ScreenShot
| Created | 2021.11.05 11:25 | Machine | s1_win7_x6401 |
| Filename | askinstall59.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 39 detected (AIDetect, malware2, malicious, high confidence, Siggen15, Razy, GenericRI, S23474139, Unsafe, Save, ZexaF, C90@aS6T7Pmj, Socelars, Eldorado, Attribute, HighConfidence, Disbuk, PWSX, R002C0WK421, PSWTroj, kcloud, Sabsik, score, Artemis, ai score=100, BScope, Agentb, FBAdsCard, CLASSIC, Static AI, Malicious PE, Genetic, confidence) | ||
| md5 | c55a782fb3152c45d4d4944539b5f4ea | ||
| sha256 | 13fedbb86566c03188cd4038d76837752e17af71055ccc91ff625ff35f532d68 | ||
| ssdeep | 24576:YcnpgcBAihZ1ziovvnNhio1d19f2Ubfmw6ESydB5NSfScZB:vpZt97Zea9SydBXSfScT | ||
| imphash | d69e4c13e25f0ad622344ac56118c0df | ||
| impfuzzy | 96:9XTXfp4sMIOtz0LEsQJcGtp43ta73grmxOP:5GyGEta7Qb | ||
Network IP location
Signature (25cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 39 AntiVirus engines on VirusTotal as malicious |
| watch | Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) |
| watch | One or more non-whitelisted processes were created |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An application raised an exception which may be indicative of an exploit crash |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Executes one or more WMI queries |
| notice | Foreign language identified in PE resource |
| notice | Performs some HTTP requests |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Queries for potentially installed applications |
| notice | Steals private information from local Internet browsers |
| notice | Terminates another process |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | Tries to locate where the browsers are installed |
Rules (50cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Trojan_PWS_Stealer_1_Zero | Trojan.PWS.Stealer Zero | binaries (upload) |
| warning | Credential_User_Data_Check_Zero | Credential User Data Check | binaries (upload) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | infoStealer_browser_Zero | browser info stealer | memory |
| watch | Chrome_User_Data_Check_Zero | Google Chrome User Data Check | memory |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | Network_Downloader | File Downloader | memory |
| watch | SQLite_cookies_Check_Zero | SQLite Cookie Check... select | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | BitCoin | Perform crypto currency mining | memory |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | Persistence | Install itself for autorun at Windows startup | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | Virtual_currency_Zero | Virtual currency | memory |
| info | vmdetect | Possibly employs anti-virtualization techniques | memory |
| info | win_hook | Affect hook table | memory |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (upload) |
| info | Win_Trojan_agentTesla_Zero | Win.Trojan.agentTesla | memory |
Network (5cnts) ?
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x51e050 GetComputerNameW
0x51e054 GetModuleFileNameA
0x51e058 GetCurrentProcessId
0x51e05c OpenProcess
0x51e060 GetModuleFileNameW
0x51e064 SetLastError
0x51e068 WaitForSingleObject
0x51e06c CreateEventW
0x51e070 FreeLibrary
0x51e074 WinExec
0x51e078 GetPrivateProfileStringW
0x51e07c CopyFileW
0x51e080 SetStdHandle
0x51e084 SetEnvironmentVariableW
0x51e088 FreeEnvironmentStringsW
0x51e08c GetEnvironmentStringsW
0x51e090 GetOEMCP
0x51e094 LocalFree
0x51e098 LocalAlloc
0x51e09c LoadResource
0x51e0a0 FindResourceW
0x51e0a4 SizeofResource
0x51e0a8 LockResource
0x51e0ac GetTickCount
0x51e0b0 GetCurrentThread
0x51e0b4 Sleep
0x51e0b8 GetProcessHeap
0x51e0bc HeapAlloc
0x51e0c0 GetLastError
0x51e0c4 GetTempPathA
0x51e0c8 SetCurrentDirectoryW
0x51e0cc GetShortPathNameA
0x51e0d0 LoadLibraryW
0x51e0d4 GetProcAddress
0x51e0d8 WideCharToMultiByte
0x51e0dc MultiByteToWideChar
0x51e0e0 SystemTimeToFileTime
0x51e0e4 DosDateTimeToFileTime
0x51e0e8 GetCurrentProcess
0x51e0ec DuplicateHandle
0x51e0f0 CloseHandle
0x51e0f4 WriteFile
0x51e0f8 SetFileTime
0x51e0fc SetFilePointer
0x51e100 ReadFile
0x51e104 GetFileType
0x51e108 CreateFileW
0x51e10c CreateDirectoryW
0x51e110 TerminateProcess
0x51e114 GetCurrentDirectoryW
0x51e118 GetACP
0x51e11c IsValidCodePage
0x51e120 FindNextFileW
0x51e124 FindFirstFileExW
0x51e128 FindClose
0x51e12c GetTimeZoneInformation
0x51e130 GetFileSizeEx
0x51e134 GetConsoleOutputCP
0x51e138 SetFilePointerEx
0x51e13c ReadConsoleW
0x51e140 GetConsoleMode
0x51e144 EnumSystemLocalesW
0x51e148 GetUserDefaultLCID
0x51e14c IsValidLocale
0x51e150 GetLocaleInfoW
0x51e154 LCMapStringW
0x51e158 CompareStringW
0x51e15c GetCommandLineW
0x51e160 GetCommandLineA
0x51e164 GetStdHandle
0x51e168 ExitProcess
0x51e16c GetModuleHandleExW
0x51e170 FreeLibraryAndExitThread
0x51e174 ExitThread
0x51e178 CreateThread
0x51e17c LoadLibraryExW
0x51e180 TlsFree
0x51e184 TlsSetValue
0x51e188 TlsGetValue
0x51e18c TlsAlloc
0x51e190 RtlUnwind
0x51e194 RaiseException
0x51e198 GetStringTypeW
0x51e19c WriteConsoleW
0x51e1a0 GetCPInfo
0x51e1a4 CompareStringEx
0x51e1a8 LCMapStringEx
0x51e1ac DecodePointer
0x51e1b0 EncodePointer
0x51e1b4 InitializeCriticalSectionEx
0x51e1b8 InitializeSListHead
0x51e1bc GetStartupInfoW
0x51e1c0 IsDebuggerPresent
0x51e1c4 GetModuleHandleW
0x51e1c8 ResetEvent
0x51e1cc SetEvent
0x51e1d0 InitializeCriticalSectionAndSpinCount
0x51e1d4 IsProcessorFeaturePresent
0x51e1d8 SetUnhandledExceptionFilter
0x51e1dc UnhandledExceptionFilter
0x51e1e0 FlushFileBuffers
0x51e1e4 QueryPerformanceCounter
0x51e1e8 MapViewOfFile
0x51e1ec CreateFileMappingW
0x51e1f0 AreFileApisANSI
0x51e1f4 TryEnterCriticalSection
0x51e1f8 HeapCreate
0x51e1fc HeapFree
0x51e200 EnterCriticalSection
0x51e204 GetFullPathNameW
0x51e208 GetDiskFreeSpaceW
0x51e20c OutputDebugStringA
0x51e210 LockFile
0x51e214 LeaveCriticalSection
0x51e218 InitializeCriticalSection
0x51e21c GetFullPathNameA
0x51e220 SetEndOfFile
0x51e224 UnlockFileEx
0x51e228 GetTempPathW
0x51e22c CreateMutexW
0x51e230 GetFileAttributesW
0x51e234 GetCurrentThreadId
0x51e238 UnmapViewOfFile
0x51e23c HeapValidate
0x51e240 HeapSize
0x51e244 FormatMessageW
0x51e248 GetDiskFreeSpaceA
0x51e24c GetFileAttributesA
0x51e250 GetFileAttributesExW
0x51e254 OutputDebugStringW
0x51e258 FlushViewOfFile
0x51e25c CreateFileA
0x51e260 LoadLibraryA
0x51e264 WaitForSingleObjectEx
0x51e268 DeleteFileA
0x51e26c DeleteFileW
0x51e270 HeapReAlloc
0x51e274 GetSystemInfo
0x51e278 HeapCompact
0x51e27c HeapDestroy
0x51e280 UnlockFile
0x51e284 LockFileEx
0x51e288 GetFileSize
0x51e28c DeleteCriticalSection
0x51e290 GetSystemTimeAsFileTime
0x51e294 GetSystemTime
0x51e298 FormatMessageA
ADVAPI32.dll
0x51e000 LookupPrivilegeValueW
0x51e004 AdjustTokenPrivileges
0x51e008 LookupAccountNameW
0x51e00c SetSecurityDescriptorOwner
0x51e010 SetSecurityDescriptorGroup
0x51e014 SetSecurityDescriptorDacl
0x51e018 IsValidSecurityDescriptor
0x51e01c InitializeSecurityDescriptor
0x51e020 InitializeAcl
0x51e024 GetTokenInformation
0x51e028 GetLengthSid
0x51e02c FreeSid
0x51e030 EqualSid
0x51e034 DuplicateToken
0x51e038 AllocateAndInitializeSid
0x51e03c AddAccessAllowedAce
0x51e040 AccessCheck
0x51e044 OpenThreadToken
0x51e048 OpenProcessToken
SHELL32.dll
0x51e2a8 ShellExecuteExA
ole32.dll
0x51e2fc CoInitializeEx
0x51e300 CoGetObject
0x51e304 CoUninitialize
WININET.dll
0x51e2b0 InternetGetCookieExA
NETAPI32.dll
0x51e2a0 Netbios
ntdll.dll
0x51e2b8 RtlInitUnicodeString
0x51e2bc NtFreeVirtualMemory
0x51e2c0 LdrEnumerateLoadedModules
0x51e2c4 RtlEqualUnicodeString
0x51e2c8 RtlAcquirePebLock
0x51e2cc NtAllocateVirtualMemory
0x51e2d0 RtlReleasePebLock
0x51e2d4 RtlNtStatusToDosError
0x51e2d8 RtlCreateHeap
0x51e2dc RtlDestroyHeap
0x51e2e0 RtlAllocateHeap
0x51e2e4 RtlFreeHeap
0x51e2e8 NtClose
0x51e2ec NtOpenKey
0x51e2f0 NtEnumerateValueKey
0x51e2f4 NtQueryValueKey
EAT(Export Address Table) is none
KERNEL32.dll
0x51e050 GetComputerNameW
0x51e054 GetModuleFileNameA
0x51e058 GetCurrentProcessId
0x51e05c OpenProcess
0x51e060 GetModuleFileNameW
0x51e064 SetLastError
0x51e068 WaitForSingleObject
0x51e06c CreateEventW
0x51e070 FreeLibrary
0x51e074 WinExec
0x51e078 GetPrivateProfileStringW
0x51e07c CopyFileW
0x51e080 SetStdHandle
0x51e084 SetEnvironmentVariableW
0x51e088 FreeEnvironmentStringsW
0x51e08c GetEnvironmentStringsW
0x51e090 GetOEMCP
0x51e094 LocalFree
0x51e098 LocalAlloc
0x51e09c LoadResource
0x51e0a0 FindResourceW
0x51e0a4 SizeofResource
0x51e0a8 LockResource
0x51e0ac GetTickCount
0x51e0b0 GetCurrentThread
0x51e0b4 Sleep
0x51e0b8 GetProcessHeap
0x51e0bc HeapAlloc
0x51e0c0 GetLastError
0x51e0c4 GetTempPathA
0x51e0c8 SetCurrentDirectoryW
0x51e0cc GetShortPathNameA
0x51e0d0 LoadLibraryW
0x51e0d4 GetProcAddress
0x51e0d8 WideCharToMultiByte
0x51e0dc MultiByteToWideChar
0x51e0e0 SystemTimeToFileTime
0x51e0e4 DosDateTimeToFileTime
0x51e0e8 GetCurrentProcess
0x51e0ec DuplicateHandle
0x51e0f0 CloseHandle
0x51e0f4 WriteFile
0x51e0f8 SetFileTime
0x51e0fc SetFilePointer
0x51e100 ReadFile
0x51e104 GetFileType
0x51e108 CreateFileW
0x51e10c CreateDirectoryW
0x51e110 TerminateProcess
0x51e114 GetCurrentDirectoryW
0x51e118 GetACP
0x51e11c IsValidCodePage
0x51e120 FindNextFileW
0x51e124 FindFirstFileExW
0x51e128 FindClose
0x51e12c GetTimeZoneInformation
0x51e130 GetFileSizeEx
0x51e134 GetConsoleOutputCP
0x51e138 SetFilePointerEx
0x51e13c ReadConsoleW
0x51e140 GetConsoleMode
0x51e144 EnumSystemLocalesW
0x51e148 GetUserDefaultLCID
0x51e14c IsValidLocale
0x51e150 GetLocaleInfoW
0x51e154 LCMapStringW
0x51e158 CompareStringW
0x51e15c GetCommandLineW
0x51e160 GetCommandLineA
0x51e164 GetStdHandle
0x51e168 ExitProcess
0x51e16c GetModuleHandleExW
0x51e170 FreeLibraryAndExitThread
0x51e174 ExitThread
0x51e178 CreateThread
0x51e17c LoadLibraryExW
0x51e180 TlsFree
0x51e184 TlsSetValue
0x51e188 TlsGetValue
0x51e18c TlsAlloc
0x51e190 RtlUnwind
0x51e194 RaiseException
0x51e198 GetStringTypeW
0x51e19c WriteConsoleW
0x51e1a0 GetCPInfo
0x51e1a4 CompareStringEx
0x51e1a8 LCMapStringEx
0x51e1ac DecodePointer
0x51e1b0 EncodePointer
0x51e1b4 InitializeCriticalSectionEx
0x51e1b8 InitializeSListHead
0x51e1bc GetStartupInfoW
0x51e1c0 IsDebuggerPresent
0x51e1c4 GetModuleHandleW
0x51e1c8 ResetEvent
0x51e1cc SetEvent
0x51e1d0 InitializeCriticalSectionAndSpinCount
0x51e1d4 IsProcessorFeaturePresent
0x51e1d8 SetUnhandledExceptionFilter
0x51e1dc UnhandledExceptionFilter
0x51e1e0 FlushFileBuffers
0x51e1e4 QueryPerformanceCounter
0x51e1e8 MapViewOfFile
0x51e1ec CreateFileMappingW
0x51e1f0 AreFileApisANSI
0x51e1f4 TryEnterCriticalSection
0x51e1f8 HeapCreate
0x51e1fc HeapFree
0x51e200 EnterCriticalSection
0x51e204 GetFullPathNameW
0x51e208 GetDiskFreeSpaceW
0x51e20c OutputDebugStringA
0x51e210 LockFile
0x51e214 LeaveCriticalSection
0x51e218 InitializeCriticalSection
0x51e21c GetFullPathNameA
0x51e220 SetEndOfFile
0x51e224 UnlockFileEx
0x51e228 GetTempPathW
0x51e22c CreateMutexW
0x51e230 GetFileAttributesW
0x51e234 GetCurrentThreadId
0x51e238 UnmapViewOfFile
0x51e23c HeapValidate
0x51e240 HeapSize
0x51e244 FormatMessageW
0x51e248 GetDiskFreeSpaceA
0x51e24c GetFileAttributesA
0x51e250 GetFileAttributesExW
0x51e254 OutputDebugStringW
0x51e258 FlushViewOfFile
0x51e25c CreateFileA
0x51e260 LoadLibraryA
0x51e264 WaitForSingleObjectEx
0x51e268 DeleteFileA
0x51e26c DeleteFileW
0x51e270 HeapReAlloc
0x51e274 GetSystemInfo
0x51e278 HeapCompact
0x51e27c HeapDestroy
0x51e280 UnlockFile
0x51e284 LockFileEx
0x51e288 GetFileSize
0x51e28c DeleteCriticalSection
0x51e290 GetSystemTimeAsFileTime
0x51e294 GetSystemTime
0x51e298 FormatMessageA
ADVAPI32.dll
0x51e000 LookupPrivilegeValueW
0x51e004 AdjustTokenPrivileges
0x51e008 LookupAccountNameW
0x51e00c SetSecurityDescriptorOwner
0x51e010 SetSecurityDescriptorGroup
0x51e014 SetSecurityDescriptorDacl
0x51e018 IsValidSecurityDescriptor
0x51e01c InitializeSecurityDescriptor
0x51e020 InitializeAcl
0x51e024 GetTokenInformation
0x51e028 GetLengthSid
0x51e02c FreeSid
0x51e030 EqualSid
0x51e034 DuplicateToken
0x51e038 AllocateAndInitializeSid
0x51e03c AddAccessAllowedAce
0x51e040 AccessCheck
0x51e044 OpenThreadToken
0x51e048 OpenProcessToken
SHELL32.dll
0x51e2a8 ShellExecuteExA
ole32.dll
0x51e2fc CoInitializeEx
0x51e300 CoGetObject
0x51e304 CoUninitialize
WININET.dll
0x51e2b0 InternetGetCookieExA
NETAPI32.dll
0x51e2a0 Netbios
ntdll.dll
0x51e2b8 RtlInitUnicodeString
0x51e2bc NtFreeVirtualMemory
0x51e2c0 LdrEnumerateLoadedModules
0x51e2c4 RtlEqualUnicodeString
0x51e2c8 RtlAcquirePebLock
0x51e2cc NtAllocateVirtualMemory
0x51e2d0 RtlReleasePebLock
0x51e2d4 RtlNtStatusToDosError
0x51e2d8 RtlCreateHeap
0x51e2dc RtlDestroyHeap
0x51e2e0 RtlAllocateHeap
0x51e2e4 RtlFreeHeap
0x51e2e8 NtClose
0x51e2ec NtOpenKey
0x51e2f0 NtEnumerateValueKey
0x51e2f4 NtQueryValueKey
EAT(Export Address Table) is none