Report - NMemo1Setp.exe

Confuser .NET PE32 .NET EXE PE File
ScreenShot
Created 2023.01.11 07:50 Machine s1_win7_x6401
Filename NMemo1Setp.exe
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
10
Behavior Score
4.6
ZERO API file : malware
VT API (file) 55 detected (AIDetectNet, GenericKD, Unsafe, GenKryptik, EWGN, AgentTesla, malicious, Kryptik, Eldorado, Attribute, HighConfidence, high confidence, Clipbanker, PWSX, Malware@#2xosua0q0b3ex, Siggen14, R002C0DD622, Static AI, Malicious PE, AGEN, KVMH008, kcloud, score, R428560, FCSR, ai score=87, HeapOverride, PasswordStealer, Probably Heur, ExeHeaderL, JgXbcCpuZUE, susgen, ZemsilF, ku0@aO1u9qn, GdSda, confidence, 100%)
md5 f12aa4983f77ed85b3a618f7656807c2
sha256 5db1d9e50f0e0e0ba0b15920e65a1b9e3b61bcc03d5930870e0b226b600a72e2
ssdeep 3072:vuosgt5uZEnV79k7oPmfY44cQM2qGUhm:2orQEnV+oqxQTxU
imphash f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy 3:rGsLdAIEK:tf
  Network IP location

Signature (10cnts)

Level Description
danger File has been identified by 55 AntiVirus engines on VirusTotal as malicious
warning Generates some ICMP traffic
watch Appends a known CryptoMix ransomware file extension to files that have been encrypted
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (4cnts)

Level Name Description Collection
watch ConfuserEx_Zero Confuser .NET binaries (upload)
info Is_DotNET_EXE (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
videoconvert-download38.xyz Unknown mailcious
iplogger.org DE Hetzner Online GmbH 148.251.234.83 mailcious
148.251.234.83 DE Hetzner Online GmbH 148.251.234.83 clean

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x432000 _CorExeMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure