ScreenShot
| Created | 2023.03.07 07:47 | Machine | s1_win7_x6401 |
| Filename | 1234321.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 43 detected (Rasftuby, unsafe, Save, malicious, confidence, 100%, high confidence, Kryptik, HSQQ, score, Generic ML PUA, Inject4, REDLINE, YXDCFZ, Static AI, Suspicious SFX, XPACK, Gen3, RDAK, Detected, Artemis, ai score=89, BScope, PasswordStealer, eBzAvx40xUE, HSIR, ZexaF, vzY@aWziI4li) | ||
| md5 | 526e66348d684c4f6cbf2b5c7defe69a | ||
| sha256 | 2d9faf2c0c9c2c9b8abf6608cf7966b515ac9c4856f7b9dee69318b0d06a9f1d | ||
| ssdeep | 12288:PgZXEAO/BUdG3gVdt7K7WX+t4bJYMrsL/9FAhzrhqK8vzS6:PgZXoZUTVdt7K7UbJYMIjLAdrh76 | ||
| imphash | aac51396886833dc961fcd7aab7711e4 | ||
| impfuzzy | 48:J9jOXRgLy1XFjsX1Pfc++6W31YpZBtDXtuniLFH:JdcgLy1XFgX1Pfc++VG7BtDXtuniLFH | ||
Network IP location
Signature (27cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 43 AntiVirus engines on VirusTotal as malicious |
| danger | Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | Executed a process and injected code into it |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | One or more of the buffers contains an embedded PE file |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates (office) documents on the filesystem |
| notice | Creates executable files on the filesystem |
| notice | Creates hidden or system file |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | One or more potentially interesting buffers were extracted |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (44cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | RedLine_Stealer_m_Zero | RedLine stealer | memory |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | memory |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| watch | Win32_WinRAR_SFX_Zero | Win32 WinRAR SFX | binaries (upload) |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | docx | Word 2007 file format detection | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x434000 GetLastError
0x434004 SetLastError
0x434008 FormatMessageW
0x43400c GetCurrentProcess
0x434010 DeviceIoControl
0x434014 SetFileTime
0x434018 CloseHandle
0x43401c CreateDirectoryW
0x434020 RemoveDirectoryW
0x434024 CreateFileW
0x434028 DeleteFileW
0x43402c CreateHardLinkW
0x434030 GetShortPathNameW
0x434034 GetLongPathNameW
0x434038 MoveFileW
0x43403c GetFileType
0x434040 GetStdHandle
0x434044 WriteFile
0x434048 ReadFile
0x43404c FlushFileBuffers
0x434050 SetEndOfFile
0x434054 SetFilePointer
0x434058 GetCurrentProcessId
0x43405c SetFileAttributesW
0x434060 GetFileAttributesW
0x434064 FindClose
0x434068 FindFirstFileW
0x43406c FindNextFileW
0x434070 InterlockedDecrement
0x434074 GetVersionExW
0x434078 GetCurrentDirectoryW
0x43407c GetFullPathNameW
0x434080 FoldStringW
0x434084 GetModuleFileNameW
0x434088 GetModuleHandleW
0x43408c FindResourceW
0x434090 FreeLibrary
0x434094 GetProcAddress
0x434098 ExitProcess
0x43409c SetThreadExecutionState
0x4340a0 Sleep
0x4340a4 LoadLibraryW
0x4340a8 GetSystemDirectoryW
0x4340ac CompareStringW
0x4340b0 AllocConsole
0x4340b4 FreeConsole
0x4340b8 AttachConsole
0x4340bc WriteConsoleW
0x4340c0 GetProcessAffinityMask
0x4340c4 CreateThread
0x4340c8 SetThreadPriority
0x4340cc InitializeCriticalSection
0x4340d0 EnterCriticalSection
0x4340d4 LeaveCriticalSection
0x4340d8 DeleteCriticalSection
0x4340dc SetEvent
0x4340e0 ResetEvent
0x4340e4 ReleaseSemaphore
0x4340e8 WaitForSingleObject
0x4340ec CreateEventW
0x4340f0 CreateSemaphoreW
0x4340f4 GetSystemTime
0x4340f8 SystemTimeToTzSpecificLocalTime
0x4340fc TzSpecificLocalTimeToSystemTime
0x434100 SystemTimeToFileTime
0x434104 FileTimeToLocalFileTime
0x434108 LocalFileTimeToFileTime
0x43410c FileTimeToSystemTime
0x434110 GetCPInfo
0x434114 IsDBCSLeadByte
0x434118 MultiByteToWideChar
0x43411c WideCharToMultiByte
0x434120 GlobalAlloc
0x434124 LockResource
0x434128 GlobalLock
0x43412c GlobalUnlock
0x434130 GlobalFree
0x434134 LoadResource
0x434138 SizeofResource
0x43413c SetCurrentDirectoryW
0x434140 GetTimeFormatW
0x434144 GetDateFormatW
0x434148 GetExitCodeProcess
0x43414c GetLocalTime
0x434150 GetTickCount
0x434154 MapViewOfFile
0x434158 UnmapViewOfFile
0x43415c CreateFileMappingW
0x434160 OpenFileMappingW
0x434164 GetCommandLineW
0x434168 SetEnvironmentVariableW
0x43416c ExpandEnvironmentStringsW
0x434170 GetTempPathW
0x434174 MoveFileExW
0x434178 GetLocaleInfoW
0x43417c GetNumberFormatW
0x434180 DecodePointer
0x434184 SetFilePointerEx
0x434188 GetConsoleMode
0x43418c GetConsoleCP
0x434190 HeapSize
0x434194 SetStdHandle
0x434198 GetProcessHeap
0x43419c FreeEnvironmentStringsW
0x4341a0 GetEnvironmentStringsW
0x4341a4 GetCommandLineA
0x4341a8 GetOEMCP
0x4341ac RaiseException
0x4341b0 GetSystemInfo
0x4341b4 VirtualProtect
0x4341b8 VirtualQuery
0x4341bc LoadLibraryExA
0x4341c0 IsProcessorFeaturePresent
0x4341c4 IsDebuggerPresent
0x4341c8 UnhandledExceptionFilter
0x4341cc SetUnhandledExceptionFilter
0x4341d0 GetStartupInfoW
0x4341d4 QueryPerformanceCounter
0x4341d8 GetCurrentThreadId
0x4341dc GetSystemTimeAsFileTime
0x4341e0 InitializeSListHead
0x4341e4 TerminateProcess
0x4341e8 LocalFree
0x4341ec RtlUnwind
0x4341f0 EncodePointer
0x4341f4 InitializeCriticalSectionAndSpinCount
0x4341f8 TlsAlloc
0x4341fc TlsGetValue
0x434200 TlsSetValue
0x434204 TlsFree
0x434208 LoadLibraryExW
0x43420c QueryPerformanceFrequency
0x434210 GetModuleHandleExW
0x434214 GetModuleFileNameA
0x434218 GetACP
0x43421c HeapFree
0x434220 HeapReAlloc
0x434224 HeapAlloc
0x434228 GetStringTypeW
0x43422c LCMapStringW
0x434230 FindFirstFileExA
0x434234 FindNextFileA
0x434238 IsValidCodePage
OLEAUT32.dll
0x434240 SysAllocString
0x434244 SysFreeString
0x434248 VariantClear
gdiplus.dll
0x434250 GdipAlloc
0x434254 GdipDisposeImage
0x434258 GdipCloneImage
0x43425c GdipCreateBitmapFromStream
0x434260 GdipCreateBitmapFromStreamICM
0x434264 GdipCreateHBITMAPFromBitmap
0x434268 GdiplusStartup
0x43426c GdiplusShutdown
0x434270 GdipFree
EAT(Export Address Table) Library
KERNEL32.dll
0x434000 GetLastError
0x434004 SetLastError
0x434008 FormatMessageW
0x43400c GetCurrentProcess
0x434010 DeviceIoControl
0x434014 SetFileTime
0x434018 CloseHandle
0x43401c CreateDirectoryW
0x434020 RemoveDirectoryW
0x434024 CreateFileW
0x434028 DeleteFileW
0x43402c CreateHardLinkW
0x434030 GetShortPathNameW
0x434034 GetLongPathNameW
0x434038 MoveFileW
0x43403c GetFileType
0x434040 GetStdHandle
0x434044 WriteFile
0x434048 ReadFile
0x43404c FlushFileBuffers
0x434050 SetEndOfFile
0x434054 SetFilePointer
0x434058 GetCurrentProcessId
0x43405c SetFileAttributesW
0x434060 GetFileAttributesW
0x434064 FindClose
0x434068 FindFirstFileW
0x43406c FindNextFileW
0x434070 InterlockedDecrement
0x434074 GetVersionExW
0x434078 GetCurrentDirectoryW
0x43407c GetFullPathNameW
0x434080 FoldStringW
0x434084 GetModuleFileNameW
0x434088 GetModuleHandleW
0x43408c FindResourceW
0x434090 FreeLibrary
0x434094 GetProcAddress
0x434098 ExitProcess
0x43409c SetThreadExecutionState
0x4340a0 Sleep
0x4340a4 LoadLibraryW
0x4340a8 GetSystemDirectoryW
0x4340ac CompareStringW
0x4340b0 AllocConsole
0x4340b4 FreeConsole
0x4340b8 AttachConsole
0x4340bc WriteConsoleW
0x4340c0 GetProcessAffinityMask
0x4340c4 CreateThread
0x4340c8 SetThreadPriority
0x4340cc InitializeCriticalSection
0x4340d0 EnterCriticalSection
0x4340d4 LeaveCriticalSection
0x4340d8 DeleteCriticalSection
0x4340dc SetEvent
0x4340e0 ResetEvent
0x4340e4 ReleaseSemaphore
0x4340e8 WaitForSingleObject
0x4340ec CreateEventW
0x4340f0 CreateSemaphoreW
0x4340f4 GetSystemTime
0x4340f8 SystemTimeToTzSpecificLocalTime
0x4340fc TzSpecificLocalTimeToSystemTime
0x434100 SystemTimeToFileTime
0x434104 FileTimeToLocalFileTime
0x434108 LocalFileTimeToFileTime
0x43410c FileTimeToSystemTime
0x434110 GetCPInfo
0x434114 IsDBCSLeadByte
0x434118 MultiByteToWideChar
0x43411c WideCharToMultiByte
0x434120 GlobalAlloc
0x434124 LockResource
0x434128 GlobalLock
0x43412c GlobalUnlock
0x434130 GlobalFree
0x434134 LoadResource
0x434138 SizeofResource
0x43413c SetCurrentDirectoryW
0x434140 GetTimeFormatW
0x434144 GetDateFormatW
0x434148 GetExitCodeProcess
0x43414c GetLocalTime
0x434150 GetTickCount
0x434154 MapViewOfFile
0x434158 UnmapViewOfFile
0x43415c CreateFileMappingW
0x434160 OpenFileMappingW
0x434164 GetCommandLineW
0x434168 SetEnvironmentVariableW
0x43416c ExpandEnvironmentStringsW
0x434170 GetTempPathW
0x434174 MoveFileExW
0x434178 GetLocaleInfoW
0x43417c GetNumberFormatW
0x434180 DecodePointer
0x434184 SetFilePointerEx
0x434188 GetConsoleMode
0x43418c GetConsoleCP
0x434190 HeapSize
0x434194 SetStdHandle
0x434198 GetProcessHeap
0x43419c FreeEnvironmentStringsW
0x4341a0 GetEnvironmentStringsW
0x4341a4 GetCommandLineA
0x4341a8 GetOEMCP
0x4341ac RaiseException
0x4341b0 GetSystemInfo
0x4341b4 VirtualProtect
0x4341b8 VirtualQuery
0x4341bc LoadLibraryExA
0x4341c0 IsProcessorFeaturePresent
0x4341c4 IsDebuggerPresent
0x4341c8 UnhandledExceptionFilter
0x4341cc SetUnhandledExceptionFilter
0x4341d0 GetStartupInfoW
0x4341d4 QueryPerformanceCounter
0x4341d8 GetCurrentThreadId
0x4341dc GetSystemTimeAsFileTime
0x4341e0 InitializeSListHead
0x4341e4 TerminateProcess
0x4341e8 LocalFree
0x4341ec RtlUnwind
0x4341f0 EncodePointer
0x4341f4 InitializeCriticalSectionAndSpinCount
0x4341f8 TlsAlloc
0x4341fc TlsGetValue
0x434200 TlsSetValue
0x434204 TlsFree
0x434208 LoadLibraryExW
0x43420c QueryPerformanceFrequency
0x434210 GetModuleHandleExW
0x434214 GetModuleFileNameA
0x434218 GetACP
0x43421c HeapFree
0x434220 HeapReAlloc
0x434224 HeapAlloc
0x434228 GetStringTypeW
0x43422c LCMapStringW
0x434230 FindFirstFileExA
0x434234 FindNextFileA
0x434238 IsValidCodePage
OLEAUT32.dll
0x434240 SysAllocString
0x434244 SysFreeString
0x434248 VariantClear
gdiplus.dll
0x434250 GdipAlloc
0x434254 GdipDisposeImage
0x434258 GdipCloneImage
0x43425c GdipCreateBitmapFromStream
0x434260 GdipCreateBitmapFromStreamICM
0x434264 GdipCreateHBITMAPFromBitmap
0x434268 GdiplusStartup
0x43426c GdiplusShutdown
0x434270 GdipFree
EAT(Export Address Table) Library