popup

Report - lv.exe

Emotet Gen1 Gen2 Malicious Library Malicious Packer DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Hijack Network Internet API FTP ScreenShot Http API Steal credential Downloader P2P persistence AntiDebug Anti
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.08.21 09:16 Machine s1_win7_x6401
Filename lv.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
 Behavior Score
6.6
ZERO API file : malware
VT API (file) 40 detected (malicious, high confidence, Fragtor, Unsafe, Save, Coins, Kryptik, Eldorado, Attribute, HighConfidence, multiple detections, Agen, myuddl, DropperX, CLASSIC, GenDownloader, kcloud, Sabsik, HLJWVB, score, Artemis, ai score=82, BScope, Glupteba, R002H0CHK21, Tdps, AVEvader, ZexaF, mq0@a0Ms4Chi)
md5 ccfc289366f06bf59611aecaba901d50
sha256 20a8ba80dc39bf96815fbe7aac15ae018c57df40e3fd75f223f31dfc20f1e61f
ssdeep 24576:z71ZOukQnPSxzxXdjT6YQJG3EtzgklajHZTRvi030ZoMgyRRoNq:v1ZORQei80tzoR9308+iNq
imphash be41bf7b8cc010b614bd36bbca606973
impfuzzy 48:RlSYTMgU/4R6OR3J5OHALxlla/7LqQEFSv8rOAl6UyeXb0Wzn7+9SPNJ4KQ/1by5:DVAgu4R6qaIj19aBKsy
  Network IP location

Signature (15cnts)

Level Description
danger File has been identified by 40 AntiVirus engines on VirusTotal as malicious
watch Attempts to identify installed AV products by installation directory
watch Installs itself for autorun at Windows startup
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice Potentially malicious URLs were found in the process memory dump
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (43cnts)

Level Name Description Collection
danger Win32_Trojan_Emotet_RL_Gen_Zero Win32 Trojan Emotet binaries (download)
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch Network_Downloader File Downloader memory
notice Code_injection Code injection with CreateRemoteThread in a remote process memory
notice Create_Service Create a windows service memory
notice Escalate_priviledges Escalate priviledges memory
notice Hijack_Network Hijack network configuration memory
notice KeyLogger Run a KeyLogger memory
notice local_credential_Steal Steal credential memory
notice Network_DGA Communication using DGA memory
notice Network_DNS Communications use DNS memory
notice Network_FTP Communications over FTP memory
notice Network_HTTP Communications over HTTP memory
notice Network_P2P_Win Communications over P2P network memory
notice Network_TCP_Socket Communications over RAW Socket memory
notice Persistence Install itself for autorun at Windows startup memory
notice ScreenShot Take ScreenShot memory
notice Sniff_Audio Record Audio memory
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info win_hook Affect hook table memory
info Win32_Trojan_Gen_2_0904B0_Zero Win32 Trojan Gen binaries (download)

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
DUJLnoInJHUNOY.DUJLnoInJHUNOY
whois
Unknown clean

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x409060 SetFileTime
 0x409064 CompareFileTime
 0x409068 SearchPathW
 0x40906c GetShortPathNameW
 0x409070 GetFullPathNameW
 0x409074 MoveFileW
 0x409078 SetCurrentDirectoryW
 0x40907c GetFileAttributesW
 0x409080 GetLastError
 0x409084 CreateDirectoryW
 0x409088 SetFileAttributesW
 0x40908c Sleep
 0x409090 GetTickCount
 0x409094 GetFileSize
 0x409098 GetModuleFileNameW
 0x40909c GetCurrentProcess
 0x4090a0 CopyFileW
 0x4090a4 ExitProcess
 0x4090a8 GetWindowsDirectoryW
 0x4090ac GetTempPathW
 0x4090b0 GetCommandLineW
 0x4090b4 SetErrorMode
 0x4090b8 lstrcpynA
 0x4090bc CloseHandle
 0x4090c0 lstrcpynW
 0x4090c4 GetDiskFreeSpaceW
 0x4090c8 GlobalUnlock
 0x4090cc GlobalLock
 0x4090d0 CreateThread
 0x4090d4 LoadLibraryW
 0x4090d8 CreateProcessW
 0x4090dc lstrcmpiA
 0x4090e0 CreateFileW
 0x4090e4 GetTempFileNameW
 0x4090e8 lstrcatW
 0x4090ec GetProcAddress
 0x4090f0 LoadLibraryA
 0x4090f4 GetModuleHandleA
 0x4090f8 OpenProcess
 0x4090fc lstrcpyW
 0x409100 GetVersionExW
 0x409104 GetSystemDirectoryW
 0x409108 GetVersion
 0x40910c lstrcpyA
 0x409110 RemoveDirectoryW
 0x409114 lstrcmpA
 0x409118 lstrcmpiW
 0x40911c lstrcmpW
 0x409120 ExpandEnvironmentStringsW
 0x409124 GlobalAlloc
 0x409128 WaitForSingleObject
 0x40912c GetExitCodeProcess
 0x409130 GlobalFree
 0x409134 GetModuleHandleW
 0x409138 LoadLibraryExW
 0x40913c FreeLibrary
 0x409140 WritePrivateProfileStringW
 0x409144 GetPrivateProfileStringW
 0x409148 WideCharToMultiByte
 0x40914c lstrlenA
 0x409150 MulDiv
 0x409154 WriteFile
 0x409158 ReadFile
 0x40915c MultiByteToWideChar
 0x409160 SetFilePointer
 0x409164 FindClose
 0x409168 FindNextFileW
 0x40916c FindFirstFileW
 0x409170 DeleteFileW
 0x409174 lstrlenW
USER32.dll
 0x409198 GetAsyncKeyState
 0x40919c IsDlgButtonChecked
 0x4091a0 ScreenToClient
 0x4091a4 GetMessagePos
 0x4091a8 CallWindowProcW
 0x4091ac IsWindowVisible
 0x4091b0 LoadBitmapW
 0x4091b4 CloseClipboard
 0x4091b8 SetClipboardData
 0x4091bc EmptyClipboard
 0x4091c0 OpenClipboard
 0x4091c4 TrackPopupMenu
 0x4091c8 GetWindowRect
 0x4091cc AppendMenuW
 0x4091d0 CreatePopupMenu
 0x4091d4 GetSystemMetrics
 0x4091d8 EndDialog
 0x4091dc EnableMenuItem
 0x4091e0 GetSystemMenu
 0x4091e4 SetClassLongW
 0x4091e8 IsWindowEnabled
 0x4091ec SetWindowPos
 0x4091f0 DialogBoxParamW
 0x4091f4 CheckDlgButton
 0x4091f8 CreateWindowExW
 0x4091fc SystemParametersInfoW
 0x409200 RegisterClassW
 0x409204 SetDlgItemTextW
 0x409208 GetDlgItemTextW
 0x40920c MessageBoxIndirectW
 0x409210 CharNextA
 0x409214 CharUpperW
 0x409218 CharPrevW
 0x40921c wvsprintfW
 0x409220 DispatchMessageW
 0x409224 PeekMessageW
 0x409228 wsprintfA
 0x40922c DestroyWindow
 0x409230 CreateDialogParamW
 0x409234 SetTimer
 0x409238 SetWindowTextW
 0x40923c PostQuitMessage
 0x409240 SetForegroundWindow
 0x409244 ShowWindow
 0x409248 wsprintfW
 0x40924c SendMessageTimeoutW
 0x409250 LoadCursorW
 0x409254 SetCursor
 0x409258 GetWindowLongW
 0x40925c GetSysColor
 0x409260 CharNextW
 0x409264 GetClassInfoW
 0x409268 ExitWindowsEx
 0x40926c IsWindow
 0x409270 GetDlgItem
 0x409274 SetWindowLongW
 0x409278 LoadImageW
 0x40927c GetDC
 0x409280 EnableWindow
 0x409284 InvalidateRect
 0x409288 SendMessageW
 0x40928c DefWindowProcW
 0x409290 BeginPaint
 0x409294 GetClientRect
 0x409298 FillRect
 0x40929c DrawTextW
 0x4092a0 EndPaint
 0x4092a4 FindWindowExW
GDI32.dll
 0x40903c SetBkColor
 0x409040 GetDeviceCaps
 0x409044 DeleteObject
 0x409048 CreateBrushIndirect
 0x40904c CreateFontIndirectW
 0x409050 SetBkMode
 0x409054 SetTextColor
 0x409058 SelectObject
SHELL32.dll
 0x40917c SHBrowseForFolderW
 0x409180 SHGetPathFromIDListW
 0x409184 SHGetFileInfoW
 0x409188 ShellExecuteW
 0x40918c SHFileOperationW
 0x409190 SHGetSpecialFolderLocation
ADVAPI32.dll
 0x409000 RegEnumKeyW
 0x409004 RegOpenKeyExW
 0x409008 RegCloseKey
 0x40900c RegDeleteKeyW
 0x409010 RegDeleteValueW
 0x409014 RegCreateKeyExW
 0x409018 RegSetValueExW
 0x40901c RegQueryValueExW
 0x409020 RegEnumValueW
COMCTL32.dll
 0x409028 ImageList_AddMasked
 0x40902c ImageList_Destroy
 0x409030 None
 0x409034 ImageList_Create
ole32.dll
 0x4092bc CoTaskMemFree
 0x4092c0 OleInitialize
 0x4092c4 OleUninitialize
 0x4092c8 CoCreateInstance
VERSION.dll
 0x4092ac GetFileVersionInfoSizeW
 0x4092b0 GetFileVersionInfoW
 0x4092b4 VerQueryValueW

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure