popup

Report - CalcCryptoInstalww.exe

Emotet RAT Gen1 Generic Malware Themida Packer Malicious Library UPX Antivirus PE File PE32 OS Processor Check .NET EXE GIF Format PE64
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.10.07 18:14 Machine s1_win7_x6402
Filename CalcCryptoInstalww.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
2
 Behavior Score
13.6
ZERO API file : malware
VT API (file) 8 detected (Malicious, ccnc, Generic@ML, RDML, deNq3GEEDx6KHgDsNkMa5A, Kpot, kcloud, Sabsik)
md5 86a1c8f0737fc82085f4a859733c9514
sha256 65ac1c0eba209c49f78fa7b62e16bce45cffe0ea5a8320846ecf7f6c298853ae
ssdeep 49152:4yGN7KAoB+iXbYG6N+R9GPV4DN5D5btClqaebQQBuz9n9EYesXT2hI2Qd0KdUMwo:ZGN2z6V+vK4v6lP0uz9ebsjV2Qd08fp
imphash 2fb819a19fe4dee5c03e8c6a79342f79
impfuzzy 48:8cfp1rcQX0gebPCZr9ZbldH9AOZGwt+Eu55T/lGB:8cfpdcqNebqZr3rHW2
  Network IP location

Signature (33cnts)

Level Description
warning Generates some ICMP traffic
watch Checks for the presence of known windows from debuggers and forensic tools
watch Checks the version of Bios
watch Collects information about installed applications
watch Communicates with host for which no DNS query was performed
watch Detects Virtual Machines through their custom firmware
watch Detects VMWare through the in instruction feature
watch Harvests credentials from local FTP client softwares
watch The process powershell.exe wrote an executable file to disk
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice Expresses interest in specific running processes
notice File has been identified by 8 AntiVirus engines on VirusTotal as malicious
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Steals private information from local Internet browsers
notice Uses Windows utilities for basic Windows functionality
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Tries to locate where the browsers are installed
info Uses Windows APIs to generate a cryptographic key

Rules (18cnts)

Level Name Description Collection
danger Win32_Trojan_Emotet_2_Zero Win32 Trojan Emotet binaries (download)
danger Win32_Trojan_Emotet_2_Zero Win32 Trojan Emotet binaries (upload)
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
warning themida_packer themida packer binaries (download)
watch Antivirus Contains references to security software binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
info Is_DotNET_EXE (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info IsPE64 (no description) binaries (download)
info Lnk_Format_Zero LNK Format binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info Win_Backdoor_AsyncRAT_Zero Win Backdoor AsyncRAT binaries (download)

Network (9cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://gdv.federguda.ru/PeZcZ/
whois
RU JSC RTComm.RU 81.177.141.85 clean
http://gdv.federguda.ru/
whois
RU JSC RTComm.RU 81.177.141.85 clean
http://e6tfvc.federguda.ru/
whois
RU JSC RTComm.RU 81.177.141.85 clean
e6tfvc.federguda.ru
whois
RU JSC RTComm.RU 81.177.141.85 clean
gdv.federguda.ru
whois
RU JSC RTComm.RU 81.177.141.85 clean
lessab.space
whois
PL WorldStream B.V. 80.66.87.32 clean
185.215.113.121
whois
Unknown 185.215.113.121 clean
81.177.141.85
whois
RU JSC RTComm.RU 81.177.141.85 mailcious
80.66.87.32
whois
PL WorldStream B.V. 80.66.87.32 mailcious

Suricata ids

ET DROP Spamhaus DROP Listed Traffic Inbound group 25

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x40e0b4 DeleteCriticalSection
 0x40e0b8 LeaveCriticalSection
 0x40e0bc EnterCriticalSection
 0x40e0c0 InitializeCriticalSection
 0x40e0c4 VirtualFree
 0x40e0c8 VirtualAlloc
 0x40e0cc LocalFree
 0x40e0d0 LocalAlloc
 0x40e0d4 WideCharToMultiByte
 0x40e0d8 TlsSetValue
 0x40e0dc TlsGetValue
 0x40e0e0 MultiByteToWideChar
 0x40e0e4 GetModuleHandleA
 0x40e0e8 GetLastError
 0x40e0ec GetCommandLineA
 0x40e0f0 WriteFile
 0x40e0f4 SetFilePointer
 0x40e0f8 SetEndOfFile
 0x40e0fc RtlUnwind
 0x40e100 ReadFile
 0x40e104 RaiseException
 0x40e108 GetStdHandle
 0x40e10c GetFileSize
 0x40e110 GetSystemTime
 0x40e114 GetFileType
 0x40e118 ExitProcess
 0x40e11c CreateFileA
 0x40e120 CloseHandle
user32.dll
 0x40e128 MessageBoxA
oleaut32.dll
 0x40e130 VariantChangeTypeEx
 0x40e134 VariantCopyInd
 0x40e138 VariantClear
 0x40e13c SysStringLen
 0x40e140 SysAllocStringLen
advapi32.dll
 0x40e148 RegQueryValueExA
 0x40e14c RegOpenKeyExA
 0x40e150 RegCloseKey
 0x40e154 OpenProcessToken
 0x40e158 LookupPrivilegeValueA
kernel32.dll
 0x40e160 WriteFile
 0x40e164 VirtualQuery
 0x40e168 VirtualProtect
 0x40e16c VirtualFree
 0x40e170 VirtualAlloc
 0x40e174 Sleep
 0x40e178 SizeofResource
 0x40e17c SetLastError
 0x40e180 SetFilePointer
 0x40e184 SetErrorMode
 0x40e188 SetEndOfFile
 0x40e18c RemoveDirectoryA
 0x40e190 ReadFile
 0x40e194 LockResource
 0x40e198 LoadResource
 0x40e19c LoadLibraryA
 0x40e1a0 IsDBCSLeadByte
 0x40e1a4 GetWindowsDirectoryA
 0x40e1a8 GetVersionExA
 0x40e1ac GetVersion
 0x40e1b0 GetUserDefaultLangID
 0x40e1b4 GetSystemInfo
 0x40e1b8 GetSystemDirectoryA
 0x40e1bc GetSystemDefaultLCID
 0x40e1c0 GetProcAddress
 0x40e1c4 GetModuleHandleA
 0x40e1c8 GetModuleFileNameA
 0x40e1cc GetLocaleInfoA
 0x40e1d0 GetLastError
 0x40e1d4 GetFullPathNameA
 0x40e1d8 GetFileSize
 0x40e1dc GetFileAttributesA
 0x40e1e0 GetExitCodeProcess
 0x40e1e4 GetEnvironmentVariableA
 0x40e1e8 GetCurrentProcess
 0x40e1ec GetCommandLineA
 0x40e1f0 GetACP
 0x40e1f4 InterlockedExchange
 0x40e1f8 FormatMessageA
 0x40e1fc FindResourceA
 0x40e200 DeleteFileA
 0x40e204 CreateProcessA
 0x40e208 CreateFileA
 0x40e20c CreateDirectoryA
 0x40e210 CloseHandle
user32.dll
 0x40e218 TranslateMessage
 0x40e21c SetWindowLongA
 0x40e220 PeekMessageA
 0x40e224 MsgWaitForMultipleObjects
 0x40e228 MessageBoxA
 0x40e22c LoadStringA
 0x40e230 ExitWindowsEx
 0x40e234 DispatchMessageA
 0x40e238 DestroyWindow
 0x40e23c CreateWindowExA
 0x40e240 CallWindowProcA
 0x40e244 CharPrevA
comctl32.dll
 0x40e24c InitCommonControls
advapi32.dll
 0x40e254 AdjustTokenPrivileges

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure