popup

Report - kgec63hr0ubmn.exe

Generic Malware UPX Malicious Library Antivirus AntiDebug AntiVM OS Processor Check PE File PE32 PowerShell
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.07.24 09:33 Machine s1_win7_x6403
Filename kgec63hr0ubmn.exe
Type PE32 executable (console) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
14.4
ZERO API file : clean
VT API (file) 30 detected (AIDetectMalware, ZMW@I1zk4ue, Save, malicious, confidence, Attribute, HighConfidence, high confidence, Kryptik, HUBU, PWSX, Generic ML PUA, Static AI, Suspicious PE, Detected, ai score=85, Sabsik, score, Generic@AI, RDML, f6+b6oYd1PVYXDfTPOF, susgen)
md5 79982cf6836eebddfc2aa3e773f54f38
sha256 c734d9e260a93250d5f6a81fd6a2fd7eb30ac20ea1ac2ec0032767cced2107bc
ssdeep 24576:yOicyeXFhwaxa72C6rj5C+gj3ao2HKElSG/Dg8N6AWWzAHypg186MVhf1JzaKtX0:yrohwaxa2hgjKoPKD/7AH86M/nltXhl
imphash 99618c39aafbf01419fbcd53cea0e110
impfuzzy 24:kJGrjlV90wcpVOsmrYtMS1MGzplJBlxeDoLoEOovbOZFuFZMv1GMApTm+lEZHu9c:GY97cpVOVrYtMS1MGzPXXc3fuFZGVL
  Network IP location

Signature (30cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
danger Executed a process and injected code into it
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch Allocates execute permission to another process indicative of possible code injection
watch Communicates with host for which no DNS query was performed
watch Manipulates memory of a non-child process indicative of process injection
watch One or more non-whitelisted processes were created
watch One or more of the buffers contains an embedded PE file
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Looks up the external IP address
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer
info Uses Windows APIs to generate a cryptographic key

Rules (22cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Antivirus Contains references to security software binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info PowerShell PowerShell script scripts
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (15cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://www.microsoft.com/
whois
US AKAMAI-AS 23.36.221.62 clean
http://ip-api.com/json/?fields=query,status,countryCode,city,timezone
whois
US TUT-AS 208.95.112.1 clean
http://185.228.234.30/clpr/OWUsN2UsODMsOWIsOWUsODIsOTAsOTEsNjQsN2Ys
whois
RU IT Outsourcing LLC 185.228.234.30 clean
http://pastebin.com/raw/r0KhEEzi
whois
US CLOUDFLARENET 172.67.34.170 clean
https://pastebin.com/raw/r0KhEEzi
whois
US CLOUDFLARENET 172.67.34.170 clean
www.microsoft.com
whois
Unknown 104.94.217.134 clean
pastebin.com
whois
US CLOUDFLARENET 172.67.34.170 mailcious
ip-api.com
whois
US TUT-AS 208.95.112.1 clean
185.149.146.118
whois
LU Foton Telecom CJSC 185.149.146.118 clean
185.159.129.168
whois
RU IT Outsourcing LLC 185.159.129.168 mailcious
77.91.77.144
whois
RU Foton Telecom CJSC 77.91.77.144 clean
208.95.112.1
whois
US TUT-AS 208.95.112.1 clean
104.94.217.134
whois
Unknown 104.94.217.134 clean
185.228.234.30
whois
RU IT Outsourcing LLC 185.228.234.30 clean
172.67.34.170
whois
US CLOUDFLARENET 172.67.34.170 mailcious

Suricata ids

ET POLICY External IP Lookup ip-api.com
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET POLICY Microsoft user-agent automated process response to automated request

PE API

IAT(Import Address Table) Library

USER32.dll
 0x502208 GetClientRect
 0x50220c SetWindowDisplayAffinity
GDI32.dll
 0x502000 RestoreDC
 0x502004 DeleteObject
KERNEL32.dll
 0x502034 HeapSize
 0x502038 CreateFileW
 0x50203c TlsFree
 0x502040 CloseHandle
 0x502044 WaitForSingleObject
 0x502048 CreateThread
 0x50204c FormatMessageA
 0x502050 LocalFree
 0x502054 EncodePointer
 0x502058 DecodePointer
 0x50205c EnterCriticalSection
 0x502060 LeaveCriticalSection
 0x502064 InitializeCriticalSectionEx
 0x502068 DeleteCriticalSection
 0x50206c MultiByteToWideChar
 0x502070 WideCharToMultiByte
 0x502074 LCMapStringEx
 0x502078 GetLocaleInfoEx
 0x50207c GetStringTypeW
 0x502080 CompareStringEx
 0x502084 GetCPInfo
 0x502088 UnhandledExceptionFilter
 0x50208c SetUnhandledExceptionFilter
 0x502090 GetCurrentProcess
 0x502094 TerminateProcess
 0x502098 IsProcessorFeaturePresent
 0x50209c QueryPerformanceCounter
 0x5020a0 GetCurrentProcessId
 0x5020a4 GetCurrentThreadId
 0x5020a8 GetSystemTimeAsFileTime
 0x5020ac InitializeSListHead
 0x5020b0 IsDebuggerPresent
 0x5020b4 GetStartupInfoW
 0x5020b8 GetModuleHandleW
 0x5020bc GetProcessHeap
 0x5020c0 RaiseException
 0x5020c4 RtlUnwind
 0x5020c8 InterlockedPushEntrySList
 0x5020cc InterlockedFlushSList
 0x5020d0 GetLastError
 0x5020d4 SetLastError
 0x5020d8 InitializeCriticalSectionAndSpinCount
 0x5020dc TlsAlloc
 0x5020e0 TlsGetValue
 0x5020e4 TlsSetValue
 0x5020e8 WriteConsoleW
 0x5020ec FreeLibrary
 0x5020f0 GetProcAddress
 0x5020f4 LoadLibraryExW
 0x5020f8 GetStdHandle
 0x5020fc WriteFile
 0x502100 GetModuleFileNameW
 0x502104 ExitProcess
 0x502108 GetModuleHandleExW
 0x50210c GetCommandLineA
 0x502110 GetCommandLineW
 0x502114 GetCurrentThread
 0x502118 HeapFree
 0x50211c HeapAlloc
 0x502120 GetDateFormatW
 0x502124 GetTimeFormatW
 0x502128 CompareStringW
 0x50212c LCMapStringW
 0x502130 GetLocaleInfoW
 0x502134 IsValidLocale
 0x502138 GetUserDefaultLCID
 0x50213c EnumSystemLocalesW
 0x502140 GetFileType
 0x502144 FlushFileBuffers
 0x502148 GetConsoleOutputCP
 0x50214c GetConsoleMode
 0x502150 ReadFile
 0x502154 GetFileSizeEx
 0x502158 SetFilePointerEx
 0x50215c ReadConsoleW
 0x502160 SetConsoleCtrlHandler
 0x502164 HeapReAlloc
 0x502168 GetTimeZoneInformation
 0x50216c OutputDebugStringW
 0x502170 FindClose
 0x502174 FindFirstFileExW
 0x502178 FindNextFileW
 0x50217c IsValidCodePage
 0x502180 GetACP
 0x502184 GetOEMCP
 0x502188 GetEnvironmentStringsW
 0x50218c FreeEnvironmentStringsW
 0x502190 SetEnvironmentVariableW
 0x502194 SetStdHandle

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure