ScreenShot
| Created | 2021.10.07 15:51 | Machine | s1_win7_x6401 |
| Filename | wmzr_2021-09-28_12-08.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 40 detected (malicious, high confidence, DownLoader42, Mint, Zard, Stop, Fragtor, Unsafe, Save, ZexaF, gwW@aaZxJnhO, Eldorado, Attribute, HighConfidence, Kryptik, HMQN, Ransomware, Ulise, MalwareX, Score, MalwareCrypter, cpdfd, ai score=84, StopCrypt, Raccrypt, R443414, BScope, Tasker, CLASSIC, Static AI, Malicious PE, GenKryptik, FLGE, GdSda, confidence) | ||
| md5 | 54de310a8f0a06c0141f2c00ee587736 | ||
| sha256 | a396c91b4750c7d2c166e523f2659ee64d88a840ab3d941b27b8b4e78e0ec24a | ||
| ssdeep | 49152:It3osYaVpLVxqQINtEFDeRw/p3VbBysa8aoS94FVN7GKBx:I9oRM4Hree6B39a864DZG | ||
| imphash | 56c207817e66e7690a43bf97b1ee7374 | ||
| impfuzzy | 48:7OPdL3inFXU7d7wwOfSX2CNxtxma2IK9Jc9rh9J:KVL3uFXU7NwwLXlxtxj2IQJc9rhn | ||
Network IP location
Signature (26cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 40 AntiVirus engines on VirusTotal as malicious |
| danger | Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | Executed a process and injected code into it |
| watch | A process attempted to delay the analysis task. |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates a windows hook that monitors keyboard input (keylogger) |
| watch | Installs an hook procedure to monitor for mouse events |
| watch | Installs itself for autorun at Windows startup |
| watch | Looks for the Windows Idle Time to determine the uptime |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates hidden or system file |
| notice | Drops an executable to the user AppData folder |
| notice | Foreign language identified in PE resource |
| notice | Moves the original executable to a new location |
| notice | One or more potentially interesting buffers were extracted |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Checks if process is being debugged by a debugger |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (30cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | memory |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | network_smtp_raw | Communications smtp | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41c00c TlsGetValue
0x41c010 SetLocalTime
0x41c014 InterlockedIncrement
0x41c018 GetCommState
0x41c01c GetProfileStringW
0x41c020 UnlockFile
0x41c024 CallNamedPipeW
0x41c028 FreeEnvironmentStringsA
0x41c02c GetNumberFormatA
0x41c030 FindResourceExA
0x41c034 GlobalAlloc
0x41c038 GetPrivateProfileIntA
0x41c03c LoadLibraryW
0x41c040 GetConsoleAliasExesLengthW
0x41c044 HeapDestroy
0x41c048 CreateSemaphoreA
0x41c04c EnumResourceLanguagesA
0x41c050 GetModuleFileNameW
0x41c054 GetCompressedFileSizeA
0x41c058 GetSystemDirectoryA
0x41c05c CreateActCtxA
0x41c060 GetBinaryTypeW
0x41c064 LCMapStringA
0x41c068 GetStartupInfoA
0x41c06c lstrlenA
0x41c070 GetStdHandle
0x41c074 FreeLibraryAndExitThread
0x41c078 GetLastError
0x41c07c GetProcAddress
0x41c080 CreateNamedPipeA
0x41c084 EnterCriticalSection
0x41c088 LoadLibraryA
0x41c08c OpenMutexA
0x41c090 WritePrivateProfileStringA
0x41c094 SetThreadIdealProcessor
0x41c098 FindAtomA
0x41c09c SetSystemTime
0x41c0a0 FindNextFileA
0x41c0a4 WriteProfileStringA
0x41c0a8 CreateIoCompletionPort
0x41c0ac FindFirstChangeNotificationA
0x41c0b0 HeapSetInformation
0x41c0b4 GetCurrentDirectoryA
0x41c0b8 SetFileShortNameA
0x41c0bc UnregisterWaitEx
0x41c0c0 CopyFileExA
0x41c0c4 DeleteFileA
0x41c0c8 GetVolumeInformationW
0x41c0cc LocalFileTimeToFileTime
0x41c0d0 GetThreadContext
0x41c0d4 SetThreadLocale
0x41c0d8 GetCommandLineW
0x41c0dc WideCharToMultiByte
0x41c0e0 EncodePointer
0x41c0e4 DecodePointer
0x41c0e8 GetCommandLineA
0x41c0ec GetStartupInfoW
0x41c0f0 InterlockedDecrement
0x41c0f4 GetModuleHandleW
0x41c0f8 ExitProcess
0x41c0fc TerminateProcess
0x41c100 GetCurrentProcess
0x41c104 UnhandledExceptionFilter
0x41c108 SetUnhandledExceptionFilter
0x41c10c IsDebuggerPresent
0x41c110 WriteFile
0x41c114 GetACP
0x41c118 GetOEMCP
0x41c11c GetCPInfo
0x41c120 IsValidCodePage
0x41c124 TlsAlloc
0x41c128 TlsSetValue
0x41c12c GetCurrentThreadId
0x41c130 TlsFree
0x41c134 SetLastError
0x41c138 HeapValidate
0x41c13c IsBadReadPtr
0x41c140 LeaveCriticalSection
0x41c144 SetHandleCount
0x41c148 InitializeCriticalSectionAndSpinCount
0x41c14c GetFileType
0x41c150 DeleteCriticalSection
0x41c154 QueryPerformanceCounter
0x41c158 GetTickCount
0x41c15c GetCurrentProcessId
0x41c160 GetSystemTimeAsFileTime
0x41c164 GetModuleFileNameA
0x41c168 FreeEnvironmentStringsW
0x41c16c GetEnvironmentStringsW
0x41c170 HeapCreate
0x41c174 IsProcessorFeaturePresent
0x41c178 OutputDebugStringA
0x41c17c WriteConsoleW
0x41c180 OutputDebugStringW
0x41c184 RtlUnwind
0x41c188 LCMapStringW
0x41c18c MultiByteToWideChar
0x41c190 GetStringTypeW
0x41c194 SetFilePointer
0x41c198 GetConsoleCP
0x41c19c GetConsoleMode
0x41c1a0 HeapAlloc
0x41c1a4 HeapReAlloc
0x41c1a8 HeapSize
0x41c1ac HeapQueryInformation
0x41c1b0 HeapFree
0x41c1b4 SetStdHandle
0x41c1b8 FlushFileBuffers
0x41c1bc RaiseException
0x41c1c0 CreateFileW
0x41c1c4 CloseHandle
ADVAPI32.dll
0x41c000 InitiateSystemShutdownA
0x41c004 AbortSystemShutdownA
WINHTTP.dll
0x41c1cc WinHttpOpen
EAT(Export Address Table) is none
KERNEL32.dll
0x41c00c TlsGetValue
0x41c010 SetLocalTime
0x41c014 InterlockedIncrement
0x41c018 GetCommState
0x41c01c GetProfileStringW
0x41c020 UnlockFile
0x41c024 CallNamedPipeW
0x41c028 FreeEnvironmentStringsA
0x41c02c GetNumberFormatA
0x41c030 FindResourceExA
0x41c034 GlobalAlloc
0x41c038 GetPrivateProfileIntA
0x41c03c LoadLibraryW
0x41c040 GetConsoleAliasExesLengthW
0x41c044 HeapDestroy
0x41c048 CreateSemaphoreA
0x41c04c EnumResourceLanguagesA
0x41c050 GetModuleFileNameW
0x41c054 GetCompressedFileSizeA
0x41c058 GetSystemDirectoryA
0x41c05c CreateActCtxA
0x41c060 GetBinaryTypeW
0x41c064 LCMapStringA
0x41c068 GetStartupInfoA
0x41c06c lstrlenA
0x41c070 GetStdHandle
0x41c074 FreeLibraryAndExitThread
0x41c078 GetLastError
0x41c07c GetProcAddress
0x41c080 CreateNamedPipeA
0x41c084 EnterCriticalSection
0x41c088 LoadLibraryA
0x41c08c OpenMutexA
0x41c090 WritePrivateProfileStringA
0x41c094 SetThreadIdealProcessor
0x41c098 FindAtomA
0x41c09c SetSystemTime
0x41c0a0 FindNextFileA
0x41c0a4 WriteProfileStringA
0x41c0a8 CreateIoCompletionPort
0x41c0ac FindFirstChangeNotificationA
0x41c0b0 HeapSetInformation
0x41c0b4 GetCurrentDirectoryA
0x41c0b8 SetFileShortNameA
0x41c0bc UnregisterWaitEx
0x41c0c0 CopyFileExA
0x41c0c4 DeleteFileA
0x41c0c8 GetVolumeInformationW
0x41c0cc LocalFileTimeToFileTime
0x41c0d0 GetThreadContext
0x41c0d4 SetThreadLocale
0x41c0d8 GetCommandLineW
0x41c0dc WideCharToMultiByte
0x41c0e0 EncodePointer
0x41c0e4 DecodePointer
0x41c0e8 GetCommandLineA
0x41c0ec GetStartupInfoW
0x41c0f0 InterlockedDecrement
0x41c0f4 GetModuleHandleW
0x41c0f8 ExitProcess
0x41c0fc TerminateProcess
0x41c100 GetCurrentProcess
0x41c104 UnhandledExceptionFilter
0x41c108 SetUnhandledExceptionFilter
0x41c10c IsDebuggerPresent
0x41c110 WriteFile
0x41c114 GetACP
0x41c118 GetOEMCP
0x41c11c GetCPInfo
0x41c120 IsValidCodePage
0x41c124 TlsAlloc
0x41c128 TlsSetValue
0x41c12c GetCurrentThreadId
0x41c130 TlsFree
0x41c134 SetLastError
0x41c138 HeapValidate
0x41c13c IsBadReadPtr
0x41c140 LeaveCriticalSection
0x41c144 SetHandleCount
0x41c148 InitializeCriticalSectionAndSpinCount
0x41c14c GetFileType
0x41c150 DeleteCriticalSection
0x41c154 QueryPerformanceCounter
0x41c158 GetTickCount
0x41c15c GetCurrentProcessId
0x41c160 GetSystemTimeAsFileTime
0x41c164 GetModuleFileNameA
0x41c168 FreeEnvironmentStringsW
0x41c16c GetEnvironmentStringsW
0x41c170 HeapCreate
0x41c174 IsProcessorFeaturePresent
0x41c178 OutputDebugStringA
0x41c17c WriteConsoleW
0x41c180 OutputDebugStringW
0x41c184 RtlUnwind
0x41c188 LCMapStringW
0x41c18c MultiByteToWideChar
0x41c190 GetStringTypeW
0x41c194 SetFilePointer
0x41c198 GetConsoleCP
0x41c19c GetConsoleMode
0x41c1a0 HeapAlloc
0x41c1a4 HeapReAlloc
0x41c1a8 HeapSize
0x41c1ac HeapQueryInformation
0x41c1b0 HeapFree
0x41c1b4 SetStdHandle
0x41c1b8 FlushFileBuffers
0x41c1bc RaiseException
0x41c1c0 CreateFileW
0x41c1c4 CloseHandle
ADVAPI32.dll
0x41c000 InitiateSystemShutdownA
0x41c004 AbortSystemShutdownA
WINHTTP.dll
0x41c1cc WinHttpOpen
EAT(Export Address Table) is none