popup

Report - 5_6232986114823555269.exe

RAT NSIS Generic Malware UPX Malicious Library AntiDebug AntiVM PE32 PE File PNG Format MSOffice File .NET DLL DLL .NET EXE JPEG Format
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.05.06 12:12 Machine s1_win7_x6403
Filename 5_6232986114823555269.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
AI Score
3
 Behavior Score
12.8
ZERO API file : malware
VT API (file) 42 detected (AIDetectMalware, Sysn, malicious, moderate confidence, Killer, GenericKD, V99u, grayware, confidence, 100%, JIYK, score, jvxcsp, lloja, high, Shelm, Sabsik, Detected, Artemis, ai score=85, unsafe, Chgt, R002H09E323, LuckyWheel, CLASSIC, PossibleThreat)
md5 454de28853ea54861c14acf6b2520bab
sha256 bb5d251130efb47c960fa6b622a603ed4c53e91494f8ebaceefcd65899b02d6a
ssdeep 6144:L8dNXSEm8t107G59ZLNokDCW4KwNLl4fn6wRPFDdL6qnoz1+vv8UoGfaD2H:gmU107GVWWCNPLl3Muq++HFomaD2H
imphash e160ef8e55bb9d162da4e266afd9eef3
impfuzzy 48:3Nz5WHtyOIDrQlSv5L8r+tAlt8tz4eObGLl4x0Q7XEFpV74dT+5EQX/1Eowhy6Ub:3Nz52MtDrpJTc/6aj0
  Network IP location

Signature (28cnts)

Level Description
danger File has been identified by 42 AntiVirus engines on VirusTotal as malicious
warning Disables Windows Security features
watch Attempts to create or modify system certificates
watch Attempts to modify browser security settings
watch Attempts to modify UAC prompt behavior
watch Communicates with host for which no DNS query was performed
watch Disables proxy possibly for traffic interception
watch Installs itself for autorun at Windows startup
watch Network activity contains more than one unique useragent
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Sends data using the HTTP POST Method
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Uses Windows APIs to generate a cryptographic key

Rules (24cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning NSIS_Installer Null Soft Installer binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info Is_DotNET_DLL (no description) binaries (download)
info Is_DotNET_EXE (no description) binaries (download)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info JPEG_Format_Zero JPEG Format binaries (download)
info Microsoft_Office_File_Zero Microsoft Office File binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info PNG_Format_Zero PNG Format binaries (download)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info Win_Backdoor_AsyncRAT_Zero Win Backdoor AsyncRAT binaries (download)

Network (9cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://www.google.com/
whois
US GOOGLE 172.217.25.164 clean
https://luckywheels-v2.onrender.com/api/getDetails
whois
US RENDER 216.24.57.3 clean
https://luckywheels-v2.onrender.com/api/installedreports
whois
US RENDER 216.24.57.3 clean
luckywheels-v2.onrender.com
whois
US RENDER 216.24.57.3 clean
zwoops.com
whois
CA GTCOMM 72.10.175.208 clean
www.google.com
whois
US GOOGLE 172.217.25.164 clean
142.250.204.68
whois
US GOOGLE 142.250.204.68 clean
216.24.57.3
whois
US RENDER 216.24.57.3 phishing
72.10.175.208
whois
CA GTCOMM 72.10.175.208 malware

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x407060 GetTickCount
 0x407064 GetFullPathNameA
 0x407068 MoveFileA
 0x40706c SetCurrentDirectoryA
 0x407070 GetFileAttributesA
 0x407074 GetLastError
 0x407078 CreateDirectoryA
 0x40707c SetFileAttributesA
 0x407080 SearchPathA
 0x407084 GetShortPathNameA
 0x407088 GetFileSize
 0x40708c GetModuleFileNameA
 0x407090 GetCurrentProcess
 0x407094 CopyFileA
 0x407098 ExitProcess
 0x40709c SetEnvironmentVariableA
 0x4070a0 GetWindowsDirectoryA
 0x4070a4 GetTempPathA
 0x4070a8 Sleep
 0x4070ac CloseHandle
 0x4070b0 LoadLibraryA
 0x4070b4 lstrlenA
 0x4070b8 lstrcpynA
 0x4070bc GetDiskFreeSpaceA
 0x4070c0 GlobalUnlock
 0x4070c4 GlobalLock
 0x4070c8 CreateThread
 0x4070cc CreateProcessA
 0x4070d0 RemoveDirectoryA
 0x4070d4 CreateFileA
 0x4070d8 GetTempFileNameA
 0x4070dc ReadFile
 0x4070e0 lstrcpyA
 0x4070e4 lstrcatA
 0x4070e8 GetSystemDirectoryA
 0x4070ec GetVersion
 0x4070f0 GetProcAddress
 0x4070f4 GlobalAlloc
 0x4070f8 CompareFileTime
 0x4070fc SetFileTime
 0x407100 ExpandEnvironmentStringsA
 0x407104 lstrcmpiA
 0x407108 lstrcmpA
 0x40710c WaitForSingleObject
 0x407110 GlobalFree
 0x407114 GetExitCodeProcess
 0x407118 GetModuleHandleA
 0x40711c SetErrorMode
 0x407120 GetCommandLineA
 0x407124 LoadLibraryExA
 0x407128 FindFirstFileA
 0x40712c FindNextFileA
 0x407130 DeleteFileA
 0x407134 SetFilePointer
 0x407138 WriteFile
 0x40713c FindClose
 0x407140 WritePrivateProfileStringA
 0x407144 MultiByteToWideChar
 0x407148 MulDiv
 0x40714c GetPrivateProfileStringA
 0x407150 FreeLibrary
USER32.dll
 0x407174 CreateWindowExA
 0x407178 EndDialog
 0x40717c ScreenToClient
 0x407180 GetWindowRect
 0x407184 EnableMenuItem
 0x407188 GetSystemMenu
 0x40718c SetClassLongA
 0x407190 IsWindowEnabled
 0x407194 SetWindowPos
 0x407198 GetSysColor
 0x40719c GetWindowLongA
 0x4071a0 SetCursor
 0x4071a4 LoadCursorA
 0x4071a8 CheckDlgButton
 0x4071ac GetMessagePos
 0x4071b0 LoadBitmapA
 0x4071b4 CallWindowProcA
 0x4071b8 IsWindowVisible
 0x4071bc CloseClipboard
 0x4071c0 GetDC
 0x4071c4 SystemParametersInfoA
 0x4071c8 RegisterClassA
 0x4071cc TrackPopupMenu
 0x4071d0 AppendMenuA
 0x4071d4 CreatePopupMenu
 0x4071d8 GetSystemMetrics
 0x4071dc SetDlgItemTextA
 0x4071e0 GetDlgItemTextA
 0x4071e4 MessageBoxIndirectA
 0x4071e8 CharPrevA
 0x4071ec DispatchMessageA
 0x4071f0 PeekMessageA
 0x4071f4 ReleaseDC
 0x4071f8 EnableWindow
 0x4071fc InvalidateRect
 0x407200 SendMessageA
 0x407204 DefWindowProcA
 0x407208 BeginPaint
 0x40720c GetClientRect
 0x407210 FillRect
 0x407214 DrawTextA
 0x407218 GetClassInfoA
 0x40721c DialogBoxParamA
 0x407220 CharNextA
 0x407224 ExitWindowsEx
 0x407228 DestroyWindow
 0x40722c CreateDialogParamA
 0x407230 SetTimer
 0x407234 GetDlgItem
 0x407238 wsprintfA
 0x40723c SetForegroundWindow
 0x407240 ShowWindow
 0x407244 IsWindow
 0x407248 LoadImageA
 0x40724c SetWindowLongA
 0x407250 SetClipboardData
 0x407254 EmptyClipboard
 0x407258 OpenClipboard
 0x40725c EndPaint
 0x407260 PostQuitMessage
 0x407264 FindWindowExA
 0x407268 SendMessageTimeoutA
 0x40726c SetWindowTextA
GDI32.dll
 0x40703c SelectObject
 0x407040 SetBkMode
 0x407044 CreateFontIndirectA
 0x407048 SetTextColor
 0x40704c DeleteObject
 0x407050 GetDeviceCaps
 0x407054 CreateBrushIndirect
 0x407058 SetBkColor
SHELL32.dll
 0x407158 SHGetSpecialFolderLocation
 0x40715c SHGetPathFromIDListA
 0x407160 SHBrowseForFolderA
 0x407164 SHGetFileInfoA
 0x407168 ShellExecuteA
 0x40716c SHFileOperationA
ADVAPI32.dll
 0x407000 RegCloseKey
 0x407004 RegOpenKeyExA
 0x407008 RegDeleteKeyA
 0x40700c RegDeleteValueA
 0x407010 RegEnumValueA
 0x407014 RegCreateKeyExA
 0x407018 RegSetValueExA
 0x40701c RegQueryValueExA
 0x407020 RegEnumKeyA
COMCTL32.dll
 0x407028 ImageList_Create
 0x40702c ImageList_AddMasked
 0x407030 ImageList_Destroy
 0x407034 None
ole32.dll
 0x407284 CoCreateInstance
 0x407288 CoTaskMemFree
 0x40728c OleInitialize
 0x407290 OleUninitialize
VERSION.dll
 0x407274 GetFileVersionInfoSizeA
 0x407278 GetFileVersionInfoA
 0x40727c VerQueryValueA

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure