraryW
0x42708c GetSystemDirectoryW
0x427090 CompareStringW
0x427094 AllocConsole
0x427098 FreeConsole
0x42709c AttachConsole
0x4270a0 WriteConsoleW
0x4270a4 TzSpecificLocalTimeToSystemTime
0x4270a8 SystemTimeToFileTime
0x4270ac FileTimeToLocalFileTime
0x4270b0 LocalFileTimeToFileTime
0x4270b4 FileTimeToSystemTime
0x4270b8 GetCPInfo
0x4270bc IsDBCSLeadByte
0x4270c0 MultiByteToWideChar
0x4270c4 WideCharToMultiByte
0x4270c8 GlobalAlloc
0x4270cc LockResource
0x4270d0 GlobalLock
0x4270d4 GlobalUnlock
0x4270d8 GlobalFree
0x4270dc LoadResource
0x4270e0 SizeofResource
0x4270e4 SetCurrentDirectoryW
0x4270e8 GetExitCodeProcess
0x4270ec WaitForSingleObject
0x4270f0 GetLocalTime
0x4270f4 GetTickCount
0x4270f8 MapViewOfFile
0x4270fc UnmapViewOfFile
0x427100 CreateFileMappingW
0x427104 OpenFileMappingW
0x427108 GetCommandLineW
0x42710c SetEnvironmentVariableW
0x427110 ExpandEnvironmentStringsW
0x427114 GetTempPathW
0x427118 MoveFileExW
0x42711c GetLocaleInfoW
0x427120 GetTimeFormatW
0x427124 GetDateFormatW
0x427128 GetNumberFormatW
0x42712c SetFilePointerEx
0x427130 GetConsoleMode
0x427134 GetConsoleCP
0x427138 HeapSize
0x42713c SetStdHandle
0x427140 GetProcessHeap
0x427144 RaiseException
0x427148 GetSystemInfo
0x42714c VirtualProtect
0x427150 VirtualQuery
0x427154 LoadLibraryExA
0x427158 IsProcessorFeaturePresent
0x42715c IsDebuggerPresent
0x427160 UnhandledExceptionFilter
0x427164 SetUnhandledExceptionFilter
0x427168 GetStartupInfoW
0x42716c QueryPerformanceCounter
0x427170 GetCurrentThreadId
0x427174 GetSystemTimeAsFileTime
0x427178 InitializeSListHead
0x42717c GetCurrentProcess
0x427180 TerminateProcess
0x427184 RtlUnwind
0x427188 EncodePointer
0x42718c EnterCriticalSection
0x427190 LeaveCriticalSection
0x427194 DeleteCriticalSection
0x427198 InitializeCriticalSectionAndSpinCount
0x42719c TlsAlloc
0x4271a0 TlsGetValue
0x4271a4 TlsSetValue
0x4271a8 TlsFree
0x4271ac LoadLibraryExW
0x4271b0 QueryPerformanceFrequency
0x4271b4 GetModuleHandleExW
0x4271b8 GetModuleFileNameA
0x4271bc GetACP
0x4271c0 HeapFree
0x4271c4 HeapAlloc
0x4271c8 HeapReAlloc
0x4271cc GetStringTypeW
0x4271d0 LCMapStringW
0x4271d4 FindFirstFileExA
0x4271d8 FindNextFileA
0x4271dc IsValidCodePage
0x4271e0 GetOEMCP
0x4271e4 GetCommandLineA
0x4271e8 GetEnvironmentStringsW
0x4271ec FreeEnvironmentStringsW
0x4271f0 DecodePointer
gdiplus.dll
0x4271f8 GdiplusShutdown
0x4271fc GdiplusStartup
0x427200 GdipCreateHBITMAPFromBitmap
0x427204 GdipCreateBitmapFromStreamICM
0x427208 GdipCreateBitmapFromStream
0x42720c GdipDisposeImage
0x427210 GdipCloneImage
0x427214 GdipFree
0x427218 GdipAlloc
EAT(Export Address Table) Library
KERNEL32.dll
0x427000 GetLastError
0x427004 SetLastError
0x427008 FormatMessageW
0x42700c GetFileType
0x427010 GetStdHandle
0x427014 WriteFile
0x427018 ReadFile
0x42701c FlushFileBuffers
0x427020 SetEndOfFile
0x427024 SetFilePointer
0x427028 SetFileTime
0x42702c CloseHandle
0x427030 CreateFileW
0x427034 CreateDirectoryW
0x427038 SetFileAttributesW
0x42703c GetFileAttributesW
0x427040 DeleteFileW
0x427044 MoveFileW
0x427048 FindClose
0x42704c FindFirstFileW
0x427050 FindNextFileW
0x427054 GetVersionExW
0x427058 GetCurrentDirectoryW
0x42705c GetFullPathNameW
0x427060 FoldStringW
0x427064 GetModuleFileNameW
0x427068 GetModuleHandleW
0x42706c FindResourceW
0x427070 FreeLibrary
0x427074 GetProcAddress
0x427078 GetCurrentProcessId
0x42707c ExitProcess
0x427080 SetThreadExecutionState
0x427084 Sleep
0x427088 LoadLibraryW
0x42708c GetSystemDirectoryW
0x427090 CompareStringW
0x427094 AllocConsole
0x427098 FreeConsole
0x42709c AttachConsole
0x4270a0 WriteConsoleW
0x4270a4 TzSpecificLocalTimeToSystemTime
0x4270a8 SystemTimeToFileTime
0x4270ac FileTimeToLocalFileTime
0x4270b0 LocalFileTimeToFileTime
0x4270b4 FileTimeToSystemTime
0x4270b8 GetCPInfo
0x4270bc IsDBCSLeadByte
0x4270c0 MultiByteToWideChar
0x4270c4 WideCharToMultiByte
0x4270c8 GlobalAlloc
0x4270cc LockResource
0x4270d0 GlobalLock
0x4270d4 GlobalUnlock
0x4270d8 GlobalFree
0x4270dc LoadResource
0x4270e0 SizeofResource
0x4270e4 SetCurrentDirectoryW
0x4270e8 GetExitCodeProcess
0x4270ec WaitForSingleObject
0x4270f0 GetLocalTime
0x4270f4 GetTickCount
0x4270f8 MapViewOfFile
0x4270fc UnmapViewOfFile
0x427100 CreateFileMappingW
0x427104 OpenFileMappingW
0x427108 GetCommandLineW
0x42710c SetEnvironmentVariableW
0x427110 ExpandEnvironmentStringsW
0x427114 GetTempPathW
0x427118 MoveFileExW
0x42711c GetLocaleInfoW
0x427120 GetTimeFormatW
0x427124 GetDateFormatW
0x427128 GetNumberFormatW
0x42712c SetFilePointerEx
0x427130 GetConsoleMode
0x427134 GetConsoleCP
0x427138 HeapSize
0x42713c SetStdHandle
0x427140 GetProcessHeap
0x427144 RaiseException
0x427148 GetSystemInfo
0x42714c VirtualProtect
0x427150 VirtualQuery
0x427154 LoadLibraryExA
0x427158 IsProcessorFeaturePresent
0x42715c IsDebuggerPresent
0x427160 UnhandledExceptionFilter
0x427164 SetUnhandledExceptionFilter
0x427168 GetStartupInfoW
0x42716c QueryPerformanceCounter
0x427170 GetCurrentThreadId
0x427174 GetSystemTimeAsFileTime
0x427178 InitializeSListHead
0x42717c GetCurrentProcess
0x427180 TerminateProcess
0x427184 RtlUnwind
0x427188 EncodePointer
0x42718c EnterCriticalSection
0x427190 LeaveCriticalSection
0x427194 DeleteCriticalSection
0x427198 InitializeCriticalSectionAndSpinCount
0x42719c TlsAlloc
0x4271a0 TlsGetValue
0x4271a4 TlsSetValue
0x4271a8 TlsFree
0x4271ac LoadLibraryExW
0x4271b0 QueryPerformanceFrequency
0x4271b4 GetModuleHandleExW
0x4271b8 GetModuleFileNameA
0x4271bc GetACP
0x4271c0 HeapFree
0x4271c4 HeapAlloc
0x4271c8 HeapReAlloc
0x4271cc GetStringTypeW
0x4271d0 LCMapStringW
0x4271d4 FindFirstFileExA
0x4271d8 FindNextFileA
0x4271dc IsValidCodePage
0x4271e0 GetOEMCP
0x4271e4 GetCommandLineA
0x4271e8 GetEnvironmentStringsW
0x4271ec FreeEnvironmentStringsW
0x4271f0 DecodePointer
gdiplus.dll
0x4271f8 GdiplusShutdown
0x4271fc GdiplusStartup
0x427200 GdipCreateHBITMAPFromBitmap
0x427204 GdipCreateBitmapFromStreamICM
0x427208 GdipCreateBitmapFromStream
0x42720c GdipDisposeImage
0x427210 GdipCloneImage
0x427214 GdipFree
0x427218 GdipAlloc
EAT(Export Address Table) Library