popup

Report - saiwer.exe

PWS Loki[b] Loki.m RAT .NET framework Gen2 Trojan_PWS_Stealer Generic Malware Credential User Data Malicious Library Malicious Packer UPX Anti_VM SQLite Cookie AntiDebug AntiVM PE32 OS Processor Check PE File DLL .NET EXE PNG Format JPEG Format
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2022.12.08 10:57 Machine s1_win7_x6403
Filename saiwer.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
 Behavior Score
18.8
ZERO API file : malware
VT API (file) 43 detected (AIDetect, malware2, Deyma, malicious, high confidence, score, Artemis, Unsafe, Lazy, Save, Amadey, confidence, 100%, Eldorado, Attribute, HighConfidence, BotX, Horst, Static AI, Malicious PE, kcloud, Detected, ZexaF, puW@amB2DIoi, ai score=84, R002C0RL722, Generic@AI, RDML, mMTw7NwLuqPivtIFNn7ejQ, susgen, EGTS, Genetic)
md5 369321f33d5ffaeeadb4da9f33c78156
sha256 5c5db333e1a7ce5e55ffa3aca2858d8e431e6e1fc0dae0ca508c6081819828dd
ssdeep 6144:nlvsfCqKGsJzgVvk/JUfL6pWnqujpiBLI89Xu:lkKpJI6pFujpiVFu
imphash 857774b8dd5bc6abe25ef09f890c7f72
impfuzzy 48:4NGXVbLJGGOBtdS1CM2c+ppZccgTg3ISF57fwSqzNW/uPg:hXVMGAtdS1CM2c+ppZct+D+OSg
  Network IP location

Signature (43cnts)

Level Description
danger File has been identified by 43 AntiVirus engines on VirusTotal as malicious
watch A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations.
watch Attempts to create or modify system certificates
watch Attempts to identify installed AV products by installation directory
watch Collects information about installed applications
watch Communicates with host for which no DNS query was performed
watch Harvests credentials from local email clients
watch Harvests credentials from local FTP client softwares
watch Harvests information related to installed instant messenger clients
watch Installs itself for autorun at Windows startup
watch Network activity contains more than one unique useragent
watch One or more non-whitelisted processes were created
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Uses suspicious command line tools or Windows utilities
notice A process attempted to delay the analysis task.
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice An executable file was downloaded by the process gntuud.exe
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice Executes one or more WMI queries
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Sends data using the HTTP POST Method
notice Steals private information from local Internet browsers
notice Terminates another process
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info Command line console output was observed
info One or more processes crashed
info Queries for the computername
info This executable has a PDB path
info Tries to locate where the browsers are installed
info Uses Windows APIs to generate a cryptographic key

Rules (33cnts)

Level Name Description Collection
danger Trojan_PWS_Stealer_1_Zero Trojan.PWS.Stealer Zero binaries (download)
danger Win32_PWS_Loki_Zero Win32 PWS Loki binaries (download)
warning Credential_User_Data_Check_Zero Credential User Data Check binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch SQLite_cookies_Check_Zero SQLite Cookie Check... select binaries (download)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
watch Win32_Trojan_PWS_Net_1_Zero Win32 Trojan PWS .NET Azorult binaries (download)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (download)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info Is_DotNET_EXE (no description) binaries (download)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info JPEG_Format_Zero JPEG Format binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info PNG_Format_Zero PNG Format binaries (download)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info Win32_Trojan_Gen_2_0904B0_Zero Win32 Trojan Gen binaries (download)
info Win_Backdoor_AsyncRAT_Zero Win Backdoor AsyncRAT binaries (download)

Network (29cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://31.41.244.237/jg94cVd30f/index.php?scr=1
whois
RU LLC Aeroexpress 31.41.244.237 clean
http://www.aculpainting.com/mp3studios97/mp3studios_97.exe
whois
US NETINF-PRIMARY-AS 23.160.193.16 clean
http://31.41.244.237/jg94cVd30f/index.php
whois
RU LLC Aeroexpress 31.41.244.237 clean
http://31.41.244.253/new/linda5.exe
whois
RU LLC Aeroexpress 31.41.244.253 malware
http://62.204.41.6/p9cWxH/Plugins/cred64.dll
whois
Unknown 62.204.41.6 25001 malware
http://www.aculpainting.com/mp3studios_97.exe
whois
US NETINF-PRIMARY-AS 23.160.193.16 malware
http://62.204.41.6/p9cWxH/index.php
whois
Unknown 62.204.41.6 24996 mailcious
http://31.41.244.237/jg94cVd30f/Plugins/cred64.dll
whois
RU LLC Aeroexpress 31.41.244.237 clean
http://31.41.244.253/miha/wish.exe
whois
RU LLC Aeroexpress 31.41.244.253 malware
http://62.204.41.6/p9cWxH/index.php?scr=1
whois
Unknown 62.204.41.6 24996 mailcious
http://31.41.244.253/goga/nash.exe
whois
RU LLC Aeroexpress 31.41.244.253 clean
http://31.41.244.188/ano/anon.exe
whois
RU LLC Aeroexpress 31.41.244.188 25005 malware
http://transfer.sh/get/gI6LT0/loader.exe
whois
DE Hetzner Online GmbH 144.76.136.153 clean
http://62.204.41.6/newlege.exe
whois
Unknown 62.204.41.6 malware
https://www.icodeps.com/
whois
US AS-CHOOPA 149.28.253.196 14280 mailcious
iplogger.org
whois
DE Hetzner Online GmbH 148.251.234.83 mailcious
transfer.sh
whois
DE Hetzner Online GmbH 144.76.136.153 malware
www.icodeps.com
whois
US AS-CHOOPA 149.28.253.196 mailcious
www.aculpainting.com
whois
US NETINF-PRIMARY-AS 23.160.193.16 malware
148.251.234.83
whois
DE Hetzner Online GmbH 148.251.234.83 clean
185.106.92.214
whois
RU NTX Technologies s.r.o. 185.106.92.214 mailcious
31.41.244.253
whois
RU LLC Aeroexpress 31.41.244.253 malware
149.28.253.196
whois
US AS-CHOOPA 149.28.253.196 mailcious
31.41.244.237
whois
RU LLC Aeroexpress 31.41.244.237 malware
144.76.136.153
whois
DE Hetzner Online GmbH 144.76.136.153 mailcious
31.41.244.14
whois
RU LLC Aeroexpress 31.41.244.14 mailcious
62.204.41.6
whois
Unknown 62.204.41.6 malware
31.41.244.188
whois
RU LLC Aeroexpress 31.41.244.188 malware
23.160.193.16
whois
US NETINF-PRIMARY-AS 23.160.193.16 malware

Suricata ids

ET MALWARE Amadey CnC Check-In
ET INFO Executable Download from dotted-quad Host
ET POLICY PE EXE or DLL Windows file download HTTP
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET DROP Dshield Block Listed Source group 1
ET MALWARE Possible Kelihos.F EXE Download Common Structure
ET POLICY IP Check Domain (iplogger .org in DNS Lookup)
ET POLICY IP Check Domain (iplogger .org in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh)
ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup)
ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)
ET INFO Dotted Quad Host DLL Request
ET INFO TLS Handshake Failure

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x42f040 CopyFileA
 0x42f044 GetLastError
 0x42f048 GetFileAttributesA
 0x42f04c CreateFileA
 0x42f050 CloseHandle
 0x42f054 GetSystemInfo
 0x42f058 CreateThread
 0x42f05c HeapAlloc
 0x42f060 GetThreadContext
 0x42f064 GetProcAddress
 0x42f068 VirtualAllocEx
 0x42f06c GetTempPathA
 0x42f070 RemoveDirectoryA
 0x42f074 ReadProcessMemory
 0x42f078 GetProcessHeap
 0x42f07c CreateProcessA
 0x42f080 CreateDirectoryA
 0x42f084 SetThreadContext
 0x42f088 WriteConsoleW
 0x42f08c ReadConsoleW
 0x42f090 SetEndOfFile
 0x42f094 HeapReAlloc
 0x42f098 HeapSize
 0x42f09c Sleep
 0x42f0a0 SetCurrentDirectoryA
 0x42f0a4 GetModuleHandleA
 0x42f0a8 ResumeThread
 0x42f0ac SuspendThread
 0x42f0b0 GetComputerNameExW
 0x42f0b4 GetVersionExW
 0x42f0b8 CreateMutexW
 0x42f0bc VirtualAlloc
 0x42f0c0 WriteFile
 0x42f0c4 VirtualFree
 0x42f0c8 HeapFree
 0x42f0cc WriteProcessMemory
 0x42f0d0 GetModuleFileNameA
 0x42f0d4 LocalFree
 0x42f0d8 ReadFile
 0x42f0dc SetFilePointerEx
 0x42f0e0 GetTimeZoneInformation
 0x42f0e4 GetConsoleMode
 0x42f0e8 GetConsoleCP
 0x42f0ec FlushFileBuffers
 0x42f0f0 GetStringTypeW
 0x42f0f4 SetEnvironmentVariableW
 0x42f0f8 FreeEnvironmentStringsW
 0x42f0fc GetEnvironmentStringsW
 0x42f100 WideCharToMultiByte
 0x42f104 GetCPInfo
 0x42f108 GetOEMCP
 0x42f10c GetACP
 0x42f110 IsValidCodePage
 0x42f114 FindNextFileW
 0x42f118 FindFirstFileExW
 0x42f11c FindClose
 0x42f120 SetStdHandle
 0x42f124 GetFullPathNameW
 0x42f128 GetCurrentDirectoryW
 0x42f12c DeleteFileW
 0x42f130 DecodePointer
 0x42f134 UnhandledExceptionFilter
 0x42f138 SetUnhandledExceptionFilter
 0x42f13c GetCurrentProcess
 0x42f140 TerminateProcess
 0x42f144 IsProcessorFeaturePresent
 0x42f148 IsDebuggerPresent
 0x42f14c GetStartupInfoW
 0x42f150 GetModuleHandleW
 0x42f154 QueryPerformanceCounter
 0x42f158 GetCurrentProcessId
 0x42f15c GetCurrentThreadId
 0x42f160 GetSystemTimeAsFileTime
 0x42f164 InitializeSListHead
 0x42f168 RtlUnwind
 0x42f16c RaiseException
 0x42f170 SetLastError
 0x42f174 EncodePointer
 0x42f178 EnterCriticalSection
 0x42f17c LeaveCriticalSection
 0x42f180 DeleteCriticalSection
 0x42f184 InitializeCriticalSectionAndSpinCount
 0x42f188 TlsAlloc
 0x42f18c TlsGetValue
 0x42f190 TlsSetValue
 0x42f194 TlsFree
 0x42f198 FreeLibrary
 0x42f19c LoadLibraryExW
 0x42f1a0 ExitProcess
 0x42f1a4 GetModuleHandleExW
 0x42f1a8 CreateFileW
 0x42f1ac GetDriveTypeW
 0x42f1b0 GetFileInformationByHandle
 0x42f1b4 GetFileType
 0x42f1b8 PeekNamedPipe
 0x42f1bc SystemTimeToTzSpecificLocalTime
 0x42f1c0 FileTimeToSystemTime
 0x42f1c4 GetModuleFileNameW
 0x42f1c8 GetStdHandle
 0x42f1cc GetCommandLineA
 0x42f1d0 GetCommandLineW
 0x42f1d4 MultiByteToWideChar
 0x42f1d8 CompareStringW
 0x42f1dc LCMapStringW
USER32.dll
 0x42f1f4 GetSystemMetrics
 0x42f1f8 ReleaseDC
 0x42f1fc GetDC
GDI32.dll
 0x42f028 CreateCompatibleBitmap
 0x42f02c SelectObject
 0x42f030 CreateCompatibleDC
 0x42f034 DeleteObject
 0x42f038 BitBlt
ADVAPI32.dll
 0x42f000 RegCloseKey
 0x42f004 RegGetValueA
 0x42f008 RegQueryValueExA
 0x42f00c GetUserNameA
 0x42f010 RegSetValueExA
 0x42f014 RegOpenKeyExA
 0x42f018 ConvertSidToStringSidW
 0x42f01c GetUserNameW
 0x42f020 LookupAccountNameW
SHELL32.dll
 0x42f1e4 ShellExecuteA
 0x42f1e8 None
 0x42f1ec SHGetFolderPathA
WININET.dll
 0x42f204 HttpOpenRequestA
 0x42f208 InternetOpenUrlW
 0x42f20c InternetReadFile
 0x42f210 InternetConnectA
 0x42f214 HttpSendRequestA
 0x42f218 InternetCloseHandle
 0x42f21c InternetOpenA
 0x42f220 HttpAddRequestHeadersA
 0x42f224 HttpSendRequestExW
 0x42f228 HttpEndRequestA
 0x42f22c InternetOpenW
 0x42f230 InternetOpenUrlA
 0x42f234 InternetWriteFile
gdiplus.dll
 0x42f23c GdipSaveImageToFile
 0x42f240 GdipGetImageEncodersSize
 0x42f244 GdipDisposeImage
 0x42f248 GdipCreateBitmapFromHBITMAP
 0x42f24c GdipGetImageEncoders
 0x42f250 GdiplusShutdown
 0x42f254 GdiplusStartup

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure