ScreenShot
| Created | 2023.08.02 17:09 | Machine | s1_win7_x6401 |
| Filename | taskmaskamd.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 47 detected (Common, Deyma, malicious, high confidence, score, GenericKD, unsafe, Vk38, confidence, 100%, ABRisk, ZRQS, GenCBL, Gencirc, wpzvx, Packed2, Artemis, high, Outbreak, Amadey, Sabsik, Detected, ai score=86, BScope, TrojanPSW, Coins, Chgt, R002H0DGT23, bzUFKwFqakH, GEB027V7fpI, susgen, ZexaF, @J1@ai8f3Xfi) | ||
| md5 | 89e9bc7a5d97370a0f4a35041a54a696 | ||
| sha256 | 9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847 | ||
| ssdeep | 196608:3PbBDSjGzSuyKff2j6pdVY3d2dZo2tOuAX+W6+B6VJN1lev:3JKGzXuTwdZdLM+JS | ||
| imphash | 1779b49e339a4992a1e5095de91944cb | ||
| impfuzzy | 6:AqBptabxdLqRgKLbGeuL16n9hF6BIIXajXA8VyH/JLGMZ/OiBJAEnERGDW:vmGRgRZg9XCX6w8sZGMZGqAJcDW | ||
Network IP location
Signature (45cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 47 AntiVirus engines on VirusTotal as malicious |
| danger | Executed a process and injected code into it |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Attempts to identify installed AV products by installation directory |
| watch | Collects information about installed applications |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates an executable file in a user folder |
| watch | Executes one or more WMI queries |
| watch | Harvests credentials from local FTP client softwares |
| watch | Installs itself for autorun at Windows startup |
| watch | One or more of the buffers contains an embedded PE file |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| watch | Uses suspicious command line tools or Windows utilities |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An executable file was downloaded by the process oneetx.exe |
| notice | Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Checks whether any human activity is being performed by constantly checking whether the foreground window changed |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | Executes one or more WMI queries which can be used to identify virtual machines |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Queries for potentially installed applications |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (24cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | themida_packer | themida packer | binaries (download) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | MPRESS_Zero | MPRESS packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
| notice | Network_SMTP_dotNet | Communications smtp | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | JPEG_Format_Zero | JPEG Format | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
Network (12cnts) ?
Suricata ids
ET MALWARE Amadey CnC Check-In
ET MALWARE Win32/Amadey Bot Activity (POST) M2
ET INFO Executable Download from dotted-quad Host
ET POLICY PE EXE or DLL Windows file download HTTP
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
ET INFO Microsoft net.tcp Connection Initialization Activity
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET INFO Packed Executable Download
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET MALWARE Amadey Bot Activity (POST) M1
ET MALWARE Win32/Amadey Bot Activity (POST) M2
ET INFO Executable Download from dotted-quad Host
ET POLICY PE EXE or DLL Windows file download HTTP
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2
ET INFO Microsoft net.tcp Connection Initialization Activity
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET INFO Packed Executable Download
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET MALWARE Amadey Bot Activity (POST) M1
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x7a4000 GetVersionExW
USER32.dll
0x7a4008 GetSystemMetrics
GDI32.dll
0x7a4010 CreateCompatibleBitmap
ADVAPI32.dll
0x7a4018 RegCloseKey
SHELL32.dll
0x7a4020 SHGetFolderPathA
WININET.dll
0x7a4028 HttpOpenRequestA
gdiplus.dll
0x7a4030 GdipSaveImageToFile
KERNEL32.dll
0x7a4038 GetSystemTimeAsFileTime
USER32.dll
0x7a4040 CharUpperBuffW
KERNEL32.dll
0x7a4048 LocalAlloc
0x7a404c LocalFree
0x7a4050 GetModuleFileNameW
0x7a4054 ExitProcess
0x7a4058 LoadLibraryA
0x7a405c GetModuleHandleA
0x7a4060 GetProcAddress
EAT(Export Address Table) is none
KERNEL32.dll
0x7a4000 GetVersionExW
USER32.dll
0x7a4008 GetSystemMetrics
GDI32.dll
0x7a4010 CreateCompatibleBitmap
ADVAPI32.dll
0x7a4018 RegCloseKey
SHELL32.dll
0x7a4020 SHGetFolderPathA
WININET.dll
0x7a4028 HttpOpenRequestA
gdiplus.dll
0x7a4030 GdipSaveImageToFile
KERNEL32.dll
0x7a4038 GetSystemTimeAsFileTime
USER32.dll
0x7a4040 CharUpperBuffW
KERNEL32.dll
0x7a4048 LocalAlloc
0x7a404c LocalFree
0x7a4050 GetModuleFileNameW
0x7a4054 ExitProcess
0x7a4058 LoadLibraryA
0x7a405c GetModuleHandleA
0x7a4060 GetProcAddress
EAT(Export Address Table) is none