popup

Report - bluesubstantialie64.exe

Gen1 Emotet UPX Malicious Library CAB PE64 PE File .NET EXE PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.06.20 17:35 Machine s1_win7_x6402
Filename bluesubstantialie64.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score Not founds Behavior Score
4.6
ZERO API file : clean
VT API (file) 18 detected (unsafe, malicious, confidence, moderate confidence, high, score, Static AI, Malicious SFX, susgen, RATX)
md5 2bd2470d90bd8de8e260ff88a3fb181b
sha256 65918b1b4aaa0f8311e8ce96fffa7f7993537bf6132ef197ec3bb4717901198a
ssdeep 393216:Rxry/zJfUYeJIEfvx4qqWwoD/E+Bp0tQ:Rxur14JIEBJq/wh7b
imphash 4cea7ae85c87ddc7295d39ff9cda31d1
impfuzzy 48:mPkNSpUOU4iLeyMuM9QBt3S1W8KEl4LTFGACupNXR6x9pg1go5E95dSva5pUrz+L:ikmUZ4iLfMuMqBt3S1WwfSbmaeGipT
  Network IP location

Signature (13cnts)

Level Description
watch Deletes executed files from disk
watch File has been identified by 18 AntiVirus engines on VirusTotal as malicious
watch Installs itself for autorun at Windows startup
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info Queries for the computername
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (11cnts)

Level Name Description Collection
danger Win32_Trojan_Emotet_RL_Gen_Zero Win32 Trojan Emotet binaries (upload)
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info CAB_file_format CAB archive file binaries (upload)
info Is_DotNET_EXE (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

ADVAPI32.dll
 0x140009128 GetTokenInformation
 0x140009130 RegDeleteValueA
 0x140009138 RegOpenKeyExA
 0x140009140 RegQueryInfoKeyA
 0x140009148 FreeSid
 0x140009150 OpenProcessToken
 0x140009158 RegSetValueExA
 0x140009160 RegCreateKeyExA
 0x140009168 LookupPrivilegeValueA
 0x140009170 AllocateAndInitializeSid
 0x140009178 RegQueryValueExA
 0x140009180 EqualSid
 0x140009188 RegCloseKey
 0x140009190 AdjustTokenPrivileges
KERNEL32.dll
 0x1400091e8 _lopen
 0x1400091f0 _llseek
 0x1400091f8 CompareStringA
 0x140009200 GetLastError
 0x140009208 GetFileAttributesA
 0x140009210 GetSystemDirectoryA
 0x140009218 LoadLibraryA
 0x140009220 DeleteFileA
 0x140009228 GlobalAlloc
 0x140009230 GlobalFree
 0x140009238 CloseHandle
 0x140009240 WritePrivateProfileStringA
 0x140009248 IsDBCSLeadByte
 0x140009250 GetWindowsDirectoryA
 0x140009258 SetFileAttributesA
 0x140009260 GetProcAddress
 0x140009268 GlobalLock
 0x140009270 LocalFree
 0x140009278 RemoveDirectoryA
 0x140009280 FreeLibrary
 0x140009288 _lclose
 0x140009290 CreateDirectoryA
 0x140009298 GetPrivateProfileIntA
 0x1400092a0 GetPrivateProfileStringA
 0x1400092a8 GlobalUnlock
 0x1400092b0 ReadFile
 0x1400092b8 SizeofResource
 0x1400092c0 WriteFile
 0x1400092c8 GetDriveTypeA
 0x1400092d0 LoadLibraryExA
 0x1400092d8 SetFileTime
 0x1400092e0 SetFilePointer
 0x1400092e8 FindResourceA
 0x1400092f0 CreateMutexA
 0x1400092f8 GetVolumeInformationA
 0x140009300 WaitForSingleObject
 0x140009308 GetCurrentDirectoryA
 0x140009310 FreeResource
 0x140009318 GetVersion
 0x140009320 SetCurrentDirectoryA
 0x140009328 GetTempPathA
 0x140009330 LocalFileTimeToFileTime
 0x140009338 CreateFileA
 0x140009340 SetEvent
 0x140009348 TerminateThread
 0x140009350 GetVersionExA
 0x140009358 LockResource
 0x140009360 GetSystemInfo
 0x140009368 CreateThread
 0x140009370 ResetEvent
 0x140009378 LoadResource
 0x140009380 ExitProcess
 0x140009388 GetModuleHandleW
 0x140009390 CreateProcessA
 0x140009398 FormatMessageA
 0x1400093a0 GetTempFileNameA
 0x1400093a8 DosDateTimeToFileTime
 0x1400093b0 CreateEventA
 0x1400093b8 GetExitCodeProcess
 0x1400093c0 ExpandEnvironmentStringsA
 0x1400093c8 LocalAlloc
 0x1400093d0 lstrcmpA
 0x1400093d8 FindNextFileA
 0x1400093e0 GetCurrentProcess
 0x1400093e8 FindFirstFileA
 0x1400093f0 GetModuleFileNameA
 0x1400093f8 GetShortPathNameA
 0x140009400 Sleep
 0x140009408 GetStartupInfoW
 0x140009410 RtlCaptureContext
 0x140009418 RtlLookupFunctionEntry
 0x140009420 RtlVirtualUnwind
 0x140009428 UnhandledExceptionFilter
 0x140009430 SetUnhandledExceptionFilter
 0x140009438 TerminateProcess
 0x140009440 QueryPerformanceCounter
 0x140009448 GetCurrentProcessId
 0x140009450 GetCurrentThreadId
 0x140009458 GetSystemTimeAsFileTime
 0x140009460 GetTickCount
 0x140009468 EnumResourceLanguagesA
 0x140009470 GetDiskFreeSpaceA
 0x140009478 MulDiv
 0x140009480 FindClose
GDI32.dll
 0x1400091d8 GetDeviceCaps
USER32.dll
 0x140009490 ShowWindow
 0x140009498 MsgWaitForMultipleObjects
 0x1400094a0 SetWindowPos
 0x1400094a8 GetDC
 0x1400094b0 GetWindowRect
 0x1400094b8 DispatchMessageA
 0x1400094c0 GetSystemMetrics
 0x1400094c8 CallWindowProcA
 0x1400094d0 SetWindowTextA
 0x1400094d8 MessageBoxA
 0x1400094e0 SendDlgItemMessageA
 0x1400094e8 SendMessageA
 0x1400094f0 GetDlgItem
 0x1400094f8 DialogBoxIndirectParamA
 0x140009500 GetWindowLongPtrA
 0x140009508 SetWindowLongPtrA
 0x140009510 SetForegroundWindow
 0x140009518 ReleaseDC
 0x140009520 EnableWindow
 0x140009528 CharNextA
 0x140009530 LoadStringA
 0x140009538 CharPrevA
 0x140009540 EndDialog
 0x140009548 MessageBeep
 0x140009550 ExitWindowsEx
 0x140009558 SetDlgItemTextA
 0x140009560 CharUpperA
 0x140009568 GetDesktopWindow
 0x140009570 PeekMessageA
 0x140009578 GetDlgItemTextA
msvcrt.dll
 0x1400095a8 ?terminate@@YAXXZ
 0x1400095b0 _commode
 0x1400095b8 _fmode
 0x1400095c0 _acmdln
 0x1400095c8 __C_specific_handler
 0x1400095d0 memset
 0x1400095d8 __setusermatherr
 0x1400095e0 _ismbblead
 0x1400095e8 _cexit
 0x1400095f0 _exit
 0x1400095f8 exit
 0x140009600 __set_app_type
 0x140009608 __getmainargs
 0x140009610 _amsg_exit
 0x140009618 _XcptFilter
 0x140009620 memcpy_s
 0x140009628 _vsnprintf
 0x140009630 _initterm
 0x140009638 memcpy
COMCTL32.dll
 0x1400091a0 None
Cabinet.dll
 0x1400091b0 None
 0x1400091b8 None
 0x1400091c0 None
 0x1400091c8 None
VERSION.dll
 0x140009588 VerQueryValueA
 0x140009590 GetFileVersionInfoSizeA
 0x140009598 GetFileVersionInfoA

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure