popup

Report - Mainsetupv1.0.exe

Malicious Library UPX Create Service DGA Socket Steal credential DNS Internet API Hijack Network Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P persistence AntiDebug AntiVM PE File PE32 OS Processor C
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.11.02 22:17 Machine s1_win7_x6401
Filename Mainsetupv1.0.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
AI Score
5
 Behavior Score
7.0
ZERO API file : clean
VT API (file) 51 detected (AIDetect, malware1, malicious, high confidence, GenericKD, Artemis, Unsafe, myuaxu, 7Drop, YJRA, Attribute, HighConfidence, 7zip, AL suspicious, Crypzip, BGQN, ApplicUnwnt@#2dbe8bvu70bzl, R06BC0WEI21, Fsysna, yfpto, ai score=81, ASMalwS, kcloud, Sabsik, S11PG3, score, R425135, Gencirc, q1VL37ik7x4, susgen, confidence, 100%, HgIASU0A)
md5 689b7bfb1424aa69046653e635ecb9ac
sha256 33b321374349db0323465f27465cabc62472c405e2a45638467e32c174d18082
ssdeep 49152:AuUZOlRW++2IqL321m6IxSwdN0ZsCbSq4ijHsBm:AHZOjW+Vt3SiODu/ijM0
imphash 2b914b6fd04316572d777593dc737715
impfuzzy 96:d0+mOVs3df+3sFzqiVbXpqffFSGJZZ+RGIXjqcI/gI:m+hVs3GZgw1ScZZ9IXuT/gI
  Network IP location

Signature (16cnts)

Level Description
danger File has been identified by 51 AntiVirus engines on VirusTotal as malicious
watch Attempts to identify installed AV products by installation directory
watch Checks the CPU name from registry
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Potentially malicious URLs were found in the process memory dump
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info The executable uses a known packer

Rules (38cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Network_Downloader File Downloader memory
watch UPX_Zero UPX packed file binaries (upload)
notice Code_injection Code injection with CreateRemoteThread in a remote process memory
notice Create_Service Create a windows service memory
notice Escalate_priviledges Escalate priviledges memory
notice Hijack_Network Hijack network configuration memory
notice KeyLogger Run a KeyLogger memory
notice local_credential_Steal Steal credential memory
notice Network_DGA Communication using DGA memory
notice Network_DNS Communications use DNS memory
notice Network_FTP Communications over FTP memory
notice Network_HTTP Communications over HTTP memory
notice Network_P2P_Win Communications over P2P network memory
notice Network_TCP_Socket Communications over RAW Socket memory
notice Persistence Install itself for autorun at Windows startup memory
notice ScreenShot Take ScreenShot memory
notice Sniff_Audio Record Audio memory
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info win_hook Affect hook table memory

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
iBFBxuLonchVeJiTrbJe.iBFBxuLonchVeJiTrbJe
whois
Unknown clean

Suricata ids

PE API

IAT(Import Address Table) Library

COMCTL32.dll
 0x419010 None
SHELL32.dll
 0x419270 SHGetSpecialFolderPathW
 0x419274 ShellExecuteW
 0x419278 SHGetMalloc
 0x41927c SHGetPathFromIDListW
 0x419280 SHBrowseForFolderW
 0x419284 SHGetFileInfoW
 0x419288 ShellExecuteExW
GDI32.dll
 0x419018 CreateCompatibleDC
 0x41901c CreateFontIndirectW
 0x419020 DeleteObject
 0x419024 DeleteDC
 0x419028 GetCurrentObject
 0x41902c StretchBlt
 0x419030 GetDeviceCaps
 0x419034 CreateCompatibleBitmap
 0x419038 SelectObject
 0x41903c SetStretchBltMode
 0x419040 GetObjectW
ADVAPI32.dll
 0x419000 FreeSid
 0x419004 AllocateAndInitializeSid
 0x419008 CheckTokenMembership
USER32.dll
 0x419290 CreateWindowExW
 0x419294 GetDesktopWindow
 0x419298 wsprintfA
 0x41929c SetWindowPos
 0x4192a0 SetTimer
 0x4192a4 GetMessageW
 0x4192a8 ScreenToClient
 0x4192ac KillTimer
 0x4192b0 CharUpperW
 0x4192b4 SendMessageW
 0x4192b8 EndDialog
 0x4192bc wsprintfW
 0x4192c0 MessageBoxW
 0x4192c4 GetParent
 0x4192c8 CopyImage
 0x4192cc ReleaseDC
 0x4192d0 GetWindowDC
 0x4192d4 GetMenu
 0x4192d8 GetWindowLongW
 0x4192dc DispatchMessageW
 0x4192e0 GetWindowTextW
 0x4192e4 GetWindowTextLengthW
 0x4192e8 SetWindowTextW
 0x4192ec GetSysColor
 0x4192f0 DestroyWindow
 0x4192f4 MessageBoxA
 0x4192f8 BringWindowToTop
 0x4192fc ShowWindow
 0x419300 GetKeyState
 0x419304 GetDlgItem
 0x419308 GetClientRect
 0x41930c SetWindowLongW
 0x419310 UnhookWindowsHookEx
 0x419314 SetFocus
 0x419318 GetSystemMetrics
 0x41931c SystemParametersInfoW
 0x419320 DrawTextW
 0x419324 GetDC
 0x419328 ClientToScreen
 0x41932c GetWindow
 0x419330 DialogBoxIndirectParamW
 0x419334 DrawIconEx
 0x419338 CallWindowProcW
 0x41933c DefWindowProcW
 0x419340 CallNextHookEx
 0x419344 PtInRect
 0x419348 SetWindowsHookExW
 0x41934c LoadImageW
 0x419350 LoadIconW
 0x419354 MessageBeep
 0x419358 EnableWindow
 0x41935c IsWindow
 0x419360 EnableMenuItem
 0x419364 GetSystemMenu
 0x419368 CreateWindowExA
 0x41936c wvsprintfW
 0x419370 GetClassNameA
 0x419374 GetWindowRect
ole32.dll
 0x41937c CreateStreamOnHGlobal
 0x419380 CoCreateInstance
 0x419384 CoInitialize
OLEAUT32.dll
 0x419258 SysAllocStringLen
 0x41925c VariantClear
 0x419260 SysFreeString
 0x419264 OleLoadPicture
 0x419268 SysAllocString
KERNEL32.dll
 0x419048 SetFileTime
 0x41904c SetEndOfFile
 0x419050 GetFileInformationByHandle
 0x419054 VirtualFree
 0x419058 GetModuleHandleA
 0x41905c WaitForMultipleObjects
 0x419060 VirtualAlloc
 0x419064 ReadFile
 0x419068 SetFilePointer
 0x41906c GetFileSize
 0x419070 LeaveCriticalSection
 0x419074 EnterCriticalSection
 0x419078 DeleteCriticalSection
 0x41907c FormatMessageW
 0x419080 lstrcpyW
 0x419084 LocalFree
 0x419088 IsBadReadPtr
 0x41908c SuspendThread
 0x419090 TerminateThread
 0x419094 GetSystemDirectoryW
 0x419098 GetCurrentThreadId
 0x41909c InitializeCriticalSection
 0x4190a0 ResetEvent
 0x4190a4 SetEvent
 0x4190a8 CreateEventW
 0x4190ac GetVersionExW
 0x4190b0 GetModuleFileNameW
 0x4190b4 GetCurrentProcess
 0x4190b8 SetProcessWorkingSetSize
 0x4190bc GetDriveTypeW
 0x4190c0 CreateFileW
 0x4190c4 SetEnvironmentVariableW
 0x4190c8 GetTempPathW
 0x4190cc GetCommandLineW
 0x4190d0 GetStartupInfoW
 0x4190d4 CreateProcessW
 0x4190d8 CreateJobObjectW
 0x4190dc ResumeThread
 0x4190e0 AssignProcessToJobObject
 0x4190e4 CreateIoCompletionPort
 0x4190e8 SetInformationJobObject
 0x4190ec GetQueuedCompletionStatus
 0x4190f0 GetExitCodeProcess
 0x4190f4 CloseHandle
 0x4190f8 LoadLibraryA
 0x4190fc SetThreadLocale
 0x419100 lstrlenW
 0x419104 GetSystemTimeAsFileTime
 0x419108 ExpandEnvironmentStringsW
 0x41910c CompareFileTime
 0x419110 WideCharToMultiByte
 0x419114 FindFirstFileW
 0x419118 lstrcmpW
 0x41911c DeleteFileW
 0x419120 FindNextFileW
 0x419124 FindClose
 0x419128 SetCurrentDirectoryW
 0x41912c RemoveDirectoryW
 0x419130 GetEnvironmentVariableW
 0x419134 lstrcmpiW
 0x419138 GetLocaleInfoW
 0x41913c MultiByteToWideChar
 0x419140 GetUserDefaultUILanguage
 0x419144 GetSystemDefaultUILanguage
 0x419148 GetSystemDefaultLCID
 0x41914c lstrcmpiA
 0x419150 GlobalAlloc
 0x419154 GlobalFree
 0x419158 MulDiv
 0x41915c FindResourceExA
 0x419160 SizeofResource
 0x419164 LoadResource
 0x419168 LockResource
 0x41916c GetProcAddress
 0x419170 GetModuleHandleW
 0x419174 GetStdHandle
 0x419178 ExitProcess
 0x41917c lstrcatW
 0x419180 GetDiskFreeSpaceExW
 0x419184 SetLastError
 0x419188 SetFileAttributesW
 0x41918c Sleep
 0x419190 GetExitCodeThread
 0x419194 WaitForSingleObject
 0x419198 CreateThread
 0x41919c GetLastError
 0x4191a0 SystemTimeToFileTime
 0x4191a4 GetLocalTime
 0x4191a8 GetFileAttributesW
 0x4191ac CreateDirectoryW
 0x4191b0 lstrlenA
 0x4191b4 WriteFile
 0x4191b8 GetStartupInfoA
MSVCRT.dll
 0x4191c0 _purecall
 0x4191c4 memcmp
 0x4191c8 ??2@YAPAXI@Z
 0x4191cc memmove
 0x4191d0 memcpy
 0x4191d4 _wtol
 0x4191d8 strncpy
 0x4191dc _controlfp
 0x4191e0 _except_handler3
 0x4191e4 __set_app_type
 0x4191e8 __p__fmode
 0x4191ec __p__commode
 0x4191f0 _adjust_fdiv
 0x4191f4 __setusermatherr
 0x4191f8 _initterm
 0x4191fc __getmainargs
 0x419200 _acmdln
 0x419204 exit
 0x419208 _XcptFilter
 0x41920c _exit
 0x419210 ??1type_info@@UAE@XZ
 0x419214 _onexit
 0x419218 __dllonexit
 0x41921c malloc
 0x419220 free
 0x419224 wcsstr
 0x419228 _CxxThrowException
 0x41922c wcscmp
 0x419230 _beginthreadex
 0x419234 _EH_prolog
 0x419238 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
 0x41923c memset
 0x419240 _wcsnicmp
 0x419244 strncmp
 0x419248 wcsncmp
 0x41924c wcsncpy
 0x419250 ??3@YAXPAX@Z

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure