Report - setup294.exe

UPX Malicious Library Create Service Escalate priviledges AntiDebug AntiVM OS Processor Check PE File PE32 DLL
ScreenShot
Created 2023.07.24 09:32 Machine s1_win7_x6403
Filename setup294.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
1
Behavior Score
3.0
ZERO API file : clean
VT API (file)
md5 ea7a66c1eaf1ddaca7ad98a7b8490099
sha256 649c916002f2ad5577c323dba0e08908b540f8bddce82274d258bae40f88a295
ssdeep 24576:DubsnafAPycJUI8VTNG8Z5SbQ/6/0wz7un4ghZUlNoMLmVt4DCRBq4:rLL8VTvZ0bQ/IzC4XNmt4mRBq4
imphash 0ae9e38912ff6bd742a1b9e5c003576a
impfuzzy 48:J9jOXRgLy1XFjsX1Pfc++6W3CYpZBtDXMuniLFH:JdcgLy1XFgX1Pfc++V/7BtDXMuniLFH
  Network IP location

Signature (8cnts)

Level Description
watch Communicates with host for which no DNS query was performed
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Drops an executable to the user AppData folder
notice Yara rule detected in process memory
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (20cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
notice Create_Service Create a windows service memory
notice Escalate_priviledges Escalate priviledges memory
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
185.228.234.30 RU IT Outsourcing LLC 185.228.234.30 clean

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x434000 GetLastError
 0x434004 SetLastError
 0x434008 FormatMessageW
 0x43400c GetCurrentProcess
 0x434010 DeviceIoControl
 0x434014 SetFileTime
 0x434018 CloseHandle
 0x43401c CreateDirectoryW
 0x434020 RemoveDirectoryW
 0x434024 CreateFileW
 0x434028 DeleteFileW
 0x43402c CreateHardLinkW
 0x434030 GetShortPathNameW
 0x434034 GetLongPathNameW
 0x434038 MoveFileW
 0x43403c GetFileType
 0x434040 GetStdHandle
 0x434044 WriteFile
 0x434048 ReadFile
 0x43404c FlushFileBuffers
 0x434050 SetEndOfFile
 0x434054 SetFilePointer
 0x434058 GetCurrentProcessId
 0x43405c SetFileAttributesW
 0x434060 GetFileAttributesW
 0x434064 FindClose
 0x434068 FindFirstFileW
 0x43406c FindNextFileW
 0x434070 InterlockedDecrement
 0x434074 GetVersionExW
 0x434078 GetCurrentDirectoryW
 0x43407c GetFullPathNameW
 0x434080 FoldStringW
 0x434084 GetModuleFileNameW
 0x434088 GetModuleHandleW
 0x43408c FindResourceW
 0x434090 FreeLibrary
 0x434094 GetProcAddress
 0x434098 ExitProcess
 0x43409c SetThreadExecutionState
 0x4340a0 Sleep
 0x4340a4 LoadLibraryW
 0x4340a8 GetSystemDirectoryW
 0x4340ac CompareStringW
 0x4340b0 AllocConsole
 0x4340b4 FreeConsole
 0x4340b8 AttachConsole
 0x4340bc WriteConsoleW
 0x4340c0 GetProcessAffinityMask
 0x4340c4 CreateThread
 0x4340c8 SetThreadPriority
 0x4340cc InitializeCriticalSection
 0x4340d0 EnterCriticalSection
 0x4340d4 LeaveCriticalSection
 0x4340d8 DeleteCriticalSection
 0x4340dc SetEvent
 0x4340e0 ResetEvent
 0x4340e4 ReleaseSemaphore
 0x4340e8 WaitForSingleObject
 0x4340ec CreateEventW
 0x4340f0 CreateSemaphoreW
 0x4340f4 GetSystemTime
 0x4340f8 SystemTimeToTzSpecificLocalTime
 0x4340fc TzSpecificLocalTimeToSystemTime
 0x434100 SystemTimeToFileTime
 0x434104 FileTimeToLocalFileTime
 0x434108 LocalFileTimeToFileTime
 0x43410c FileTimeToSystemTime
 0x434110 GetCPInfo
 0x434114 IsDBCSLeadByte
 0x434118 MultiByteToWideChar
 0x43411c WideCharToMultiByte
 0x434120 GlobalAlloc
 0x434124 LockResource
 0x434128 GlobalLock
 0x43412c GlobalUnlock
 0x434130 GlobalFree
 0x434134 LoadResource
 0x434138 SizeofResource
 0x43413c SetCurrentDirectoryW
 0x434140 GetTimeFormatW
 0x434144 GetDateFormatW
 0x434148 LocalFree
 0x43414c GetExitCodeProcess
 0x434150 GetLocalTime
 0x434154 GetTickCount
 0x434158 MapViewOfFile
 0x43415c UnmapViewOfFile
 0x434160 CreateFileMappingW
 0x434164 OpenFileMappingW
 0x434168 GetCommandLineW
 0x43416c SetEnvironmentVariableW
 0x434170 ExpandEnvironmentStringsW
 0x434174 GetTempPathW
 0x434178 MoveFileExW
 0x43417c GetLocaleInfoW
 0x434180 GetNumberFormatW
 0x434184 DecodePointer
 0x434188 SetFilePointerEx
 0x43418c GetConsoleMode
 0x434190 GetConsoleCP
 0x434194 HeapSize
 0x434198 SetStdHandle
 0x43419c GetProcessHeap
 0x4341a0 FreeEnvironmentStringsW
 0x4341a4 GetEnvironmentStringsW
 0x4341a8 GetCommandLineA
 0x4341ac GetOEMCP
 0x4341b0 RaiseException
 0x4341b4 GetSystemInfo
 0x4341b8 VirtualProtect
 0x4341bc VirtualQuery
 0x4341c0 LoadLibraryExA
 0x4341c4 IsProcessorFeaturePresent
 0x4341c8 IsDebuggerPresent
 0x4341cc UnhandledExceptionFilter
 0x4341d0 SetUnhandledExceptionFilter
 0x4341d4 GetStartupInfoW
 0x4341d8 QueryPerformanceCounter
 0x4341dc GetCurrentThreadId
 0x4341e0 GetSystemTimeAsFileTime
 0x4341e4 InitializeSListHead
 0x4341e8 TerminateProcess
 0x4341ec RtlUnwind
 0x4341f0 EncodePointer
 0x4341f4 InitializeCriticalSectionAndSpinCount
 0x4341f8 TlsAlloc
 0x4341fc TlsGetValue
 0x434200 TlsSetValue
 0x434204 TlsFree
 0x434208 LoadLibraryExW
 0x43420c QueryPerformanceFrequency
 0x434210 GetModuleHandleExW
 0x434214 GetModuleFileNameA
 0x434218 GetACP
 0x43421c HeapFree
 0x434220 HeapReAlloc
 0x434224 HeapAlloc
 0x434228 GetStringTypeW
 0x43422c LCMapStringW
 0x434230 FindFirstFileExA
 0x434234 FindNextFileA
 0x434238 IsValidCodePage
OLEAUT32.dll
 0x434240 SysAllocString
 0x434244 SysFreeString
 0x434248 VariantClear
gdiplus.dll
 0x434250 GdipAlloc
 0x434254 GdipDisposeImage
 0x434258 GdipCloneImage
 0x43425c GdipCreateBitmapFromStream
 0x434260 GdipCreateBitmapFromStreamICM
 0x434264 GdipCreateHBITMAPFromBitmap
 0x434268 GdiplusStartup
 0x43426c GdiplusShutdown
 0x434270 GdipFree

EAT(Export Address Table) Library



Similarity measure (PE file only) - Checking for service failure