Report - askinstall55.exe

Trojan_PWS_Stealer Gen2 NPKI BitCoin Credential User Data Generic Malware Malicious Packer UPX Malicious Library SQLite Cookie Anti_VM DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenS
ScreenShot
Created 2021.08.05 10:12 Machine s1_win7_x6401
Filename askinstall55.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
1
Behavior Score
11.4
ZERO API file : malware
VT API (file) 51 detected (malicious, high confidence, Siggen13, Zusy, DisbukRI, S19305183, GenericRXLT, Unsafe, Save, Socelars, ZexaF, z10@aGr2, Attribute, HighConfidence, Razy, PWSX, ypsig@0, R002C0PH221, PUPXFM, R + Troj, BGVO, Static AI, Suspicious PE, Disbuk, AGEN, ai score=100, kcloud, score, R372531, BScope, Agentb, Mikey, Glupteba, Bruteforce, FBAdsCard, CLASSIC, Msc3k1mjpc0, confidence, 100%, HgIASZkA)
md5 1219ec0cfe2e0dfa88dae43f713b1a94
sha256 72ee8b6976f6a73145f1db968f5d2a5ee43dfdd905bbf7e504cf0f47fce85af7
ssdeep 24576:ejmZxpT2xecnFAaeHrTM+zNyReyAN4/FDsSl3qJbZ9GgtS/Zj8PXsd9PC6Nz:vZxp1cFA3rY+hykedwYqJygtS/R8PXO1
imphash 4f0608b5638c60342069764638589dcf
impfuzzy 48:/XV+FLa0DZuBGRMUS0LES9wYQJcGtp48+9faOwOe6mxvmYBOvyzy:/XAFuEjRMr0LESBQJcGtp43ta736mxOP
  Network IP location

Signature (29cnts)

Level Description
danger File has been identified by 51 AntiVirus engines on VirusTotal as malicious
watch Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic)
watch One or more non-whitelisted processes were created
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Executes one or more WMI queries
notice Foreign language identified in PE resource
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Potentially malicious URLs were found in the process memory dump
notice Queries for potentially installed applications
notice Sends data using the HTTP POST Method
notice Steals private information from local Internet browsers
notice Terminates another process
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks if process is being debugged by a debugger
info Command line console output was observed
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path
info Tries to locate where the browsers are installed

Rules (56cnts)

Level Name Description Collection
danger NPKI_Zero File included NPKI binaries (download)
danger Trojan_PWS_Stealer_1_Zero Trojan.PWS.Stealer Zero binaries (upload)
warning Credential_User_Data_Check_Zero Credential User Data Check binaries (upload)
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch Network_Downloader File Downloader memory
watch SQLite_cookies_Check_Zero SQLite Cookie Check... select binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (download)
notice BitCoin Perform crypto currency mining memory
notice Code_injection Code injection with CreateRemoteThread in a remote process memory
notice Create_Service Create a windows service memory
notice Escalate_priviledges Escalate priviledges memory
notice KeyLogger Run a KeyLogger memory
notice local_credential_Steal Steal credential memory
notice Network_DGA Communication using DGA memory
notice Network_DNS Communications use DNS memory
notice Network_FTP Communications over FTP memory
notice Network_HTTP Communications over HTTP memory
notice Network_P2P_Win Communications over P2P network memory
notice Network_TCP_Socket Communications over RAW Socket memory
notice Persistence Install itself for autorun at Windows startup memory
notice ScreenShot Take ScreenShot memory
notice Sniff_Audio Record Audio memory
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsDLL (no description) binaries (download)
info IsELF Executable and Linking Format executable file (Linux/Unix) binaries (download)
info IsPE32 (no description) binaries (upload)
info IsPE64 (no description) binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info PNG_Format_Zero PNG Format binaries (download)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info Virtual_currency_Zero Virtual currency memory
info vmdetect Possibly employs anti-virtualization techniques memory
info win_hook Affect hook table memory
info Win32_Trojan_Gen_2_0904B0_Zero Win32 Trojan Gen binaries (upload)

Network (12cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://www.nincefcs.xyz/Home/Index/lkdinl RU TimeWeb Ltd. 188.225.87.175 3618 mailcious
http://www.iyiqian.com/ Unknown 103.155.92.58 2326 mailcious
https://iplogger.org/1lcZz DE Hetzner Online GmbH 88.99.66.31 clean
https://www.listincode.com/ US AS-CHOOPA 144.202.76.47 2327 mailcious
www.listincode.com US AS-CHOOPA 144.202.76.47 mailcious
www.nincefcs.xyz RU TimeWeb Ltd. 188.225.87.175 mailcious
www.iyiqian.com Unknown 103.155.92.58 mailcious
iplogger.org DE Hetzner Online GmbH 88.99.66.31 mailcious
103.155.92.58 Unknown 103.155.92.58 mailcious
88.99.66.31 DE Hetzner Online GmbH 88.99.66.31 mailcious
144.202.76.47 US AS-CHOOPA 144.202.76.47 mailcious
188.225.87.175 RU TimeWeb Ltd. 188.225.87.175 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x50e050 LocalAlloc
 0x50e054 LocalFree
 0x50e058 WinExec
 0x50e05c GetComputerNameW
 0x50e060 GetModuleFileNameA
 0x50e064 GetCurrentProcessId
 0x50e068 OpenProcess
 0x50e06c GetModuleFileNameW
 0x50e070 SetLastError
 0x50e074 GetCurrentThread
 0x50e078 FindResourceW
 0x50e07c GetPrivateProfileStringW
 0x50e080 CopyFileW
 0x50e084 SetStdHandle
 0x50e088 SetEnvironmentVariableW
 0x50e08c FreeEnvironmentStringsW
 0x50e090 GetEnvironmentStringsW
 0x50e094 GetOEMCP
 0x50e098 SizeofResource
 0x50e09c CreateProcessA
 0x50e0a0 LockResource
 0x50e0a4 LoadResource
 0x50e0a8 FreeLibrary
 0x50e0ac GetTickCount
 0x50e0b0 TerminateProcess
 0x50e0b4 Sleep
 0x50e0b8 WaitForSingleObject
 0x50e0bc GetProcessHeap
 0x50e0c0 HeapAlloc
 0x50e0c4 GetLastError
 0x50e0c8 GetTempPathA
 0x50e0cc CreateDirectoryA
 0x50e0d0 SetCurrentDirectoryW
 0x50e0d4 GetShortPathNameA
 0x50e0d8 LoadLibraryW
 0x50e0dc GetProcAddress
 0x50e0e0 WideCharToMultiByte
 0x50e0e4 MultiByteToWideChar
 0x50e0e8 SystemTimeToFileTime
 0x50e0ec DosDateTimeToFileTime
 0x50e0f0 GetCurrentProcess
 0x50e0f4 DuplicateHandle
 0x50e0f8 CloseHandle
 0x50e0fc WriteFile
 0x50e100 SetFileTime
 0x50e104 SetFilePointer
 0x50e108 ReadFile
 0x50e10c GetFileType
 0x50e110 CreateFileW
 0x50e114 CreateDirectoryW
 0x50e118 CreateEventW
 0x50e11c GetCurrentDirectoryW
 0x50e120 GetACP
 0x50e124 IsValidCodePage
 0x50e128 FindNextFileW
 0x50e12c FindFirstFileExW
 0x50e130 FindClose
 0x50e134 GetTimeZoneInformation
 0x50e138 GetFileSizeEx
 0x50e13c GetConsoleCP
 0x50e140 SetFilePointerEx
 0x50e144 ReadConsoleW
 0x50e148 GetConsoleMode
 0x50e14c EnumSystemLocalesW
 0x50e150 GetUserDefaultLCID
 0x50e154 IsValidLocale
 0x50e158 GetCommandLineW
 0x50e15c GetCommandLineA
 0x50e160 GetStdHandle
 0x50e164 ExitProcess
 0x50e168 GetModuleHandleExW
 0x50e16c FreeLibraryAndExitThread
 0x50e170 ExitThread
 0x50e174 CreateThread
 0x50e178 LoadLibraryExW
 0x50e17c RtlUnwind
 0x50e180 RaiseException
 0x50e184 GetStringTypeW
 0x50e188 GetLocaleInfoW
 0x50e18c LCMapStringW
 0x50e190 CompareStringW
 0x50e194 GetCPInfo
 0x50e198 TlsFree
 0x50e19c WriteConsoleW
 0x50e1a0 TlsSetValue
 0x50e1a4 TlsGetValue
 0x50e1a8 TlsAlloc
 0x50e1ac SwitchToThread
 0x50e1b0 DecodePointer
 0x50e1b4 EncodePointer
 0x50e1b8 InitializeSListHead
 0x50e1bc GetStartupInfoW
 0x50e1c0 IsDebuggerPresent
 0x50e1c4 GetModuleHandleW
 0x50e1c8 ResetEvent
 0x50e1cc SetEvent
 0x50e1d0 InitializeCriticalSectionAndSpinCount
 0x50e1d4 IsProcessorFeaturePresent
 0x50e1d8 SetUnhandledExceptionFilter
 0x50e1dc UnhandledExceptionFilter
 0x50e1e0 FlushFileBuffers
 0x50e1e4 QueryPerformanceCounter
 0x50e1e8 MapViewOfFile
 0x50e1ec CreateFileMappingW
 0x50e1f0 FormatMessageA
 0x50e1f4 GetSystemTime
 0x50e1f8 GetSystemTimeAsFileTime
 0x50e1fc AreFileApisANSI
 0x50e200 TryEnterCriticalSection
 0x50e204 HeapCreate
 0x50e208 HeapFree
 0x50e20c EnterCriticalSection
 0x50e210 GetFullPathNameW
 0x50e214 GetDiskFreeSpaceW
 0x50e218 OutputDebugStringA
 0x50e21c LockFile
 0x50e220 LeaveCriticalSection
 0x50e224 InitializeCriticalSection
 0x50e228 GetFullPathNameA
 0x50e22c SetEndOfFile
 0x50e230 UnlockFileEx
 0x50e234 GetTempPathW
 0x50e238 CreateMutexW
 0x50e23c GetFileAttributesW
 0x50e240 GetCurrentThreadId
 0x50e244 UnmapViewOfFile
 0x50e248 HeapValidate
 0x50e24c HeapSize
 0x50e250 FormatMessageW
 0x50e254 GetDiskFreeSpaceA
 0x50e258 GetFileAttributesA
 0x50e25c GetFileAttributesExW
 0x50e260 OutputDebugStringW
 0x50e264 FlushViewOfFile
 0x50e268 CreateFileA
 0x50e26c LoadLibraryA
 0x50e270 WaitForSingleObjectEx
 0x50e274 DeleteFileA
 0x50e278 DeleteFileW
 0x50e27c HeapReAlloc
 0x50e280 GetSystemInfo
 0x50e284 HeapCompact
 0x50e288 HeapDestroy
 0x50e28c UnlockFile
 0x50e290 LockFileEx
 0x50e294 GetFileSize
 0x50e298 DeleteCriticalSection
ADVAPI32.dll
 0x50e000 LookupPrivilegeValueW
 0x50e004 AdjustTokenPrivileges
 0x50e008 LookupAccountNameW
 0x50e00c SetSecurityDescriptorOwner
 0x50e010 SetSecurityDescriptorGroup
 0x50e014 SetSecurityDescriptorDacl
 0x50e018 IsValidSecurityDescriptor
 0x50e01c InitializeSecurityDescriptor
 0x50e020 InitializeAcl
 0x50e024 GetTokenInformation
 0x50e028 GetLengthSid
 0x50e02c FreeSid
 0x50e030 EqualSid
 0x50e034 DuplicateToken
 0x50e038 AllocateAndInitializeSid
 0x50e03c AddAccessAllowedAce
 0x50e040 AccessCheck
 0x50e044 OpenThreadToken
 0x50e048 OpenProcessToken
SHELL32.dll
 0x50e2a8 ShellExecuteExA
ole32.dll
 0x50e2fc CoInitializeEx
 0x50e300 CoGetObject
 0x50e304 CoUninitialize
WININET.dll
 0x50e2b0 InternetGetCookieExA
NETAPI32.dll
 0x50e2a0 Netbios
ntdll.dll
 0x50e2b8 RtlInitUnicodeString
 0x50e2bc NtFreeVirtualMemory
 0x50e2c0 LdrEnumerateLoadedModules
 0x50e2c4 RtlEqualUnicodeString
 0x50e2c8 RtlAcquirePebLock
 0x50e2cc NtAllocateVirtualMemory
 0x50e2d0 RtlReleasePebLock
 0x50e2d4 RtlNtStatusToDosError
 0x50e2d8 RtlCreateHeap
 0x50e2dc RtlDestroyHeap
 0x50e2e0 RtlAllocateHeap
 0x50e2e4 RtlFreeHeap
 0x50e2e8 NtClose
 0x50e2ec NtOpenKey
 0x50e2f0 NtEnumerateValueKey
 0x50e2f4 NtQueryValueKey

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure