ScreenShot
| Created | 2023.06.26 07:39 | Machine | s1_win7_x6403 |
| Filename | wa.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 55 detected (AIDetectMalware, Windows, AveMaria, Dacic, FDNF, Save, malicious, Genus, Antiav, INDT, Warzone, score, Powershell, Agentb, jiad, fljpfv, Gencirc, Redcap, ghjpt, Uacbypass, MOCRT, Upatre, high, EncPk, Confucius, Guildma, 38UUO1, Detected, R263895, ZexaF, iyW@ayAdNKci, ai score=87, unsafe, Genetic, CLASSIC, Static AI, Malicious PE, susgen, Kryptik, FCOG, confidence, 100%) | ||
| md5 | 4a04139d91df7de08a286bfe99cb4303 | ||
| sha256 | 565dab2ca2cccf49101da65093fb864c4857590db13be7d2fb943cfa2abad13e | ||
| ssdeep | 3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj | ||
| imphash | 0145d2c473bdbcd7b46a054bd6893ec4 | ||
| impfuzzy | 96:4seqF8J4Uqscp+5fG+9rDiCujJImM13ncGK55E5D79j9+11:4seLqcf9rDiCuj5RnehA1 | ||
Network IP location
Signature (25cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 55 AntiVirus engines on VirusTotal as malicious |
| watch | Attempts to remove evidence of file being downloaded from the Internet |
| watch | Communicates with host for which no DNS query was performed |
| watch | Harvests credentials from local email clients |
| watch | Installs itself for autorun at Windows startup |
| watch | Operates on local firewall's policies and settings |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Checks whether any human activity is being performed by constantly checking whether the foreground window changed |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | Executes one or more WMI queries |
| notice | Foreign language identified in PE resource |
| notice | One or more potentially interesting buffers were extracted |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Steals private information from local Internet browsers |
| notice | Terminates another process |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | Tries to locate where the browsers are installed |
Rules (19cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Ave_Maria_Zero | Remote Access Trojan that is also called WARZONE RAT | binaries (upload) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET MALWARE Warzone RAT Response (Inbound)
SURICATA Applayer Detect protocol only one direction
SURICATA Applayer Detect protocol only one direction
PE API
IAT(Import Address Table) Library
WINMM.dll
0x41a340 waveInClose
0x41a344 waveInAddBuffer
0x41a348 waveInStart
0x41a34c waveInStop
0x41a350 waveInPrepareHeader
0x41a354 waveInUnprepareHeader
0x41a358 waveInOpen
webservices.dll
0x41a3fc WsFileTimeToDateTime
crypt.dll
0x41a3a4 BCryptOpenAlgorithmProvider
0x41a3a8 BCryptSetProperty
0x41a3ac BCryptGenerateSymmetricKey
0x41a3b0 BCryptDecrypt
KERNEL32.dll
0x41a0b0 GetTickCount
0x41a0b4 HeapAlloc
0x41a0b8 GetProcessHeap
0x41a0bc GetCommandLineA
0x41a0c0 GetStartupInfoA
0x41a0c4 HeapFree
0x41a0c8 VirtualAlloc
0x41a0cc HeapReAlloc
0x41a0d0 VirtualQuery
0x41a0d4 LocalAlloc
0x41a0d8 LocalFree
0x41a0dc SystemTimeToFileTime
0x41a0e0 TerminateThread
0x41a0e4 CreateThread
0x41a0e8 WriteProcessMemory
0x41a0ec GetCurrentProcess
0x41a0f0 OpenProcess
0x41a0f4 GetWindowsDirectoryA
0x41a0f8 VirtualProtectEx
0x41a0fc VirtualAllocEx
0x41a100 CreateRemoteThread
0x41a104 GetModuleHandleW
0x41a108 IsWow64Process
0x41a10c WriteFile
0x41a110 WaitForSingleObject
0x41a114 CreateFileW
0x41a118 LoadLibraryW
0x41a11c GetLocalTime
0x41a120 GetCurrentThreadId
0x41a124 GetCurrentProcessId
0x41a128 ReadFile
0x41a12c FindFirstFileA
0x41a130 GetBinaryTypeW
0x41a134 FindNextFileA
0x41a138 lstrcpyW
0x41a13c CreateFileA
0x41a140 GlobalAlloc
0x41a144 GetCurrentDirectoryW
0x41a148 SetCurrentDirectoryW
0x41a14c GetFileSize
0x41a150 FreeLibrary
0x41a154 SetDllDirectoryW
0x41a158 GetFileSizeEx
0x41a15c WaitForMultipleObjects
0x41a160 CreatePipe
0x41a164 PeekNamedPipe
0x41a168 DuplicateHandle
0x41a16c SetEvent
0x41a170 CreateProcessW
0x41a174 CreateEventA
0x41a178 GetModuleFileNameW
0x41a17c LoadResource
0x41a180 FindResourceW
0x41a184 GetComputerNameW
0x41a188 GlobalMemoryStatusEx
0x41a18c LoadLibraryExW
0x41a190 FindFirstFileW
0x41a194 FindNextFileW
0x41a198 SetFilePointer
0x41a19c GetLogicalDriveStringsW
0x41a1a0 CopyFileW
0x41a1a4 GetDriveTypeW
0x41a1a8 EnterCriticalSection
0x41a1ac LeaveCriticalSection
0x41a1b0 InitializeCriticalSection
0x41a1b4 DeleteCriticalSection
0x41a1b8 CreateMutexA
0x41a1bc ReleaseMutex
0x41a1c0 TerminateProcess
0x41a1c4 K32GetModuleFileNameExW
0x41a1c8 CreateToolhelp32Snapshot
0x41a1cc Process32NextW
0x41a1d0 Process32FirstW
0x41a1d4 DeleteFileW
0x41a1d8 SizeofResource
0x41a1dc VirtualProtect
0x41a1e0 GetSystemDirectoryW
0x41a1e4 LockResource
0x41a1e8 GetWindowsDirectoryW
0x41a1ec GlobalLock
0x41a1f0 GlobalUnlock
0x41a1f4 Process32First
0x41a1f8 Process32Next
0x41a1fc WideCharToMultiByte
0x41a200 lstrcpyA
0x41a204 Sleep
0x41a208 MultiByteToWideChar
0x41a20c lstrcatA
0x41a210 lstrcmpA
0x41a214 lstrlenA
0x41a218 ExpandEnvironmentStringsW
0x41a21c lstrlenW
0x41a220 lstrcmpW
0x41a224 CreateProcessA
0x41a228 WinExec
0x41a22c ExitProcess
0x41a230 GetProcAddress
0x41a234 CloseHandle
0x41a238 lstrcatW
0x41a23c LoadLibraryA
0x41a240 GetLastError
0x41a244 GetPrivateProfileStringW
0x41a248 GetModuleHandleA
0x41a24c GetTempPathW
0x41a250 VirtualFree
0x41a254 SetLastError
0x41a258 GetModuleFileNameA
0x41a25c CreateDirectoryW
0x41a260 GetFullPathNameA
USER32.dll
0x41a2c8 GetWindowTextW
0x41a2cc GetLastInputInfo
0x41a2d0 wsprintfW
0x41a2d4 CharLowerW
0x41a2d8 PostQuitMessage
0x41a2dc ToUnicode
0x41a2e0 TranslateMessage
0x41a2e4 RegisterRawInputDevices
0x41a2e8 DefWindowProcA
0x41a2ec MapVirtualKeyA
0x41a2f0 GetRawInputData
0x41a2f4 RegisterClassW
0x41a2f8 GetAsyncKeyState
0x41a2fc GetKeyboardState
0x41a300 CreateWindowExW
0x41a304 SetClipboardViewer
0x41a308 DispatchMessageA
0x41a30c MapVirtualKeyW
0x41a310 GetMessageA
0x41a314 GetKeyState
0x41a318 ReleaseDC
0x41a31c GetSystemMetrics
0x41a320 GetForegroundWindow
0x41a324 OpenClipboard
0x41a328 CloseClipboard
0x41a32c GetClipboardData
0x41a330 GetDC
ADVAPI32.dll
0x41a000 RegQueryValueExW
0x41a004 LookupPrivilegeValueW
0x41a008 AdjustTokenPrivileges
0x41a00c AllocateAndInitializeSid
0x41a010 OpenProcessToken
0x41a014 FreeSid
0x41a018 LookupAccountSidW
0x41a01c GetTokenInformation
0x41a020 RegQueryInfoKeyA
0x41a024 RegOpenKeyW
0x41a028 CloseServiceHandle
0x41a02c SetSecurityDescriptorDacl
0x41a030 RegDeleteKeyA
0x41a034 InitializeSecurityDescriptor
0x41a038 GetUserNameW
0x41a03c RegDeleteKeyW
0x41a040 RegCreateKeyExW
0x41a044 RegSetValueExA
0x41a048 RegOpenKeyExW
0x41a04c RegOpenKeyExA
0x41a050 RegEnumKeyExW
0x41a054 RegQueryValueExA
0x41a058 RegQueryInfoKeyW
0x41a05c RegCloseKey
0x41a060 OpenServiceW
0x41a064 ChangeServiceConfigW
0x41a068 QueryServiceConfigW
0x41a06c EnumServicesStatusExW
0x41a070 StartServiceW
0x41a074 RegSetValueExW
0x41a078 RegCreateKeyExA
0x41a07c OpenSCManagerW
0x41a080 RegDeleteValueW
SHELL32.dll
0x41a284 SHFileOperationW
0x41a288 SHGetSpecialFolderPathW
0x41a28c SHCreateDirectoryExW
0x41a290 SHGetFolderPathW
0x41a294 ShellExecuteW
0x41a298 None
0x41a29c SHGetKnownFolderPath
urlmon.dll
0x41a3f4 URLDownloadToFileW
gdiplus.dll
0x41a3b8 GdiplusStartup
0x41a3bc GdipGetImageEncoders
0x41a3c0 GdipSaveImageToFile
0x41a3c4 GdipDisposeImage
0x41a3c8 GdipCreateBitmapFromHBITMAP
0x41a3cc GdipGetImageEncodersSize
0x41a3d0 GdiplusShutdown
WS2_32.dll
0x41a360 WSAConnect
0x41a364 WSAStartup
0x41a368 shutdown
0x41a36c closesocket
0x41a370 WSACleanup
0x41a374 connect
0x41a378 InetNtopW
0x41a37c gethostbyname
0x41a380 send
0x41a384 socket
0x41a388 recv
0x41a38c htons
0x41a390 freeaddrinfo
0x41a394 setsockopt
0x41a398 getaddrinfo
0x41a39c inet_addr
ole32.dll
0x41a3d8 CreateStreamOnHGlobal
0x41a3dc CoInitialize
0x41a3e0 CoCreateInstance
0x41a3e4 CoTaskMemFree
0x41a3e8 CoUninitialize
0x41a3ec CoInitializeSecurity
SHLWAPI.dll
0x41a2a4 AssocQueryStringW
0x41a2a8 StrStrW
0x41a2ac PathRemoveFileSpecA
0x41a2b0 PathCombineA
0x41a2b4 PathFindFileNameW
0x41a2b8 PathFindExtensionW
0x41a2bc PathFileExistsW
0x41a2c0 StrStrA
NETAPI32.dll
0x41a268 NetUserAdd
0x41a26c NetApiBufferFree
0x41a270 NetUserGetInfo
0x41a274 NetLocalGroupAddMembers
OLEAUT32.dll
0x41a27c VariantInit
CRYPT32.dll
0x41a088 CryptStringToBinaryW
0x41a08c CryptStringToBinaryA
0x41a090 CryptUnprotectData
WININET.dll
0x41a338 InternetTimeToSystemTimeA
GDI32.dll
0x41a098 CreateCompatibleDC
0x41a09c SelectObject
0x41a0a0 CreateCompatibleBitmap
0x41a0a4 BitBlt
0x41a0a8 DeleteObject
EAT(Export Address Table) is none
WINMM.dll
0x41a340 waveInClose
0x41a344 waveInAddBuffer
0x41a348 waveInStart
0x41a34c waveInStop
0x41a350 waveInPrepareHeader
0x41a354 waveInUnprepareHeader
0x41a358 waveInOpen
webservices.dll
0x41a3fc WsFileTimeToDateTime
crypt.dll
0x41a3a4 BCryptOpenAlgorithmProvider
0x41a3a8 BCryptSetProperty
0x41a3ac BCryptGenerateSymmetricKey
0x41a3b0 BCryptDecrypt
KERNEL32.dll
0x41a0b0 GetTickCount
0x41a0b4 HeapAlloc
0x41a0b8 GetProcessHeap
0x41a0bc GetCommandLineA
0x41a0c0 GetStartupInfoA
0x41a0c4 HeapFree
0x41a0c8 VirtualAlloc
0x41a0cc HeapReAlloc
0x41a0d0 VirtualQuery
0x41a0d4 LocalAlloc
0x41a0d8 LocalFree
0x41a0dc SystemTimeToFileTime
0x41a0e0 TerminateThread
0x41a0e4 CreateThread
0x41a0e8 WriteProcessMemory
0x41a0ec GetCurrentProcess
0x41a0f0 OpenProcess
0x41a0f4 GetWindowsDirectoryA
0x41a0f8 VirtualProtectEx
0x41a0fc VirtualAllocEx
0x41a100 CreateRemoteThread
0x41a104 GetModuleHandleW
0x41a108 IsWow64Process
0x41a10c WriteFile
0x41a110 WaitForSingleObject
0x41a114 CreateFileW
0x41a118 LoadLibraryW
0x41a11c GetLocalTime
0x41a120 GetCurrentThreadId
0x41a124 GetCurrentProcessId
0x41a128 ReadFile
0x41a12c FindFirstFileA
0x41a130 GetBinaryTypeW
0x41a134 FindNextFileA
0x41a138 lstrcpyW
0x41a13c CreateFileA
0x41a140 GlobalAlloc
0x41a144 GetCurrentDirectoryW
0x41a148 SetCurrentDirectoryW
0x41a14c GetFileSize
0x41a150 FreeLibrary
0x41a154 SetDllDirectoryW
0x41a158 GetFileSizeEx
0x41a15c WaitForMultipleObjects
0x41a160 CreatePipe
0x41a164 PeekNamedPipe
0x41a168 DuplicateHandle
0x41a16c SetEvent
0x41a170 CreateProcessW
0x41a174 CreateEventA
0x41a178 GetModuleFileNameW
0x41a17c LoadResource
0x41a180 FindResourceW
0x41a184 GetComputerNameW
0x41a188 GlobalMemoryStatusEx
0x41a18c LoadLibraryExW
0x41a190 FindFirstFileW
0x41a194 FindNextFileW
0x41a198 SetFilePointer
0x41a19c GetLogicalDriveStringsW
0x41a1a0 CopyFileW
0x41a1a4 GetDriveTypeW
0x41a1a8 EnterCriticalSection
0x41a1ac LeaveCriticalSection
0x41a1b0 InitializeCriticalSection
0x41a1b4 DeleteCriticalSection
0x41a1b8 CreateMutexA
0x41a1bc ReleaseMutex
0x41a1c0 TerminateProcess
0x41a1c4 K32GetModuleFileNameExW
0x41a1c8 CreateToolhelp32Snapshot
0x41a1cc Process32NextW
0x41a1d0 Process32FirstW
0x41a1d4 DeleteFileW
0x41a1d8 SizeofResource
0x41a1dc VirtualProtect
0x41a1e0 GetSystemDirectoryW
0x41a1e4 LockResource
0x41a1e8 GetWindowsDirectoryW
0x41a1ec GlobalLock
0x41a1f0 GlobalUnlock
0x41a1f4 Process32First
0x41a1f8 Process32Next
0x41a1fc WideCharToMultiByte
0x41a200 lstrcpyA
0x41a204 Sleep
0x41a208 MultiByteToWideChar
0x41a20c lstrcatA
0x41a210 lstrcmpA
0x41a214 lstrlenA
0x41a218 ExpandEnvironmentStringsW
0x41a21c lstrlenW
0x41a220 lstrcmpW
0x41a224 CreateProcessA
0x41a228 WinExec
0x41a22c ExitProcess
0x41a230 GetProcAddress
0x41a234 CloseHandle
0x41a238 lstrcatW
0x41a23c LoadLibraryA
0x41a240 GetLastError
0x41a244 GetPrivateProfileStringW
0x41a248 GetModuleHandleA
0x41a24c GetTempPathW
0x41a250 VirtualFree
0x41a254 SetLastError
0x41a258 GetModuleFileNameA
0x41a25c CreateDirectoryW
0x41a260 GetFullPathNameA
USER32.dll
0x41a2c8 GetWindowTextW
0x41a2cc GetLastInputInfo
0x41a2d0 wsprintfW
0x41a2d4 CharLowerW
0x41a2d8 PostQuitMessage
0x41a2dc ToUnicode
0x41a2e0 TranslateMessage
0x41a2e4 RegisterRawInputDevices
0x41a2e8 DefWindowProcA
0x41a2ec MapVirtualKeyA
0x41a2f0 GetRawInputData
0x41a2f4 RegisterClassW
0x41a2f8 GetAsyncKeyState
0x41a2fc GetKeyboardState
0x41a300 CreateWindowExW
0x41a304 SetClipboardViewer
0x41a308 DispatchMessageA
0x41a30c MapVirtualKeyW
0x41a310 GetMessageA
0x41a314 GetKeyState
0x41a318 ReleaseDC
0x41a31c GetSystemMetrics
0x41a320 GetForegroundWindow
0x41a324 OpenClipboard
0x41a328 CloseClipboard
0x41a32c GetClipboardData
0x41a330 GetDC
ADVAPI32.dll
0x41a000 RegQueryValueExW
0x41a004 LookupPrivilegeValueW
0x41a008 AdjustTokenPrivileges
0x41a00c AllocateAndInitializeSid
0x41a010 OpenProcessToken
0x41a014 FreeSid
0x41a018 LookupAccountSidW
0x41a01c GetTokenInformation
0x41a020 RegQueryInfoKeyA
0x41a024 RegOpenKeyW
0x41a028 CloseServiceHandle
0x41a02c SetSecurityDescriptorDacl
0x41a030 RegDeleteKeyA
0x41a034 InitializeSecurityDescriptor
0x41a038 GetUserNameW
0x41a03c RegDeleteKeyW
0x41a040 RegCreateKeyExW
0x41a044 RegSetValueExA
0x41a048 RegOpenKeyExW
0x41a04c RegOpenKeyExA
0x41a050 RegEnumKeyExW
0x41a054 RegQueryValueExA
0x41a058 RegQueryInfoKeyW
0x41a05c RegCloseKey
0x41a060 OpenServiceW
0x41a064 ChangeServiceConfigW
0x41a068 QueryServiceConfigW
0x41a06c EnumServicesStatusExW
0x41a070 StartServiceW
0x41a074 RegSetValueExW
0x41a078 RegCreateKeyExA
0x41a07c OpenSCManagerW
0x41a080 RegDeleteValueW
SHELL32.dll
0x41a284 SHFileOperationW
0x41a288 SHGetSpecialFolderPathW
0x41a28c SHCreateDirectoryExW
0x41a290 SHGetFolderPathW
0x41a294 ShellExecuteW
0x41a298 None
0x41a29c SHGetKnownFolderPath
urlmon.dll
0x41a3f4 URLDownloadToFileW
gdiplus.dll
0x41a3b8 GdiplusStartup
0x41a3bc GdipGetImageEncoders
0x41a3c0 GdipSaveImageToFile
0x41a3c4 GdipDisposeImage
0x41a3c8 GdipCreateBitmapFromHBITMAP
0x41a3cc GdipGetImageEncodersSize
0x41a3d0 GdiplusShutdown
WS2_32.dll
0x41a360 WSAConnect
0x41a364 WSAStartup
0x41a368 shutdown
0x41a36c closesocket
0x41a370 WSACleanup
0x41a374 connect
0x41a378 InetNtopW
0x41a37c gethostbyname
0x41a380 send
0x41a384 socket
0x41a388 recv
0x41a38c htons
0x41a390 freeaddrinfo
0x41a394 setsockopt
0x41a398 getaddrinfo
0x41a39c inet_addr
ole32.dll
0x41a3d8 CreateStreamOnHGlobal
0x41a3dc CoInitialize
0x41a3e0 CoCreateInstance
0x41a3e4 CoTaskMemFree
0x41a3e8 CoUninitialize
0x41a3ec CoInitializeSecurity
SHLWAPI.dll
0x41a2a4 AssocQueryStringW
0x41a2a8 StrStrW
0x41a2ac PathRemoveFileSpecA
0x41a2b0 PathCombineA
0x41a2b4 PathFindFileNameW
0x41a2b8 PathFindExtensionW
0x41a2bc PathFileExistsW
0x41a2c0 StrStrA
NETAPI32.dll
0x41a268 NetUserAdd
0x41a26c NetApiBufferFree
0x41a270 NetUserGetInfo
0x41a274 NetLocalGroupAddMembers
OLEAUT32.dll
0x41a27c VariantInit
CRYPT32.dll
0x41a088 CryptStringToBinaryW
0x41a08c CryptStringToBinaryA
0x41a090 CryptUnprotectData
WININET.dll
0x41a338 InternetTimeToSystemTimeA
GDI32.dll
0x41a098 CreateCompatibleDC
0x41a09c SelectObject
0x41a0a0 CreateCompatibleBitmap
0x41a0a4 BitBlt
0x41a0a8 DeleteObject
EAT(Export Address Table) is none