ScreenShot
| Created | 2021.10.07 17:00 | Machine | s1_win7_x6401 |
| Filename | mega.bmp | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 45 detected (Disbuk, malicious, high confidence, GenericKD, Unsafe, Save, TrojanPSW, ZexaF, yuW@ae8rCcpi, Attribute, HighConfidence, score, Pdct, GenericRXMT, njxyo, GenericMC, Phonzy, ai score=82, BScope, FileCryptor, PasswordStealer, R002H0CJ321, CLASSIC, Static AI, Malicious PE, confidence) | ||
| md5 | 477b1b2a2779f1a1d6e7ff42a5eb9772 | ||
| sha256 | aa4efc2c7b8e21dc0ad4f2557f81768b4cf7fc05f7a0a65b22776c4e4e12454f | ||
| ssdeep | 12288:0ZK3R+sfOwtpl5othMsUmE0IKuPK6B3OXF/Bi:0Q3Rppl5ahe0qB3OZk | ||
| imphash | 9918cb366b12f5b74bee942024cd344c | ||
| impfuzzy | 24:l20QDNFOAOefTN96trS1CM3JeDc+pl39ro4vcGM1SOovbO0ZuBmzEpQz19wuDce9:WO2N0trS1CM2c+ppZhm31C6O4fI | ||
Network IP location
Signature (50cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 45 AntiVirus engines on VirusTotal as malicious |
| danger | Disables Windows Security features |
| danger | Executed a process and injected code into it |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Attempts to create or modify system certificates |
| watch | Communicates with host for which no DNS query was performed |
| watch | Disables proxy possibly for traffic interception |
| watch | Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) |
| watch | Installs itself for autorun at Windows startup |
| watch | Network activity contains more than one unique useragent |
| watch | One or more non-whitelisted processes were created |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| watch | Uses Sysinternals tools in order to add additional command line functionality |
| notice | A process attempted to delay the analysis task. |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An application raised an exception which may be indicative of an exploit crash |
| notice | An executable file was downloaded by the processes mega.bmp |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | Executes one or more WMI queries |
| notice | Expresses interest in specific running processes |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Looks up the external IP address |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Queries for potentially installed applications |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Repeatedly searches for a not-found process |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | Terminates another process |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | Tries to locate where the browsers are installed |
Rules (59cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Trojan_PWS_Stealer_1_Zero | Trojan.PWS.Stealer Zero | binaries (download) |
| danger | Win32_Trojan_Emotet_2_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Credential_User_Data_Check_Zero | Credential User Data Check | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | infoStealer_browser_Zero | browser info stealer | memory |
| watch | Chrome_User_Data_Check_Zero | Google Chrome User Data Check | memory |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Network_Downloader | File Downloader | memory |
| watch | SQLite_cookies_Check_Zero | SQLite Cookie Check... select | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| notice | BitCoin | Perform crypto currency mining | memory |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | Persistence | Install itself for autorun at Windows startup | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | Is_DotNET_EXE | (no description) | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | Virtual_currency_Zero | Virtual currency | memory |
| info | vmdetect | Possibly employs anti-virtualization techniques | memory |
| info | win_hook | Affect hook table | memory |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (download) |
| info | Win_Backdoor_AsyncRAT_Zero | Win Backdoor AsyncRAT | binaries (download) |
| info | Win_Trojan_agentTesla_Zero | Win.Trojan.agentTesla | memory |
Network (73cnts) ?
Suricata ids
ET INFO TLS Handshake Failure
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
SURICATA Applayer Mismatch protocol both directions
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET DNS Query to a *.pw domain - Likely Hostile
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
ET INFO HTTP Request to a *.pw domain
ET INFO Packed Executable Download
ET INFO EXE - Served Attached HTTP
ET DNS Query to a *.top domain - Likely Hostile
ET INFO HTTP Request to a *.top domain
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
SURICATA Applayer Mismatch protocol both directions
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET DNS Query to a *.pw domain - Likely Hostile
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
ET INFO HTTP Request to a *.pw domain
ET INFO Packed Executable Download
ET INFO EXE - Served Attached HTTP
ET DNS Query to a *.top domain - Likely Hostile
ET INFO HTTP Request to a *.top domain
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x453038 lstrcatA
0x45303c GetModuleHandleA
0x453040 lstrcpyA
0x453044 HeapFree
0x453048 IsWow64Process
0x45304c HeapAlloc
0x453050 GetProcAddress
0x453054 lstrcpynA
0x453058 GetProcessHeap
0x45305c WriteConsoleW
0x453060 CreateDirectoryA
0x453064 WinExec
0x453068 LocalFree
0x45306c GetWindowsDirectoryA
0x453070 CloseHandle
0x453074 DeleteFileA
0x453078 LoadLibraryA
0x45307c GetFileAttributesA
0x453080 GetLastError
0x453084 CopyFileA
0x453088 Sleep
0x45308c LocalAlloc
0x453090 GetVolumeInformationA
0x453094 GetCurrentProcess
0x453098 lstrlenA
0x45309c GetModuleFileNameA
0x4530a0 SetEndOfFile
0x4530a4 HeapReAlloc
0x4530a8 HeapSize
0x4530ac ReadConsoleW
0x4530b0 ReadFile
0x4530b4 FlushFileBuffers
0x4530b8 CreateFileW
0x4530bc GetStringTypeW
0x4530c0 SetStdHandle
0x4530c4 UnhandledExceptionFilter
0x4530c8 SetUnhandledExceptionFilter
0x4530cc TerminateProcess
0x4530d0 IsProcessorFeaturePresent
0x4530d4 IsDebuggerPresent
0x4530d8 GetStartupInfoW
0x4530dc GetModuleHandleW
0x4530e0 QueryPerformanceCounter
0x4530e4 GetCurrentProcessId
0x4530e8 GetCurrentThreadId
0x4530ec GetSystemTimeAsFileTime
0x4530f0 InitializeSListHead
0x4530f4 RtlUnwind
0x4530f8 RaiseException
0x4530fc SetLastError
0x453100 EncodePointer
0x453104 EnterCriticalSection
0x453108 LeaveCriticalSection
0x45310c DeleteCriticalSection
0x453110 InitializeCriticalSectionAndSpinCount
0x453114 TlsAlloc
0x453118 TlsGetValue
0x45311c TlsSetValue
0x453120 TlsFree
0x453124 FreeLibrary
0x453128 LoadLibraryExW
0x45312c ExitProcess
0x453130 GetModuleHandleExW
0x453134 GetModuleFileNameW
0x453138 GetStdHandle
0x45313c WriteFile
0x453140 MultiByteToWideChar
0x453144 LCMapStringW
0x453148 MoveFileExW
0x45314c GetFileType
0x453150 GetConsoleOutputCP
0x453154 GetConsoleMode
0x453158 GetFileSizeEx
0x45315c SetFilePointerEx
0x453160 FindClose
0x453164 FindFirstFileExW
0x453168 FindNextFileW
0x45316c IsValidCodePage
0x453170 GetACP
0x453174 GetOEMCP
0x453178 GetCPInfo
0x45317c GetCommandLineA
0x453180 GetCommandLineW
0x453184 WideCharToMultiByte
0x453188 GetEnvironmentStringsW
0x45318c FreeEnvironmentStringsW
0x453190 DecodePointer
ADVAPI32.dll
0x453000 CreateServiceA
0x453004 RegCloseKey
0x453008 StartServiceCtrlDispatcherA
0x45300c GetCurrentHwProfileA
0x453010 CloseServiceHandle
0x453014 RegQueryValueExA
0x453018 SetServiceStatus
0x45301c RegisterServiceCtrlHandlerA
0x453020 OpenSCManagerA
0x453024 GetUserNameA
0x453028 StartServiceA
0x45302c RegOpenKeyExA
0x453030 OpenServiceA
SHELL32.dll
0x4531ac SHGetSpecialFolderPathA
0x4531b0 SHGetFolderPathA
0x4531b4 ShellExecuteA
SETUPAPI.dll
0x453198 SetupDiGetClassDevsA
0x45319c SetupDiEnumDeviceInterfaces
0x4531a0 SetupDiGetDeviceInterfaceDetailA
0x4531a4 SetupDiEnumDeviceInfo
EAT(Export Address Table) is none
KERNEL32.dll
0x453038 lstrcatA
0x45303c GetModuleHandleA
0x453040 lstrcpyA
0x453044 HeapFree
0x453048 IsWow64Process
0x45304c HeapAlloc
0x453050 GetProcAddress
0x453054 lstrcpynA
0x453058 GetProcessHeap
0x45305c WriteConsoleW
0x453060 CreateDirectoryA
0x453064 WinExec
0x453068 LocalFree
0x45306c GetWindowsDirectoryA
0x453070 CloseHandle
0x453074 DeleteFileA
0x453078 LoadLibraryA
0x45307c GetFileAttributesA
0x453080 GetLastError
0x453084 CopyFileA
0x453088 Sleep
0x45308c LocalAlloc
0x453090 GetVolumeInformationA
0x453094 GetCurrentProcess
0x453098 lstrlenA
0x45309c GetModuleFileNameA
0x4530a0 SetEndOfFile
0x4530a4 HeapReAlloc
0x4530a8 HeapSize
0x4530ac ReadConsoleW
0x4530b0 ReadFile
0x4530b4 FlushFileBuffers
0x4530b8 CreateFileW
0x4530bc GetStringTypeW
0x4530c0 SetStdHandle
0x4530c4 UnhandledExceptionFilter
0x4530c8 SetUnhandledExceptionFilter
0x4530cc TerminateProcess
0x4530d0 IsProcessorFeaturePresent
0x4530d4 IsDebuggerPresent
0x4530d8 GetStartupInfoW
0x4530dc GetModuleHandleW
0x4530e0 QueryPerformanceCounter
0x4530e4 GetCurrentProcessId
0x4530e8 GetCurrentThreadId
0x4530ec GetSystemTimeAsFileTime
0x4530f0 InitializeSListHead
0x4530f4 RtlUnwind
0x4530f8 RaiseException
0x4530fc SetLastError
0x453100 EncodePointer
0x453104 EnterCriticalSection
0x453108 LeaveCriticalSection
0x45310c DeleteCriticalSection
0x453110 InitializeCriticalSectionAndSpinCount
0x453114 TlsAlloc
0x453118 TlsGetValue
0x45311c TlsSetValue
0x453120 TlsFree
0x453124 FreeLibrary
0x453128 LoadLibraryExW
0x45312c ExitProcess
0x453130 GetModuleHandleExW
0x453134 GetModuleFileNameW
0x453138 GetStdHandle
0x45313c WriteFile
0x453140 MultiByteToWideChar
0x453144 LCMapStringW
0x453148 MoveFileExW
0x45314c GetFileType
0x453150 GetConsoleOutputCP
0x453154 GetConsoleMode
0x453158 GetFileSizeEx
0x45315c SetFilePointerEx
0x453160 FindClose
0x453164 FindFirstFileExW
0x453168 FindNextFileW
0x45316c IsValidCodePage
0x453170 GetACP
0x453174 GetOEMCP
0x453178 GetCPInfo
0x45317c GetCommandLineA
0x453180 GetCommandLineW
0x453184 WideCharToMultiByte
0x453188 GetEnvironmentStringsW
0x45318c FreeEnvironmentStringsW
0x453190 DecodePointer
ADVAPI32.dll
0x453000 CreateServiceA
0x453004 RegCloseKey
0x453008 StartServiceCtrlDispatcherA
0x45300c GetCurrentHwProfileA
0x453010 CloseServiceHandle
0x453014 RegQueryValueExA
0x453018 SetServiceStatus
0x45301c RegisterServiceCtrlHandlerA
0x453020 OpenSCManagerA
0x453024 GetUserNameA
0x453028 StartServiceA
0x45302c RegOpenKeyExA
0x453030 OpenServiceA
SHELL32.dll
0x4531ac SHGetSpecialFolderPathA
0x4531b0 SHGetFolderPathA
0x4531b4 ShellExecuteA
SETUPAPI.dll
0x453198 SetupDiGetClassDevsA
0x45319c SetupDiEnumDeviceInterfaces
0x4531a0 SetupDiGetDeviceInterfaceDetailA
0x4531a4 SetupDiEnumDeviceInfo
EAT(Export Address Table) is none