Report - NMemo1Setp.exe

Confuser .NET .NET EXE PE32 PE File
ScreenShot
Created 2023.03.22 10:36 Machine s1_win7_x6401
Filename NMemo1Setp.exe
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
10
Behavior Score
3.8
ZERO API file : malware
VT API (file) 59 detected (AIDetectNet, malicious, high confidence, GenericKD, Unsafe, Save, AgentTesla, Kryptik, Eldorado, Attribute, HighConfidence, GenKryptik, EWGN, score, Clipbanker, PWSX, MSIL@AI, MSIL2, Klwrq0x5fbPy9CCGw6I1Vw, Generic ML PUA, AGEN, Siggen14, R06EC0DAB23, high, Static AI, Malicious PE, ai score=87, KVMH008, kcloud, Malware@#2xosua0q0b3ex, Detected, R428560, FCSR, HeapOverride, Probably Heur, ExeHeaderL, JgXbcCpuZUE, susgen, ZemsilF, ku0@aO1u9qn, GdSda, confidence, 100%)
md5 f12aa4983f77ed85b3a618f7656807c2
sha256 5db1d9e50f0e0e0ba0b15920e65a1b9e3b61bcc03d5930870e0b226b600a72e2
ssdeep 3072:vuosgt5uZEnV79k7oPmfY44cQM2qGUhm:2orQEnV+oqxQTxU
imphash f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy 3:rGsLdAIEK:tf
  Network IP location

Signature (9cnts)

Level Description
danger File has been identified by 59 AntiVirus engines on VirusTotal as malicious
watch Appends a known CryptoMix ransomware file extension to files that have been encrypted
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (4cnts)

Level Name Description Collection
watch ConfuserEx_Zero Confuser .NET binaries (upload)
info Is_DotNET_EXE (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
videoconvert-download38.xyz Unknown mailcious
iplogger.org DE Hetzner Online GmbH 148.251.234.83 mailcious
148.251.234.83 DE Hetzner Online GmbH 148.251.234.83 clean

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x432000 _CorExeMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure