ScreenShot
| Created | 2022.05.02 09:13 | Machine | s1_win7_x6401 |
| Filename | IE.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 47 detected (AIDetect, malware2, GenericKD, MsilFC, S19436131, MSILZilla, Unsafe, Certutil, TrojanPSW, malicious, high confidence, multiple detections, fbgfaf, Blocker, Wqcw, Malware@#1sbof9vw77lzu, Siggen10, Coinminer, LIMERAT, Static AI, Malicious SFX, XPACK, Gen7, AWK8T5, score, Disfa, Artemis, ai score=87, R002H0CDU22, CLASSIC, bWQ1OiJM5M03mm8M, Outbreak, susgen, ZemsilF, biW@ayUARzm, confidence, 100%) | ||
| md5 | d55af7419949eb1630bf0e6b3684166e | ||
| sha256 | bff7a405dc189f102b598e9fbbc88ce74f6ef1bd9dac4fa7fc93e8841233ca32 | ||
| ssdeep | 6144:8/fAhvV6B8ErzPZp5wdz753RSkKJUH43YvN6sNmw3zi7qZ1l+/Axoq8L:YfAv6B8azBwdtK2H4IvN6YQq1l+YxEL | ||
| imphash | 00be6e6c4f9e287672c8301b72bdabf3 | ||
| impfuzzy | 48:WOX8LKc1XFjsX1Pfc++64GYgeBtDXMunCHFa:WJLKc1XFgX1Pfc++rjdBtDXMunMFa | ||
Network IP location
Signature (51cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 47 AntiVirus engines on VirusTotal as malicious |
| watch | A stratum cryptocurrency mining command was executed |
| watch | Attempts to remove evidence of file being downloaded from the Internet |
| watch | Communicates with host for which no DNS query was performed |
| watch | Created a process named as a common system process |
| watch | Created a service where a service was also not started |
| watch | Detects Virtual Machines through their custom firmware |
| watch | Disables Windows' Task Manager |
| watch | Executes one or more WMI queries |
| watch | Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) |
| watch | Installs itself for autorun at Windows startup |
| watch | Network activity contains more than one unique useragent |
| watch | Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe |
| watch | Network communications indicative of possible code injection originated from the process explorer.exe |
| watch | One or more non-whitelisted processes were created |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Wscript.exe initiated network communications indicative of a script based payload download |
| watch | wscript.exe-based dropper (JScript |
| notice | A process attempted to delay the analysis task. |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An executable file was downloaded by the process certutil.exe |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Connects to a Dynamic DNS Domain |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | Executes one or more WMI queries which can be used to identify virtual machines |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Repeatedly searches for a not-found process |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (61cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | WWW_Cryptocurrency_Miner_Zero | WWW Cryptocurrency Miner Zero | memory |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Network_Downloader | File Downloader | memory |
| watch | schtasks_Zero | task schedule | memory |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| watch | Win32_WinRAR_SFX_Zero | Win32 WinRAR SFX | binaries (download) |
| watch | Win32_WinRAR_SFX_Zero | Win32 WinRAR SFX | binaries (upload) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (download) |
| notice | BitCoin | Perform crypto currency mining | memory |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | Persistence | Install itself for autorun at Windows startup | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | anti_dbgtools | Checks for the presence of known debug tools | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | disable_taskmanager | Disable Task Manager | memory |
| info | Is_DotNET_DLL | (no description) | binaries (download) |
| info | Is_DotNET_EXE | (no description) | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | Lnk_Format_Zero | LNK Format | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
| info | Win_Backdoor_AsyncRAT_Zero | Win Backdoor AsyncRAT | binaries (download) |
Network (80cnts) ?
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET POLICY DNS Query to DynDNS Domain *.ddns .net
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
ET POLICY DNS Query to DynDNS Domain *.ddnsking .com
ET POLICY DNS Query to DynDNS Domain *.bounceme .net
ET POLICY DNS Query to DynDNS Domain *.freedynamicdns .org
ET POLICY DNS Query to DynDNS Domain *.myftp .org
ET POLICY DNS Query to DynDNS Domain *.onthewifi .com
ET POLICY DNS Query to DynDNS Domain *.servegame .com
ET POLICY DNS Query to DynDNS Domain *.viewdns .net
ET POLICY DNS Query to DynDNS Domain *.serveftp .com
ET POLICY DNS Query to DynDNS Domain *.servehttp .com
ET POLICY DNS Query to DynDNS Domain *.servehalflife .com
ET POLICY DNS Query to DynDNS Domain *.serveminecraft .net
ET POLICY DNS Query to DynDNS Domain *.zapto .org
ET POLICY DNS Query to DynDNS Domain *.freedynamicdns .net
ET POLICY DNS Query to DynDNS Domain *.redirectme .net
ET POLICY DNS Query to DynDNS Domain *.serveblog .net
ET POLICY DNS Query to DynDNS Domain *.servecounterstrike .com
ET POLICY DNS Query to DynDNS Domain *.servemp3 .com
ET POLICY DNS Query to DynDNS Domain *.servepics .com
ET POLICY DNS Query to DynDNS Domain *.hopto .org
ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain
ET INFO Observed DNS Query to .biz TLD
ET POLICY DNS Query to DynDNS Domain *.serveirc .com
ET POLICY DNS Query to DynDNS Domain *.myvnc .com
ET POLICY DNS Query to DynDNS Domain *.servebeer .com
ET POLICY DNS Query to DynDNS Domain *.servequake .com
ET POLICY DNS Query to DynDNS Domain *.webhop .me
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET POLICY DNS Query to DynDNS Domain *.ddns .net
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
ET POLICY DNS Query to DynDNS Domain *.ddnsking .com
ET POLICY DNS Query to DynDNS Domain *.bounceme .net
ET POLICY DNS Query to DynDNS Domain *.freedynamicdns .org
ET POLICY DNS Query to DynDNS Domain *.myftp .org
ET POLICY DNS Query to DynDNS Domain *.onthewifi .com
ET POLICY DNS Query to DynDNS Domain *.servegame .com
ET POLICY DNS Query to DynDNS Domain *.viewdns .net
ET POLICY DNS Query to DynDNS Domain *.serveftp .com
ET POLICY DNS Query to DynDNS Domain *.servehttp .com
ET POLICY DNS Query to DynDNS Domain *.servehalflife .com
ET POLICY DNS Query to DynDNS Domain *.serveminecraft .net
ET POLICY DNS Query to DynDNS Domain *.zapto .org
ET POLICY DNS Query to DynDNS Domain *.freedynamicdns .net
ET POLICY DNS Query to DynDNS Domain *.redirectme .net
ET POLICY DNS Query to DynDNS Domain *.serveblog .net
ET POLICY DNS Query to DynDNS Domain *.servecounterstrike .com
ET POLICY DNS Query to DynDNS Domain *.servemp3 .com
ET POLICY DNS Query to DynDNS Domain *.servepics .com
ET POLICY DNS Query to DynDNS Domain *.hopto .org
ET INFO DYNAMIC_DNS Query to a Suspicious *.myftp.biz Domain
ET INFO Observed DNS Query to .biz TLD
ET POLICY DNS Query to DynDNS Domain *.serveirc .com
ET POLICY DNS Query to DynDNS Domain *.myvnc .com
ET POLICY DNS Query to DynDNS Domain *.servebeer .com
ET POLICY DNS Query to DynDNS Domain *.servequake .com
ET POLICY DNS Query to DynDNS Domain *.webhop .me
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x430000 GetLastError
0x430004 SetLastError
0x430008 GetCurrentProcess
0x43000c DeviceIoControl
0x430010 SetFileTime
0x430014 CloseHandle
0x430018 CreateDirectoryW
0x43001c RemoveDirectoryW
0x430020 CreateFileW
0x430024 DeleteFileW
0x430028 CreateHardLinkW
0x43002c GetShortPathNameW
0x430030 GetLongPathNameW
0x430034 MoveFileW
0x430038 GetFileType
0x43003c GetStdHandle
0x430040 WriteFile
0x430044 ReadFile
0x430048 FlushFileBuffers
0x43004c SetEndOfFile
0x430050 SetFilePointer
0x430054 SetFileAttributesW
0x430058 GetFileAttributesW
0x43005c FindClose
0x430060 FindFirstFileW
0x430064 FindNextFileW
0x430068 GetVersionExW
0x43006c GetCurrentDirectoryW
0x430070 GetFullPathNameW
0x430074 FoldStringW
0x430078 GetModuleFileNameW
0x43007c GetModuleHandleW
0x430080 FindResourceW
0x430084 FreeLibrary
0x430088 GetProcAddress
0x43008c GetCurrentProcessId
0x430090 ExitProcess
0x430094 SetThreadExecutionState
0x430098 Sleep
0x43009c LoadLibraryW
0x4300a0 GetSystemDirectoryW
0x4300a4 CompareStringW
0x4300a8 AllocConsole
0x4300ac FreeConsole
0x4300b0 AttachConsole
0x4300b4 WriteConsoleW
0x4300b8 GetProcessAffinityMask
0x4300bc CreateThread
0x4300c0 SetThreadPriority
0x4300c4 InitializeCriticalSection
0x4300c8 EnterCriticalSection
0x4300cc LeaveCriticalSection
0x4300d0 DeleteCriticalSection
0x4300d4 SetEvent
0x4300d8 ResetEvent
0x4300dc ReleaseSemaphore
0x4300e0 WaitForSingleObject
0x4300e4 CreateEventW
0x4300e8 CreateSemaphoreW
0x4300ec GetSystemTime
0x4300f0 SystemTimeToTzSpecificLocalTime
0x4300f4 TzSpecificLocalTimeToSystemTime
0x4300f8 SystemTimeToFileTime
0x4300fc FileTimeToLocalFileTime
0x430100 LocalFileTimeToFileTime
0x430104 FileTimeToSystemTime
0x430108 GetCPInfo
0x43010c IsDBCSLeadByte
0x430110 MultiByteToWideChar
0x430114 WideCharToMultiByte
0x430118 GlobalAlloc
0x43011c GetTickCount
0x430120 LockResource
0x430124 GlobalLock
0x430128 GlobalUnlock
0x43012c GlobalFree
0x430130 LoadResource
0x430134 SizeofResource
0x430138 SetCurrentDirectoryW
0x43013c GetExitCodeProcess
0x430140 GetLocalTime
0x430144 MapViewOfFile
0x430148 UnmapViewOfFile
0x43014c CreateFileMappingW
0x430150 OpenFileMappingW
0x430154 GetCommandLineW
0x430158 SetEnvironmentVariableW
0x43015c ExpandEnvironmentStringsW
0x430160 GetTempPathW
0x430164 MoveFileExW
0x430168 GetLocaleInfoW
0x43016c GetTimeFormatW
0x430170 GetDateFormatW
0x430174 GetNumberFormatW
0x430178 SetFilePointerEx
0x43017c GetConsoleMode
0x430180 GetConsoleCP
0x430184 HeapSize
0x430188 SetStdHandle
0x43018c GetProcessHeap
0x430190 RaiseException
0x430194 GetSystemInfo
0x430198 VirtualProtect
0x43019c VirtualQuery
0x4301a0 LoadLibraryExA
0x4301a4 IsProcessorFeaturePresent
0x4301a8 IsDebuggerPresent
0x4301ac UnhandledExceptionFilter
0x4301b0 SetUnhandledExceptionFilter
0x4301b4 GetStartupInfoW
0x4301b8 QueryPerformanceCounter
0x4301bc GetCurrentThreadId
0x4301c0 GetSystemTimeAsFileTime
0x4301c4 InitializeSListHead
0x4301c8 TerminateProcess
0x4301cc RtlUnwind
0x4301d0 EncodePointer
0x4301d4 InitializeCriticalSectionAndSpinCount
0x4301d8 TlsAlloc
0x4301dc TlsGetValue
0x4301e0 TlsSetValue
0x4301e4 TlsFree
0x4301e8 LoadLibraryExW
0x4301ec QueryPerformanceFrequency
0x4301f0 GetModuleHandleExW
0x4301f4 GetModuleFileNameA
0x4301f8 GetACP
0x4301fc HeapFree
0x430200 HeapAlloc
0x430204 HeapReAlloc
0x430208 GetStringTypeW
0x43020c LCMapStringW
0x430210 FindFirstFileExA
0x430214 FindNextFileA
0x430218 IsValidCodePage
0x43021c GetOEMCP
0x430220 GetCommandLineA
0x430224 GetEnvironmentStringsW
0x430228 FreeEnvironmentStringsW
0x43022c DecodePointer
gdiplus.dll
0x430234 GdiplusShutdown
0x430238 GdiplusStartup
0x43023c GdipCreateHBITMAPFromBitmap
0x430240 GdipCreateBitmapFromStreamICM
0x430244 GdipCreateBitmapFromStream
0x430248 GdipDisposeImage
0x43024c GdipCloneImage
0x430250 GdipFree
0x430254 GdipAlloc
EAT(Export Address Table) Library
KERNEL32.dll
0x430000 GetLastError
0x430004 SetLastError
0x430008 GetCurrentProcess
0x43000c DeviceIoControl
0x430010 SetFileTime
0x430014 CloseHandle
0x430018 CreateDirectoryW
0x43001c RemoveDirectoryW
0x430020 CreateFileW
0x430024 DeleteFileW
0x430028 CreateHardLinkW
0x43002c GetShortPathNameW
0x430030 GetLongPathNameW
0x430034 MoveFileW
0x430038 GetFileType
0x43003c GetStdHandle
0x430040 WriteFile
0x430044 ReadFile
0x430048 FlushFileBuffers
0x43004c SetEndOfFile
0x430050 SetFilePointer
0x430054 SetFileAttributesW
0x430058 GetFileAttributesW
0x43005c FindClose
0x430060 FindFirstFileW
0x430064 FindNextFileW
0x430068 GetVersionExW
0x43006c GetCurrentDirectoryW
0x430070 GetFullPathNameW
0x430074 FoldStringW
0x430078 GetModuleFileNameW
0x43007c GetModuleHandleW
0x430080 FindResourceW
0x430084 FreeLibrary
0x430088 GetProcAddress
0x43008c GetCurrentProcessId
0x430090 ExitProcess
0x430094 SetThreadExecutionState
0x430098 Sleep
0x43009c LoadLibraryW
0x4300a0 GetSystemDirectoryW
0x4300a4 CompareStringW
0x4300a8 AllocConsole
0x4300ac FreeConsole
0x4300b0 AttachConsole
0x4300b4 WriteConsoleW
0x4300b8 GetProcessAffinityMask
0x4300bc CreateThread
0x4300c0 SetThreadPriority
0x4300c4 InitializeCriticalSection
0x4300c8 EnterCriticalSection
0x4300cc LeaveCriticalSection
0x4300d0 DeleteCriticalSection
0x4300d4 SetEvent
0x4300d8 ResetEvent
0x4300dc ReleaseSemaphore
0x4300e0 WaitForSingleObject
0x4300e4 CreateEventW
0x4300e8 CreateSemaphoreW
0x4300ec GetSystemTime
0x4300f0 SystemTimeToTzSpecificLocalTime
0x4300f4 TzSpecificLocalTimeToSystemTime
0x4300f8 SystemTimeToFileTime
0x4300fc FileTimeToLocalFileTime
0x430100 LocalFileTimeToFileTime
0x430104 FileTimeToSystemTime
0x430108 GetCPInfo
0x43010c IsDBCSLeadByte
0x430110 MultiByteToWideChar
0x430114 WideCharToMultiByte
0x430118 GlobalAlloc
0x43011c GetTickCount
0x430120 LockResource
0x430124 GlobalLock
0x430128 GlobalUnlock
0x43012c GlobalFree
0x430130 LoadResource
0x430134 SizeofResource
0x430138 SetCurrentDirectoryW
0x43013c GetExitCodeProcess
0x430140 GetLocalTime
0x430144 MapViewOfFile
0x430148 UnmapViewOfFile
0x43014c CreateFileMappingW
0x430150 OpenFileMappingW
0x430154 GetCommandLineW
0x430158 SetEnvironmentVariableW
0x43015c ExpandEnvironmentStringsW
0x430160 GetTempPathW
0x430164 MoveFileExW
0x430168 GetLocaleInfoW
0x43016c GetTimeFormatW
0x430170 GetDateFormatW
0x430174 GetNumberFormatW
0x430178 SetFilePointerEx
0x43017c GetConsoleMode
0x430180 GetConsoleCP
0x430184 HeapSize
0x430188 SetStdHandle
0x43018c GetProcessHeap
0x430190 RaiseException
0x430194 GetSystemInfo
0x430198 VirtualProtect
0x43019c VirtualQuery
0x4301a0 LoadLibraryExA
0x4301a4 IsProcessorFeaturePresent
0x4301a8 IsDebuggerPresent
0x4301ac UnhandledExceptionFilter
0x4301b0 SetUnhandledExceptionFilter
0x4301b4 GetStartupInfoW
0x4301b8 QueryPerformanceCounter
0x4301bc GetCurrentThreadId
0x4301c0 GetSystemTimeAsFileTime
0x4301c4 InitializeSListHead
0x4301c8 TerminateProcess
0x4301cc RtlUnwind
0x4301d0 EncodePointer
0x4301d4 InitializeCriticalSectionAndSpinCount
0x4301d8 TlsAlloc
0x4301dc TlsGetValue
0x4301e0 TlsSetValue
0x4301e4 TlsFree
0x4301e8 LoadLibraryExW
0x4301ec QueryPerformanceFrequency
0x4301f0 GetModuleHandleExW
0x4301f4 GetModuleFileNameA
0x4301f8 GetACP
0x4301fc HeapFree
0x430200 HeapAlloc
0x430204 HeapReAlloc
0x430208 GetStringTypeW
0x43020c LCMapStringW
0x430210 FindFirstFileExA
0x430214 FindNextFileA
0x430218 IsValidCodePage
0x43021c GetOEMCP
0x430220 GetCommandLineA
0x430224 GetEnvironmentStringsW
0x430228 FreeEnvironmentStringsW
0x43022c DecodePointer
gdiplus.dll
0x430234 GdiplusShutdown
0x430238 GdiplusStartup
0x43023c GdipCreateHBITMAPFromBitmap
0x430240 GdipCreateBitmapFromStreamICM
0x430244 GdipCreateBitmapFromStream
0x430248 GdipDisposeImage
0x43024c GdipCloneImage
0x430250 GdipFree
0x430254 GdipAlloc
EAT(Export Address Table) Library