popup

Report - setup.exe

Emotet Gen2 Formbook RAT PWS .NET framework Gen1 Eredel Stealer Extended njRAT backdoor Loki[b] Loki.m Generic Malware Malicious Library UPX Malicious Packer ASPack Admin Tool (Sysinternals etc ...) PE File PE32 DLL OS Processor Check MSOffice File PE
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.11.04 15:18 Machine s1_win7_x6403
Filename setup.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
 Behavior Score
10.2
ZERO API file : clean
VT API (file) 6 detected (GenericKD, Malicious, ai score=80)
md5 bab66a1efbd3c6e65c5a6e01deea8367
sha256 e0f18444b40d78c65e1821586721760d303bb767093ea09642226abed4d1ad85
ssdeep 49152:C9OKxz5eM8JvooqXrFzYA8hVU2AGm63yjpGIcLJjmXGpf8:MOm5eMOooqhomhjrcLT8
imphash 884310b1928934402ea6fec1dbd3cf5e
impfuzzy 48:8cfp1rcQX0gebPCDr+ZbldH9AOZGwt+Eu55T/lGB:8cfpdcqNebqDrmrHW2
  Network IP location

Signature (26cnts)

Level Description
watch Attempts to create or modify system certificates
watch Communicates with host for which no DNS query was performed
watch Connects to an IRC server
watch One or more of the buffers contains an embedded PE file
watch Putty Files
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice An executable file was downloaded by the process setup.tmp
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice Expresses interest in specific running processes
notice File has been identified by 6 AntiVirus engines on VirusTotal as malicious
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Searches running processes potentially to identify processes for sandbox evasion
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Uses Windows APIs to generate a cryptographic key

Rules (27cnts)

Level Name Description Collection
danger Win32_PWS_Loki_Zero Win32 PWS Loki binaries (download)
danger Win32_Trojan_Emotet_2_Zero Win32 Trojan Emotet binaries (download)
danger Win32_Trojan_Emotet_2_Zero Win32 Trojan Emotet binaries (upload)
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
danger Win_Backdoor_njRAT_Zero Win Backdoor njRAT binaries (download)
danger Win_Eredel_Stealer_Extended_IN_Zero Win Eredel Stealer Extended binaries (download)
danger Win_Trojan_Formbook_Zero Used Formbook binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (download)
watch ASPack_Zero ASPack packed file binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
watch Win32_Trojan_PWS_Net_1_Zero Win32 Trojan PWS .NET Azorult binaries (download)
info Is_DotNET_EXE (no description) binaries (download)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info IsPE64 (no description) binaries (download)
info Microsoft_Office_File_Zero Microsoft Office File binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info Win32_Trojan_Gen_2_0904B0_Zero Win32 Trojan Gen binaries (download)
info Win_Backdoor_AsyncRAT_Zero Win Backdoor AsyncRAT binaries (download)

Network (29cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
whois
US CCCH-3 23.216.159.58 clean
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
whois
US CCCH-3 23.216.159.58 clean
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net472Rel1&plcid=0x409&clcid=0x409&ar=03062.00&sar=amd64&o1=netfx_Full_x64.msi
whois
US Akamai International B.V. 104.75.21.121 clean
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net472Rel1&plcid=0x409&clcid=0x409&ar=03062.00&sar=amd64&o1=netfx_Full.mzz
whois
US Akamai International B.V. 104.75.21.121 clean
http://go.microsoft.com/fwlink/?LinkId=862008
whois
US Akamai International B.V. 104.75.21.121 clean
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
whois
US CCCH-3 23.216.159.34 clean
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
whois
US CCCH-3 23.216.159.58 clean
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
whois
US AKAMAI-AS 23.201.37.168 clean
http://go.microsoft.com/fwlink/?LinkId=249120&clcid=0x409
whois
US Akamai International B.V. 104.74.214.213 clean
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
whois
US CCCH-3 23.216.159.34 clean
http://indug.com/68.exe
whois
US Alibaba (US) Technology Co., Ltd. 47.254.184.183 clean
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
whois
US CCCH-3 23.216.159.58 clean
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net472Rel1&plcid=0x409&clcid=0x409&ar=03081.00&sar=amd64&o1=netfx_Patch_x64.msp
whois
US Akamai International B.V. 104.74.214.213 clean
https://download.visualstudio.microsoft.com/download/pr/375f6a02-34bc-4b7d-ad8b-957789cf81e8/e4abafc291524af6e2b478f5d4857f0a/netfx_full_x64.msi
whois
US EDGECAST 192.229.232.200 clean
https://download.visualstudio.microsoft.com/download/pr/887938c3-2a46-4069-a0b1-207035f1dd82/61ef25faf2ae00460f6a77e29327699a/netfx_patch_x64.msp
whois
US EDGECAST 192.229.232.200 clean
https://download.visualstudio.microsoft.com/download/pr/887938c3-2a46-4069-a0b1-207035f1dd82/f0771dabc43ba46cfe9e3481840a7944/windows6.1-kb4019990-x64.cab
whois
US EDGECAST 192.229.232.200 clean
https://download.visualstudio.microsoft.com/download/pr/7db06743-abf0-4a85-a9d3-5af54b6cabcc/cc8282475d16202c4dca707e83cf0ae0/netfx_full_x64.msi
whois
US EDGECAST 192.229.232.200 clean
https://download.microsoft.com/download/b/9/5/b95136c0-58a0-48df-821a-d05319a86852/enu_NETFX/amd64_netfx_full_mzz/netfx_full_cab.exe
whois
US AKAMAI-AS 23.201.36.112 clean
indug.com
whois
US Alibaba (US) Technology Co., Ltd. 47.254.184.183 clean
download.visualstudio.microsoft.com
whois
US EDGECAST 192.229.232.200 clean
download.microsoft.com
whois
Unknown 104.109.240.114 clean
www.microsoft.com
whois
US AKAMAI-AS 23.201.37.168 clean
121.254.136.16
whois
KR LG DACOM Corporation 121.254.136.16 clean
104.75.21.121
whois
US Akamai International B.V. 104.75.21.121 clean
34.117.59.81
whois
US GOOGLE 34.117.59.81 clean
47.254.184.183
whois
US Alibaba (US) Technology Co., Ltd. 47.254.184.183 clean
23.201.36.112
whois
US AKAMAI-AS 23.201.36.112 clean
23.201.37.168
whois
US AKAMAI-AS 23.201.37.168 clean
192.229.232.200
whois
US EDGECAST 192.229.232.200 clean

Suricata ids

ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
ET POLICY PE EXE or DLL Windows file download HTTP
ET MALWARE JS/Nemucod.M.gen downloading EXE payload
ET INFO EXE - Served Attached HTTP
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x40d0b4 DeleteCriticalSection
 0x40d0b8 LeaveCriticalSection
 0x40d0bc EnterCriticalSection
 0x40d0c0 InitializeCriticalSection
 0x40d0c4 VirtualFree
 0x40d0c8 VirtualAlloc
 0x40d0cc LocalFree
 0x40d0d0 LocalAlloc
 0x40d0d4 WideCharToMultiByte
 0x40d0d8 TlsSetValue
 0x40d0dc TlsGetValue
 0x40d0e0 MultiByteToWideChar
 0x40d0e4 GetModuleHandleA
 0x40d0e8 GetLastError
 0x40d0ec GetCommandLineA
 0x40d0f0 WriteFile
 0x40d0f4 SetFilePointer
 0x40d0f8 SetEndOfFile
 0x40d0fc RtlUnwind
 0x40d100 ReadFile
 0x40d104 RaiseException
 0x40d108 GetStdHandle
 0x40d10c GetFileSize
 0x40d110 GetSystemTime
 0x40d114 GetFileType
 0x40d118 ExitProcess
 0x40d11c CreateFileA
 0x40d120 CloseHandle
user32.dll
 0x40d128 MessageBoxA
oleaut32.dll
 0x40d130 VariantChangeTypeEx
 0x40d134 VariantCopyInd
 0x40d138 VariantClear
 0x40d13c SysStringLen
 0x40d140 SysAllocStringLen
advapi32.dll
 0x40d148 RegQueryValueExA
 0x40d14c RegOpenKeyExA
 0x40d150 RegCloseKey
 0x40d154 OpenProcessToken
 0x40d158 LookupPrivilegeValueA
kernel32.dll
 0x40d160 WriteFile
 0x40d164 VirtualQuery
 0x40d168 VirtualProtect
 0x40d16c VirtualFree
 0x40d170 VirtualAlloc
 0x40d174 Sleep
 0x40d178 SizeofResource
 0x40d17c SetLastError
 0x40d180 SetFilePointer
 0x40d184 SetErrorMode
 0x40d188 SetEndOfFile
 0x40d18c RemoveDirectoryA
 0x40d190 ReadFile
 0x40d194 LockResource
 0x40d198 LoadResource
 0x40d19c LoadLibraryA
 0x40d1a0 IsDBCSLeadByte
 0x40d1a4 GetWindowsDirectoryA
 0x40d1a8 GetVersionExA
 0x40d1ac GetUserDefaultLangID
 0x40d1b0 GetSystemInfo
 0x40d1b4 GetSystemDefaultLCID
 0x40d1b8 GetProcAddress
 0x40d1bc GetModuleHandleA
 0x40d1c0 GetModuleFileNameA
 0x40d1c4 GetLocaleInfoA
 0x40d1c8 GetLastError
 0x40d1cc GetFullPathNameA
 0x40d1d0 GetFileSize
 0x40d1d4 GetFileAttributesA
 0x40d1d8 GetExitCodeProcess
 0x40d1dc GetEnvironmentVariableA
 0x40d1e0 GetCurrentProcess
 0x40d1e4 GetCommandLineA
 0x40d1e8 GetACP
 0x40d1ec InterlockedExchange
 0x40d1f0 FormatMessageA
 0x40d1f4 FindResourceA
 0x40d1f8 DeleteFileA
 0x40d1fc CreateProcessA
 0x40d200 CreateFileA
 0x40d204 CreateDirectoryA
 0x40d208 CloseHandle
user32.dll
 0x40d210 TranslateMessage
 0x40d214 SetWindowLongA
 0x40d218 PeekMessageA
 0x40d21c MsgWaitForMultipleObjects
 0x40d220 MessageBoxA
 0x40d224 LoadStringA
 0x40d228 ExitWindowsEx
 0x40d22c DispatchMessageA
 0x40d230 DestroyWindow
 0x40d234 CreateWindowExA
 0x40d238 CallWindowProcA
 0x40d23c CharPrevA
comctl32.dll
 0x40d244 InitCommonControls
advapi32.dll
 0x40d24c AdjustTokenPrivileges

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure