popup

Report - clip.exe

RAT Generic Malware UPX Malicious Library DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug AntiVM PE64 PE File .NET EXE PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.07.31 14:04 Machine s1_win7_x6402
Filename clip.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score
10
 Behavior Score
12.8
ZERO API file : malware
VT API (file) 35 detected (ClipBanker, Bulz, Unsafe, malicious, Static AI, Malicious PE, kcloud, Conteban, score, Artemis, ai score=100, MulDrop, PowerShell, R002H0DGU21, Outbreak, susgen, confidence)
md5 17b0dca4c5d5c3037c814ac1a253082b
sha256 0389ffef740d3bd365f2b699ac006b478a5346a1dc2383e10fd5152771641c0b
ssdeep 12288:QbjDhu9T09gUX6yBedMSGu+wTS0TMLeYfS9UiDa:e1eT0PqyodsXwO0c6eiDa
imphash 7182b1ea6f92adbf459a2c65d8d4dd9e
impfuzzy 48:YMaG/U3WmCp51GNxOI40nlUY5LoeSZ/g/KAwEUEkE/1WSY+09AFXElvyAobFzGJm:YnmU3JCp51GNxh40nlbo1WNwCJ
  Network IP location

Signature (27cnts)

Level Description
danger Executed a process and injected code into it
danger File has been identified by 35 AntiVirus engines on VirusTotal as malicious
watch Allocates execute permission to another process indicative of possible code injection
watch Code injection by writing an executable or DLL to the memory of another process
watch Creates an Alternate Data Stream (ADS)
watch Deletes executed files from disk
watch Drops a binary and executes it
watch Manipulates memory of a non-child process indicative of process injection
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Terminates another process
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Uses Windows APIs to generate a cryptographic key

Rules (40cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Network_Downloader File Downloader memory
watch UPX_Zero UPX packed file binaries (upload)
notice Code_injection Code injection with CreateRemoteThread in a remote process memory
notice Create_Service Create a windows service memory
notice Escalate_priviledges Escalate priviledges memory
notice KeyLogger Run a KeyLogger memory
notice local_credential_Steal Steal credential memory
notice Network_DGA Communication using DGA memory
notice Network_DNS Communications use DNS memory
notice Network_FTP Communications over FTP memory
notice Network_HTTP Communications over HTTP memory
notice Network_P2P_Win Communications over P2P network memory
notice Network_TCP_Socket Communications over RAW Socket memory
notice ScreenShot Take ScreenShot memory
notice Sniff_Audio Record Audio memory
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info Is_DotNET_EXE (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info win_hook Affect hook table memory
info Win_Backdoor_AsyncRAT_Zero Win Backdoor AsyncRAT binaries (download)

Network (6cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
whois
TW EDGECAST 117.18.237.29 clean
https://cdn.discordapp.com/attachments/868908533897363470/870626071547097128/clo.exe
whois
Unknown 162.159.129.233 clean
ocsp.digicert.com
whois
TW EDGECAST 117.18.237.29 clean
cdn.discordapp.com
whois
Unknown 162.159.135.233 malware
117.18.237.29
whois
TW EDGECAST 117.18.237.29 clean
162.159.129.233
whois
Unknown 162.159.129.233 malware

Suricata ids

PE API

IAT(Import Address Table) Library

msvcrt.dll
 0x14001f6a8 memset
 0x14001f6b0 wcsncmp
 0x14001f6b8 memmove
 0x14001f6c0 wcsncpy
 0x14001f6c8 wcsstr
 0x14001f6d0 _wcsnicmp
 0x14001f6d8 _wcsdup
 0x14001f6e0 free
 0x14001f6e8 _wcsicmp
 0x14001f6f0 wcslen
 0x14001f6f8 wcscpy
 0x14001f700 wcscmp
 0x14001f708 memcpy
 0x14001f710 tolower
 0x14001f718 wcscat
 0x14001f720 malloc
KERNEL32.dll
 0x14001f730 GetModuleHandleW
 0x14001f738 HeapCreate
 0x14001f740 GetStdHandle
 0x14001f748 HeapDestroy
 0x14001f750 ExitProcess
 0x14001f758 WriteFile
 0x14001f760 GetTempFileNameW
 0x14001f768 LoadLibraryExW
 0x14001f770 EnumResourceTypesW
 0x14001f778 FreeLibrary
 0x14001f780 RemoveDirectoryW
 0x14001f788 GetExitCodeProcess
 0x14001f790 EnumResourceNamesW
 0x14001f798 GetCommandLineW
 0x14001f7a0 LoadResource
 0x14001f7a8 SizeofResource
 0x14001f7b0 FreeResource
 0x14001f7b8 FindResourceW
 0x14001f7c0 GetShortPathNameW
 0x14001f7c8 GetSystemDirectoryW
 0x14001f7d0 EnterCriticalSection
 0x14001f7d8 CloseHandle
 0x14001f7e0 LeaveCriticalSection
 0x14001f7e8 InitializeCriticalSection
 0x14001f7f0 WaitForSingleObject
 0x14001f7f8 TerminateThread
 0x14001f800 CreateThread
 0x14001f808 Sleep
 0x14001f810 WideCharToMultiByte
 0x14001f818 HeapAlloc
 0x14001f820 HeapFree
 0x14001f828 LoadLibraryW
 0x14001f830 GetProcAddress
 0x14001f838 GetCurrentProcessId
 0x14001f840 GetCurrentThreadId
 0x14001f848 GetModuleFileNameW
 0x14001f850 GetEnvironmentVariableW
 0x14001f858 SetEnvironmentVariableW
 0x14001f860 GetCurrentProcess
 0x14001f868 TerminateProcess
 0x14001f870 RtlLookupFunctionEntry
 0x14001f878 RtlVirtualUnwind
 0x14001f880 RemoveVectoredExceptionHandler
 0x14001f888 AddVectoredExceptionHandler
 0x14001f890 HeapSize
 0x14001f898 MultiByteToWideChar
 0x14001f8a0 CreateDirectoryW
 0x14001f8a8 SetFileAttributesW
 0x14001f8b0 GetTempPathW
 0x14001f8b8 DeleteFileW
 0x14001f8c0 GetCurrentDirectoryW
 0x14001f8c8 SetCurrentDirectoryW
 0x14001f8d0 CreateFileW
 0x14001f8d8 SetFilePointer
 0x14001f8e0 TlsFree
 0x14001f8e8 TlsGetValue
 0x14001f8f0 TlsSetValue
 0x14001f8f8 TlsAlloc
 0x14001f900 HeapReAlloc
 0x14001f908 DeleteCriticalSection
 0x14001f910 GetLastError
 0x14001f918 SetLastError
 0x14001f920 UnregisterWait
 0x14001f928 GetCurrentThread
 0x14001f930 DuplicateHandle
 0x14001f938 RegisterWaitForSingleObject
SHELL32.DLL
 0x14001f948 ShellExecuteExW
 0x14001f950 SHGetFolderLocation
 0x14001f958 SHGetPathFromIDListW
WINMM.DLL
 0x14001f968 timeBeginPeriod
OLE32.DLL
 0x14001f978 CoInitialize
 0x14001f980 CoTaskMemFree
SHLWAPI.DLL
 0x14001f990 PathAddBackslashW
 0x14001f998 PathRenameExtensionW
 0x14001f9a0 PathQuoteSpacesW
 0x14001f9a8 PathRemoveArgsW
 0x14001f9b0 PathRemoveBackslashW
USER32.DLL
 0x14001f9c0 CharUpperW
 0x14001f9c8 CharLowerW
 0x14001f9d0 MessageBoxW
 0x14001f9d8 DefWindowProcW
 0x14001f9e0 GetWindowLongPtrW
 0x14001f9e8 GetWindowTextLengthW
 0x14001f9f0 GetWindowTextW
 0x14001f9f8 EnableWindow
 0x14001fa00 DestroyWindow
 0x14001fa08 UnregisterClassW
 0x14001fa10 LoadIconW
 0x14001fa18 LoadCursorW
 0x14001fa20 RegisterClassExW
 0x14001fa28 IsWindowEnabled
 0x14001fa30 GetSystemMetrics
 0x14001fa38 CreateWindowExW
 0x14001fa40 SetWindowLongPtrW
 0x14001fa48 SendMessageW
 0x14001fa50 SetFocus
 0x14001fa58 CreateAcceleratorTableW
 0x14001fa60 SetForegroundWindow
 0x14001fa68 BringWindowToTop
 0x14001fa70 GetMessageW
 0x14001fa78 TranslateAcceleratorW
 0x14001fa80 TranslateMessage
 0x14001fa88 DispatchMessageW
 0x14001fa90 DestroyAcceleratorTable
 0x14001fa98 PostMessageW
 0x14001faa0 GetForegroundWindow
 0x14001faa8 GetWindowThreadProcessId
 0x14001fab0 IsWindowVisible
 0x14001fab8 EnumWindows
 0x14001fac0 SetWindowPos
GDI32.DLL
 0x14001fad0 GetStockObject
COMCTL32.DLL
 0x14001fae0 InitCommonControlsEx

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure