ScreenShot
| Created | 2021.07.31 13:47 | Machine | s1_win7_x6402 |
| Filename | 112233.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 34 detected (AIDetect, malware2, Crypzip, trQO, GenericKD, Artemis, malicious, confidence, 100%, Attribute, HighConfidence, HiddenRun, CLASSIC, RedLineStealer, Wacatac, score, ZexaF, dr3@aencMdik, ai score=87, PossibleThreat, HgIASZQA) | ||
| md5 | 0602d74b76caa2200b12f83c8a77b617 | ||
| sha256 | c81ccfef5ce97e9647b89a79b4adbdb73feceea4c8ed0fa88b33f02e52859b8f | ||
| ssdeep | 24576:O7WVBJ21Phu7NbcPEipoZDO7yeLa0kKA+Br/PWkZTRMA:IGFqEi2Za7/Lx3p/+SB | ||
| imphash | a011f8d93026fd9f5e9442faeeff606d | ||
| impfuzzy | 96:d7pus+s+rZs4+ysPVkXpZI6kST+7+RGIXUo/zqrx:dpus+liCZQST+79IXn/erx | ||
Network IP location
Signature (35cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| danger | File has been identified by 34 AntiVirus engines on VirusTotal as malicious |
| warning | Generates some ICMP traffic |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Collects information about installed applications |
| watch | Executes one or more WMI queries |
| watch | One or more of the buffers contains an embedded PE file |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Executes one or more WMI queries which can be used to identify virtual machines |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Queries for potentially installed applications |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable uses a known packer |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (39cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | NPKI_Zero | File included NPKI | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | memory |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Hijack_Network | Hijack network configuration | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | Persistence | Install itself for autorun at Windows startup | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
Network (10cnts) ?
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
PE API
IAT(Import Address Table) Library
COMCTL32.dll
0x414010 None
SHELL32.dll
0x414258 SHGetSpecialFolderPathW
0x41425c ShellExecuteW
0x414260 SHGetMalloc
0x414264 SHGetPathFromIDListW
0x414268 SHBrowseForFolderW
0x41426c SHGetFileInfoW
0x414270 ShellExecuteExW
GDI32.dll
0x414018 CreateCompatibleDC
0x41401c CreateFontIndirectW
0x414020 DeleteObject
0x414024 DeleteDC
0x414028 GetCurrentObject
0x41402c StretchBlt
0x414030 GetDeviceCaps
0x414034 CreateCompatibleBitmap
0x414038 SelectObject
0x41403c SetStretchBltMode
0x414040 GetObjectW
ADVAPI32.dll
0x414000 FreeSid
0x414004 AllocateAndInitializeSid
0x414008 CheckTokenMembership
USER32.dll
0x414278 ReleaseDC
0x41427c CopyImage
0x414280 GetParent
0x414284 GetWindowRect
0x414288 wsprintfA
0x41428c CreateWindowExW
0x414290 SetTimer
0x414294 GetWindowDC
0x414298 DispatchMessageW
0x41429c KillTimer
0x4142a0 DestroyWindow
0x4142a4 CharUpperW
0x4142a8 EndDialog
0x4142ac SendMessageW
0x4142b0 wsprintfW
0x4142b4 SetWindowPos
0x4142b8 GetMenu
0x4142bc GetWindowLongW
0x4142c0 GetClassNameA
0x4142c4 GetWindowTextW
0x4142c8 GetWindowTextLengthW
0x4142cc GetMessageW
0x4142d0 SetWindowTextW
0x4142d4 MessageBoxA
0x4142d8 GetKeyState
0x4142dc GetDlgItem
0x4142e0 GetClientRect
0x4142e4 SetWindowLongW
0x4142e8 UnhookWindowsHookEx
0x4142ec SetFocus
0x4142f0 GetSystemMetrics
0x4142f4 SystemParametersInfoW
0x4142f8 ShowWindow
0x4142fc DrawTextW
0x414300 GetDC
0x414304 ClientToScreen
0x414308 GetWindow
0x41430c DialogBoxIndirectParamW
0x414310 DrawIconEx
0x414314 CallWindowProcW
0x414318 DefWindowProcW
0x41431c CallNextHookEx
0x414320 PtInRect
0x414324 SetWindowsHookExW
0x414328 LoadImageW
0x41432c LoadIconW
0x414330 MessageBeep
0x414334 EnableWindow
0x414338 IsWindow
0x41433c EnableMenuItem
0x414340 GetSystemMenu
0x414344 wvsprintfW
0x414348 GetSysColor
0x41434c ScreenToClient
ole32.dll
0x414354 CreateStreamOnHGlobal
0x414358 CoCreateInstance
0x41435c CoInitialize
OLEAUT32.dll
0x414248 SysAllocString
0x41424c VariantClear
0x414250 OleLoadPicture
KERNEL32.dll
0x414048 SetFileTime
0x41404c SetEndOfFile
0x414050 EnterCriticalSection
0x414054 DeleteCriticalSection
0x414058 GetModuleHandleA
0x41405c LeaveCriticalSection
0x414060 WaitForMultipleObjects
0x414064 ReadFile
0x414068 SetFilePointer
0x41406c GetFileSize
0x414070 FormatMessageW
0x414074 lstrcpyW
0x414078 LocalFree
0x41407c IsBadReadPtr
0x414080 GetSystemDirectoryW
0x414084 GetCurrentThreadId
0x414088 SuspendThread
0x41408c TerminateThread
0x414090 InitializeCriticalSection
0x414094 ResetEvent
0x414098 SetEvent
0x41409c CreateEventW
0x4140a0 GetVersionExW
0x4140a4 GetModuleFileNameW
0x4140a8 GetCurrentProcess
0x4140ac SetProcessWorkingSetSize
0x4140b0 SetCurrentDirectoryW
0x4140b4 SetEnvironmentVariableW
0x4140b8 GetDriveTypeW
0x4140bc CreateFileW
0x4140c0 GetCommandLineW
0x4140c4 GetStartupInfoW
0x4140c8 CreateProcessW
0x4140cc CreateJobObjectW
0x4140d0 AssignProcessToJobObject
0x4140d4 CreateIoCompletionPort
0x4140d8 SetInformationJobObject
0x4140dc ResumeThread
0x4140e0 GetQueuedCompletionStatus
0x4140e4 GetExitCodeProcess
0x4140e8 CloseHandle
0x4140ec GetTempPathW
0x4140f0 GetSystemTimeAsFileTime
0x4140f4 lstrlenW
0x4140f8 CompareFileTime
0x4140fc SetThreadLocale
0x414100 FindFirstFileW
0x414104 DeleteFileW
0x414108 FindNextFileW
0x41410c FindClose
0x414110 RemoveDirectoryW
0x414114 ExpandEnvironmentStringsW
0x414118 WideCharToMultiByte
0x41411c VirtualAlloc
0x414120 GlobalMemoryStatusEx
0x414124 lstrcmpW
0x414128 GetEnvironmentVariableW
0x41412c lstrcmpiW
0x414130 lstrlenA
0x414134 GetLocaleInfoW
0x414138 MultiByteToWideChar
0x41413c GetUserDefaultUILanguage
0x414140 GetSystemDefaultUILanguage
0x414144 GetSystemDefaultLCID
0x414148 lstrcmpiA
0x41414c GlobalAlloc
0x414150 GlobalFree
0x414154 MulDiv
0x414158 FindResourceExA
0x41415c SizeofResource
0x414160 ExitProcess
0x414164 lstrcatW
0x414168 GetDiskFreeSpaceExW
0x41416c SetFileAttributesW
0x414170 SetLastError
0x414174 Sleep
0x414178 GetExitCodeThread
0x41417c WaitForSingleObject
0x414180 CreateThread
0x414184 GetLastError
0x414188 SystemTimeToFileTime
0x41418c GetLocalTime
0x414190 GetFileAttributesW
0x414194 CreateDirectoryW
0x414198 WriteFile
0x41419c GetStdHandle
0x4141a0 VirtualFree
0x4141a4 GetModuleHandleW
0x4141a8 GetProcAddress
0x4141ac LoadLibraryA
0x4141b0 LockResource
0x4141b4 LoadResource
0x4141b8 GetStartupInfoA
MSVCRT.dll
0x4141c0 ??3@YAXPAX@Z
0x4141c4 ??2@YAPAXI@Z
0x4141c8 memcmp
0x4141cc free
0x4141d0 memcpy
0x4141d4 _controlfp
0x4141d8 _except_handler3
0x4141dc __set_app_type
0x4141e0 __p__fmode
0x4141e4 __p__commode
0x4141e8 _adjust_fdiv
0x4141ec __setusermatherr
0x4141f0 _initterm
0x4141f4 __getmainargs
0x4141f8 _acmdln
0x4141fc exit
0x414200 _XcptFilter
0x414204 _exit
0x414208 ??1type_info@@UAE@XZ
0x41420c _onexit
0x414210 __dllonexit
0x414214 _CxxThrowException
0x414218 _beginthreadex
0x41421c _EH_prolog
0x414220 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
0x414224 memset
0x414228 _wcsnicmp
0x41422c strncmp
0x414230 wcsncmp
0x414234 malloc
0x414238 memmove
0x41423c _wtol
0x414240 _purecall
EAT(Export Address Table) is none
COMCTL32.dll
0x414010 None
SHELL32.dll
0x414258 SHGetSpecialFolderPathW
0x41425c ShellExecuteW
0x414260 SHGetMalloc
0x414264 SHGetPathFromIDListW
0x414268 SHBrowseForFolderW
0x41426c SHGetFileInfoW
0x414270 ShellExecuteExW
GDI32.dll
0x414018 CreateCompatibleDC
0x41401c CreateFontIndirectW
0x414020 DeleteObject
0x414024 DeleteDC
0x414028 GetCurrentObject
0x41402c StretchBlt
0x414030 GetDeviceCaps
0x414034 CreateCompatibleBitmap
0x414038 SelectObject
0x41403c SetStretchBltMode
0x414040 GetObjectW
ADVAPI32.dll
0x414000 FreeSid
0x414004 AllocateAndInitializeSid
0x414008 CheckTokenMembership
USER32.dll
0x414278 ReleaseDC
0x41427c CopyImage
0x414280 GetParent
0x414284 GetWindowRect
0x414288 wsprintfA
0x41428c CreateWindowExW
0x414290 SetTimer
0x414294 GetWindowDC
0x414298 DispatchMessageW
0x41429c KillTimer
0x4142a0 DestroyWindow
0x4142a4 CharUpperW
0x4142a8 EndDialog
0x4142ac SendMessageW
0x4142b0 wsprintfW
0x4142b4 SetWindowPos
0x4142b8 GetMenu
0x4142bc GetWindowLongW
0x4142c0 GetClassNameA
0x4142c4 GetWindowTextW
0x4142c8 GetWindowTextLengthW
0x4142cc GetMessageW
0x4142d0 SetWindowTextW
0x4142d4 MessageBoxA
0x4142d8 GetKeyState
0x4142dc GetDlgItem
0x4142e0 GetClientRect
0x4142e4 SetWindowLongW
0x4142e8 UnhookWindowsHookEx
0x4142ec SetFocus
0x4142f0 GetSystemMetrics
0x4142f4 SystemParametersInfoW
0x4142f8 ShowWindow
0x4142fc DrawTextW
0x414300 GetDC
0x414304 ClientToScreen
0x414308 GetWindow
0x41430c DialogBoxIndirectParamW
0x414310 DrawIconEx
0x414314 CallWindowProcW
0x414318 DefWindowProcW
0x41431c CallNextHookEx
0x414320 PtInRect
0x414324 SetWindowsHookExW
0x414328 LoadImageW
0x41432c LoadIconW
0x414330 MessageBeep
0x414334 EnableWindow
0x414338 IsWindow
0x41433c EnableMenuItem
0x414340 GetSystemMenu
0x414344 wvsprintfW
0x414348 GetSysColor
0x41434c ScreenToClient
ole32.dll
0x414354 CreateStreamOnHGlobal
0x414358 CoCreateInstance
0x41435c CoInitialize
OLEAUT32.dll
0x414248 SysAllocString
0x41424c VariantClear
0x414250 OleLoadPicture
KERNEL32.dll
0x414048 SetFileTime
0x41404c SetEndOfFile
0x414050 EnterCriticalSection
0x414054 DeleteCriticalSection
0x414058 GetModuleHandleA
0x41405c LeaveCriticalSection
0x414060 WaitForMultipleObjects
0x414064 ReadFile
0x414068 SetFilePointer
0x41406c GetFileSize
0x414070 FormatMessageW
0x414074 lstrcpyW
0x414078 LocalFree
0x41407c IsBadReadPtr
0x414080 GetSystemDirectoryW
0x414084 GetCurrentThreadId
0x414088 SuspendThread
0x41408c TerminateThread
0x414090 InitializeCriticalSection
0x414094 ResetEvent
0x414098 SetEvent
0x41409c CreateEventW
0x4140a0 GetVersionExW
0x4140a4 GetModuleFileNameW
0x4140a8 GetCurrentProcess
0x4140ac SetProcessWorkingSetSize
0x4140b0 SetCurrentDirectoryW
0x4140b4 SetEnvironmentVariableW
0x4140b8 GetDriveTypeW
0x4140bc CreateFileW
0x4140c0 GetCommandLineW
0x4140c4 GetStartupInfoW
0x4140c8 CreateProcessW
0x4140cc CreateJobObjectW
0x4140d0 AssignProcessToJobObject
0x4140d4 CreateIoCompletionPort
0x4140d8 SetInformationJobObject
0x4140dc ResumeThread
0x4140e0 GetQueuedCompletionStatus
0x4140e4 GetExitCodeProcess
0x4140e8 CloseHandle
0x4140ec GetTempPathW
0x4140f0 GetSystemTimeAsFileTime
0x4140f4 lstrlenW
0x4140f8 CompareFileTime
0x4140fc SetThreadLocale
0x414100 FindFirstFileW
0x414104 DeleteFileW
0x414108 FindNextFileW
0x41410c FindClose
0x414110 RemoveDirectoryW
0x414114 ExpandEnvironmentStringsW
0x414118 WideCharToMultiByte
0x41411c VirtualAlloc
0x414120 GlobalMemoryStatusEx
0x414124 lstrcmpW
0x414128 GetEnvironmentVariableW
0x41412c lstrcmpiW
0x414130 lstrlenA
0x414134 GetLocaleInfoW
0x414138 MultiByteToWideChar
0x41413c GetUserDefaultUILanguage
0x414140 GetSystemDefaultUILanguage
0x414144 GetSystemDefaultLCID
0x414148 lstrcmpiA
0x41414c GlobalAlloc
0x414150 GlobalFree
0x414154 MulDiv
0x414158 FindResourceExA
0x41415c SizeofResource
0x414160 ExitProcess
0x414164 lstrcatW
0x414168 GetDiskFreeSpaceExW
0x41416c SetFileAttributesW
0x414170 SetLastError
0x414174 Sleep
0x414178 GetExitCodeThread
0x41417c WaitForSingleObject
0x414180 CreateThread
0x414184 GetLastError
0x414188 SystemTimeToFileTime
0x41418c GetLocalTime
0x414190 GetFileAttributesW
0x414194 CreateDirectoryW
0x414198 WriteFile
0x41419c GetStdHandle
0x4141a0 VirtualFree
0x4141a4 GetModuleHandleW
0x4141a8 GetProcAddress
0x4141ac LoadLibraryA
0x4141b0 LockResource
0x4141b4 LoadResource
0x4141b8 GetStartupInfoA
MSVCRT.dll
0x4141c0 ??3@YAXPAX@Z
0x4141c4 ??2@YAPAXI@Z
0x4141c8 memcmp
0x4141cc free
0x4141d0 memcpy
0x4141d4 _controlfp
0x4141d8 _except_handler3
0x4141dc __set_app_type
0x4141e0 __p__fmode
0x4141e4 __p__commode
0x4141e8 _adjust_fdiv
0x4141ec __setusermatherr
0x4141f0 _initterm
0x4141f4 __getmainargs
0x4141f8 _acmdln
0x4141fc exit
0x414200 _XcptFilter
0x414204 _exit
0x414208 ??1type_info@@UAE@XZ
0x41420c _onexit
0x414210 __dllonexit
0x414214 _CxxThrowException
0x414218 _beginthreadex
0x41421c _EH_prolog
0x414220 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
0x414224 memset
0x414228 _wcsnicmp
0x41422c strncmp
0x414230 wcsncmp
0x414234 malloc
0x414238 memmove
0x41423c _wtol
0x414240 _purecall
EAT(Export Address Table) is none