ScreenShot
| Created | 2022.08.31 10:07 | Machine | s1_win7_x6401 |
| Filename | setup.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 36 detected (AIDetect, malware1, malicious, high confidence, Babar, GenericPMF, S28392069, HLPX, multiple detections, score, Fugrafa, Miner, AGEN, Generic ML PUA, Static AI, Malicious SFX, Sabsik, I7XB25, Detected, ai score=88, BScope, Wacatac, Kryptik, qFgFsCC2vGK, CoinMiner, TrojanX) | ||
| md5 | a85d7d886197d00f694f2ad8e7aa5b32 | ||
| sha256 | 80930071626aa46a7ef7ebd2b285d203ebe554ea11d0799bf0395f6cb823a00a | ||
| ssdeep | 98304:juWAuvKS7/fn+k45KJq7UX39Yn51g2MOw29TxmWZ3ElF68JlrcbYrCFmmO+:jkS7/fn25gH9oTw2RxxJElIglDrYt | ||
| imphash | b4070734502a100c8f90bbd445995533 | ||
| impfuzzy | 48:J9jOX8LKc1XFjsX1Pfc++6WQYgeBtDXMunCZFi:JdJLKc1XFgX1Pfc++VVnBtDXMun8Fi | ||
Network IP location
Signature (39cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| danger | File has been identified by 36 AntiVirus engines on VirusTotal as malicious |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Attempts to access Bitcoin/ALTCoin wallets |
| watch | Attempts to disable Windows Auto Updates |
| watch | Attempts to identify installed AV products by installation directory |
| watch | Attempts to stop active services |
| watch | Communicates with host for which no DNS query was performed |
| watch | Harvests credentials from local FTP client softwares |
| watch | Installs itself for autorun at Windows startup |
| watch | One or more of the buffers contains an embedded PE file |
| watch | Potential code injection by writing to the memory of another process |
| watch | Powershell script adds registry entries |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | The process powershell.exe wrote an executable file to disk |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| watch | Uses suspicious command line tools or Windows utilities |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | One or more potentially interesting buffers were extracted |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Steals private information from local Internet browsers |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (23cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | Win_Backdoor_AsyncRAT_Zero | Win Backdoor AsyncRAT | binaries (download) |
Suricata ids
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
ET MALWARE Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil
ET POLICY Cryptocurrency Miner Checkin
ET MALWARE Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil
ET POLICY Cryptocurrency Miner Checkin
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x433000 GetLastError
0x433004 SetLastError
0x433008 FormatMessageW
0x43300c GetCurrentProcess
0x433010 DeviceIoControl
0x433014 SetFileTime
0x433018 CloseHandle
0x43301c CreateDirectoryW
0x433020 RemoveDirectoryW
0x433024 CreateFileW
0x433028 DeleteFileW
0x43302c CreateHardLinkW
0x433030 GetShortPathNameW
0x433034 GetLongPathNameW
0x433038 MoveFileW
0x43303c GetFileType
0x433040 GetStdHandle
0x433044 WriteFile
0x433048 ReadFile
0x43304c FlushFileBuffers
0x433050 SetEndOfFile
0x433054 SetFilePointer
0x433058 SetFileAttributesW
0x43305c GetFileAttributesW
0x433060 FindClose
0x433064 FindFirstFileW
0x433068 FindNextFileW
0x43306c GetVersionExW
0x433070 GetCurrentDirectoryW
0x433074 GetFullPathNameW
0x433078 FoldStringW
0x43307c GetModuleFileNameW
0x433080 GetModuleHandleW
0x433084 FindResourceW
0x433088 FreeLibrary
0x43308c GetProcAddress
0x433090 GetCurrentProcessId
0x433094 ExitProcess
0x433098 SetThreadExecutionState
0x43309c Sleep
0x4330a0 LoadLibraryW
0x4330a4 GetSystemDirectoryW
0x4330a8 CompareStringW
0x4330ac AllocConsole
0x4330b0 FreeConsole
0x4330b4 AttachConsole
0x4330b8 WriteConsoleW
0x4330bc GetProcessAffinityMask
0x4330c0 CreateThread
0x4330c4 SetThreadPriority
0x4330c8 InitializeCriticalSection
0x4330cc EnterCriticalSection
0x4330d0 LeaveCriticalSection
0x4330d4 DeleteCriticalSection
0x4330d8 SetEvent
0x4330dc ResetEvent
0x4330e0 ReleaseSemaphore
0x4330e4 WaitForSingleObject
0x4330e8 CreateEventW
0x4330ec CreateSemaphoreW
0x4330f0 GetSystemTime
0x4330f4 SystemTimeToTzSpecificLocalTime
0x4330f8 TzSpecificLocalTimeToSystemTime
0x4330fc SystemTimeToFileTime
0x433100 FileTimeToLocalFileTime
0x433104 LocalFileTimeToFileTime
0x433108 FileTimeToSystemTime
0x43310c GetCPInfo
0x433110 IsDBCSLeadByte
0x433114 MultiByteToWideChar
0x433118 WideCharToMultiByte
0x43311c GlobalAlloc
0x433120 LockResource
0x433124 GlobalLock
0x433128 GlobalUnlock
0x43312c GlobalFree
0x433130 LoadResource
0x433134 SizeofResource
0x433138 SetCurrentDirectoryW
0x43313c GetExitCodeProcess
0x433140 GetLocalTime
0x433144 GetTickCount
0x433148 MapViewOfFile
0x43314c UnmapViewOfFile
0x433150 CreateFileMappingW
0x433154 OpenFileMappingW
0x433158 GetCommandLineW
0x43315c SetEnvironmentVariableW
0x433160 ExpandEnvironmentStringsW
0x433164 GetTempPathW
0x433168 MoveFileExW
0x43316c GetLocaleInfoW
0x433170 GetTimeFormatW
0x433174 GetDateFormatW
0x433178 GetNumberFormatW
0x43317c SetFilePointerEx
0x433180 GetConsoleMode
0x433184 GetConsoleCP
0x433188 HeapSize
0x43318c SetStdHandle
0x433190 GetProcessHeap
0x433194 FreeEnvironmentStringsW
0x433198 RaiseException
0x43319c GetSystemInfo
0x4331a0 VirtualProtect
0x4331a4 VirtualQuery
0x4331a8 LoadLibraryExA
0x4331ac IsProcessorFeaturePresent
0x4331b0 IsDebuggerPresent
0x4331b4 UnhandledExceptionFilter
0x4331b8 SetUnhandledExceptionFilter
0x4331bc GetStartupInfoW
0x4331c0 QueryPerformanceCounter
0x4331c4 GetCurrentThreadId
0x4331c8 GetSystemTimeAsFileTime
0x4331cc InitializeSListHead
0x4331d0 TerminateProcess
0x4331d4 RtlUnwind
0x4331d8 EncodePointer
0x4331dc InitializeCriticalSectionAndSpinCount
0x4331e0 TlsAlloc
0x4331e4 TlsGetValue
0x4331e8 TlsSetValue
0x4331ec TlsFree
0x4331f0 LoadLibraryExW
0x4331f4 QueryPerformanceFrequency
0x4331f8 GetModuleHandleExW
0x4331fc GetModuleFileNameA
0x433200 GetACP
0x433204 HeapFree
0x433208 HeapAlloc
0x43320c HeapReAlloc
0x433210 GetStringTypeW
0x433214 LCMapStringW
0x433218 FindFirstFileExA
0x43321c FindNextFileA
0x433220 IsValidCodePage
0x433224 GetOEMCP
0x433228 GetCommandLineA
0x43322c GetEnvironmentStringsW
0x433230 DecodePointer
gdiplus.dll
0x433238 GdiplusStartup
0x43323c GdipCreateHBITMAPFromBitmap
0x433240 GdipCreateBitmapFromStreamICM
0x433244 GdiplusShutdown
0x433248 GdipCreateBitmapFromStream
0x43324c GdipDisposeImage
0x433250 GdipCloneImage
0x433254 GdipFree
0x433258 GdipAlloc
EAT(Export Address Table) Library
KERNEL32.dll
0x433000 GetLastError
0x433004 SetLastError
0x433008 FormatMessageW
0x43300c GetCurrentProcess
0x433010 DeviceIoControl
0x433014 SetFileTime
0x433018 CloseHandle
0x43301c CreateDirectoryW
0x433020 RemoveDirectoryW
0x433024 CreateFileW
0x433028 DeleteFileW
0x43302c CreateHardLinkW
0x433030 GetShortPathNameW
0x433034 GetLongPathNameW
0x433038 MoveFileW
0x43303c GetFileType
0x433040 GetStdHandle
0x433044 WriteFile
0x433048 ReadFile
0x43304c FlushFileBuffers
0x433050 SetEndOfFile
0x433054 SetFilePointer
0x433058 SetFileAttributesW
0x43305c GetFileAttributesW
0x433060 FindClose
0x433064 FindFirstFileW
0x433068 FindNextFileW
0x43306c GetVersionExW
0x433070 GetCurrentDirectoryW
0x433074 GetFullPathNameW
0x433078 FoldStringW
0x43307c GetModuleFileNameW
0x433080 GetModuleHandleW
0x433084 FindResourceW
0x433088 FreeLibrary
0x43308c GetProcAddress
0x433090 GetCurrentProcessId
0x433094 ExitProcess
0x433098 SetThreadExecutionState
0x43309c Sleep
0x4330a0 LoadLibraryW
0x4330a4 GetSystemDirectoryW
0x4330a8 CompareStringW
0x4330ac AllocConsole
0x4330b0 FreeConsole
0x4330b4 AttachConsole
0x4330b8 WriteConsoleW
0x4330bc GetProcessAffinityMask
0x4330c0 CreateThread
0x4330c4 SetThreadPriority
0x4330c8 InitializeCriticalSection
0x4330cc EnterCriticalSection
0x4330d0 LeaveCriticalSection
0x4330d4 DeleteCriticalSection
0x4330d8 SetEvent
0x4330dc ResetEvent
0x4330e0 ReleaseSemaphore
0x4330e4 WaitForSingleObject
0x4330e8 CreateEventW
0x4330ec CreateSemaphoreW
0x4330f0 GetSystemTime
0x4330f4 SystemTimeToTzSpecificLocalTime
0x4330f8 TzSpecificLocalTimeToSystemTime
0x4330fc SystemTimeToFileTime
0x433100 FileTimeToLocalFileTime
0x433104 LocalFileTimeToFileTime
0x433108 FileTimeToSystemTime
0x43310c GetCPInfo
0x433110 IsDBCSLeadByte
0x433114 MultiByteToWideChar
0x433118 WideCharToMultiByte
0x43311c GlobalAlloc
0x433120 LockResource
0x433124 GlobalLock
0x433128 GlobalUnlock
0x43312c GlobalFree
0x433130 LoadResource
0x433134 SizeofResource
0x433138 SetCurrentDirectoryW
0x43313c GetExitCodeProcess
0x433140 GetLocalTime
0x433144 GetTickCount
0x433148 MapViewOfFile
0x43314c UnmapViewOfFile
0x433150 CreateFileMappingW
0x433154 OpenFileMappingW
0x433158 GetCommandLineW
0x43315c SetEnvironmentVariableW
0x433160 ExpandEnvironmentStringsW
0x433164 GetTempPathW
0x433168 MoveFileExW
0x43316c GetLocaleInfoW
0x433170 GetTimeFormatW
0x433174 GetDateFormatW
0x433178 GetNumberFormatW
0x43317c SetFilePointerEx
0x433180 GetConsoleMode
0x433184 GetConsoleCP
0x433188 HeapSize
0x43318c SetStdHandle
0x433190 GetProcessHeap
0x433194 FreeEnvironmentStringsW
0x433198 RaiseException
0x43319c GetSystemInfo
0x4331a0 VirtualProtect
0x4331a4 VirtualQuery
0x4331a8 LoadLibraryExA
0x4331ac IsProcessorFeaturePresent
0x4331b0 IsDebuggerPresent
0x4331b4 UnhandledExceptionFilter
0x4331b8 SetUnhandledExceptionFilter
0x4331bc GetStartupInfoW
0x4331c0 QueryPerformanceCounter
0x4331c4 GetCurrentThreadId
0x4331c8 GetSystemTimeAsFileTime
0x4331cc InitializeSListHead
0x4331d0 TerminateProcess
0x4331d4 RtlUnwind
0x4331d8 EncodePointer
0x4331dc InitializeCriticalSectionAndSpinCount
0x4331e0 TlsAlloc
0x4331e4 TlsGetValue
0x4331e8 TlsSetValue
0x4331ec TlsFree
0x4331f0 LoadLibraryExW
0x4331f4 QueryPerformanceFrequency
0x4331f8 GetModuleHandleExW
0x4331fc GetModuleFileNameA
0x433200 GetACP
0x433204 HeapFree
0x433208 HeapAlloc
0x43320c HeapReAlloc
0x433210 GetStringTypeW
0x433214 LCMapStringW
0x433218 FindFirstFileExA
0x43321c FindNextFileA
0x433220 IsValidCodePage
0x433224 GetOEMCP
0x433228 GetCommandLineA
0x43322c GetEnvironmentStringsW
0x433230 DecodePointer
gdiplus.dll
0x433238 GdiplusStartup
0x43323c GdipCreateHBITMAPFromBitmap
0x433240 GdipCreateBitmapFromStreamICM
0x433244 GdiplusShutdown
0x433248 GdipCreateBitmapFromStream
0x43324c GdipDisposeImage
0x433250 GdipCloneImage
0x433254 GdipFree
0x433258 GdipAlloc
EAT(Export Address Table) Library