ScreenShot
| Created | 2023.08.04 09:17 | Machine | s1_win7_x6403 |
| Filename | utilsxupdater.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 21 detected (malicious, high confidence, Artemis, unsafe, Save, Attribute, HighConfidence, score, RealProtect, Generic ML PUA, Static AI, Suspicious PE, Wacatac, Detected, susgen, PossibleThreat) | ||
| md5 | 96c30f7179f2d7045aba556d3b8f92af | ||
| sha256 | 4b45a2333b183144267f5492c7dae553b28ad86d03a96891efb0fb04359d67e4 | ||
| ssdeep | 3072:w/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSEj:Ltzsb5Uh28+V1WW69B9VjMdxPedN9ugC | ||
| imphash | f326f88ca83c9aacaa44acfb8884f1d4 | ||
| impfuzzy | 48:YMuGno3GmCp51H3NxOI40nIUY5LoeSZ/g/KAwEUEkE/1WSY+09AFXElvyAobFzGQ:Y7qo35Cp51XNxh40nIbo1WNwCJ | ||
Network IP location
Signature (15cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 21 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Terminates another process |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
msvcrt.dll
0x14001f6c8 memset
0x14001f6d0 wcsncmp
0x14001f6d8 memmove
0x14001f6e0 wcsncpy
0x14001f6e8 wcsstr
0x14001f6f0 _wcsnicmp
0x14001f6f8 _wcsdup
0x14001f700 free
0x14001f708 _wcsicmp
0x14001f710 wcslen
0x14001f718 wcscpy
0x14001f720 wcscmp
0x14001f728 wcscat
0x14001f730 memcpy
0x14001f738 tolower
0x14001f740 malloc
KERNEL32.dll
0x14001f750 GetModuleHandleW
0x14001f758 HeapCreate
0x14001f760 GetStdHandle
0x14001f768 SetConsoleCtrlHandler
0x14001f770 HeapDestroy
0x14001f778 ExitProcess
0x14001f780 WriteFile
0x14001f788 GetTempFileNameW
0x14001f790 LoadLibraryExW
0x14001f798 EnumResourceTypesW
0x14001f7a0 FreeLibrary
0x14001f7a8 RemoveDirectoryW
0x14001f7b0 EnumResourceNamesW
0x14001f7b8 GetCommandLineW
0x14001f7c0 LoadResource
0x14001f7c8 SizeofResource
0x14001f7d0 FreeResource
0x14001f7d8 FindResourceW
0x14001f7e0 GetShortPathNameW
0x14001f7e8 GetSystemDirectoryW
0x14001f7f0 EnterCriticalSection
0x14001f7f8 CloseHandle
0x14001f800 LeaveCriticalSection
0x14001f808 InitializeCriticalSection
0x14001f810 WaitForSingleObject
0x14001f818 TerminateThread
0x14001f820 CreateThread
0x14001f828 Sleep
0x14001f830 WideCharToMultiByte
0x14001f838 HeapAlloc
0x14001f840 HeapFree
0x14001f848 LoadLibraryW
0x14001f850 GetProcAddress
0x14001f858 GetCurrentProcessId
0x14001f860 GetCurrentThreadId
0x14001f868 GetModuleFileNameW
0x14001f870 PeekNamedPipe
0x14001f878 TerminateProcess
0x14001f880 GetEnvironmentVariableW
0x14001f888 SetEnvironmentVariableW
0x14001f890 GetCurrentProcess
0x14001f898 DuplicateHandle
0x14001f8a0 CreatePipe
0x14001f8a8 CreateProcessW
0x14001f8b0 GetExitCodeProcess
0x14001f8b8 RtlLookupFunctionEntry
0x14001f8c0 RtlVirtualUnwind
0x14001f8c8 RemoveVectoredExceptionHandler
0x14001f8d0 AddVectoredExceptionHandler
0x14001f8d8 HeapSize
0x14001f8e0 MultiByteToWideChar
0x14001f8e8 CreateDirectoryW
0x14001f8f0 SetFileAttributesW
0x14001f8f8 GetTempPathW
0x14001f900 DeleteFileW
0x14001f908 GetCurrentDirectoryW
0x14001f910 SetCurrentDirectoryW
0x14001f918 CreateFileW
0x14001f920 SetFilePointer
0x14001f928 TlsFree
0x14001f930 TlsGetValue
0x14001f938 TlsSetValue
0x14001f940 TlsAlloc
0x14001f948 HeapReAlloc
0x14001f950 DeleteCriticalSection
0x14001f958 GetLastError
0x14001f960 SetLastError
0x14001f968 UnregisterWait
0x14001f970 GetCurrentThread
0x14001f978 RegisterWaitForSingleObject
SHELL32.DLL
0x14001f988 ShellExecuteExW
0x14001f990 SHGetFolderLocation
0x14001f998 SHGetPathFromIDListW
WINMM.DLL
0x14001f9a8 timeBeginPeriod
OLE32.DLL
0x14001f9b8 CoInitialize
0x14001f9c0 CoTaskMemFree
SHLWAPI.DLL
0x14001f9d0 PathAddBackslashW
0x14001f9d8 PathRenameExtensionW
0x14001f9e0 PathQuoteSpacesW
0x14001f9e8 PathRemoveArgsW
0x14001f9f0 PathRemoveBackslashW
USER32.DLL
0x14001fa00 CharUpperW
0x14001fa08 CharLowerW
0x14001fa10 MessageBoxW
0x14001fa18 DefWindowProcW
0x14001fa20 GetWindowLongPtrW
0x14001fa28 GetWindowTextLengthW
0x14001fa30 GetWindowTextW
0x14001fa38 EnableWindow
0x14001fa40 DestroyWindow
0x14001fa48 UnregisterClassW
0x14001fa50 LoadIconW
0x14001fa58 LoadCursorW
0x14001fa60 RegisterClassExW
0x14001fa68 IsWindowEnabled
0x14001fa70 GetSystemMetrics
0x14001fa78 CreateWindowExW
0x14001fa80 SetWindowLongPtrW
0x14001fa88 SendMessageW
0x14001fa90 SetFocus
0x14001fa98 CreateAcceleratorTableW
0x14001faa0 SetForegroundWindow
0x14001faa8 BringWindowToTop
0x14001fab0 GetMessageW
0x14001fab8 TranslateAcceleratorW
0x14001fac0 TranslateMessage
0x14001fac8 DispatchMessageW
0x14001fad0 DestroyAcceleratorTable
0x14001fad8 PostMessageW
0x14001fae0 GetForegroundWindow
0x14001fae8 GetWindowThreadProcessId
0x14001faf0 IsWindowVisible
0x14001faf8 EnumWindows
0x14001fb00 SetWindowPos
GDI32.DLL
0x14001fb10 GetStockObject
COMCTL32.DLL
0x14001fb20 InitCommonControlsEx
EAT(Export Address Table) is none
msvcrt.dll
0x14001f6c8 memset
0x14001f6d0 wcsncmp
0x14001f6d8 memmove
0x14001f6e0 wcsncpy
0x14001f6e8 wcsstr
0x14001f6f0 _wcsnicmp
0x14001f6f8 _wcsdup
0x14001f700 free
0x14001f708 _wcsicmp
0x14001f710 wcslen
0x14001f718 wcscpy
0x14001f720 wcscmp
0x14001f728 wcscat
0x14001f730 memcpy
0x14001f738 tolower
0x14001f740 malloc
KERNEL32.dll
0x14001f750 GetModuleHandleW
0x14001f758 HeapCreate
0x14001f760 GetStdHandle
0x14001f768 SetConsoleCtrlHandler
0x14001f770 HeapDestroy
0x14001f778 ExitProcess
0x14001f780 WriteFile
0x14001f788 GetTempFileNameW
0x14001f790 LoadLibraryExW
0x14001f798 EnumResourceTypesW
0x14001f7a0 FreeLibrary
0x14001f7a8 RemoveDirectoryW
0x14001f7b0 EnumResourceNamesW
0x14001f7b8 GetCommandLineW
0x14001f7c0 LoadResource
0x14001f7c8 SizeofResource
0x14001f7d0 FreeResource
0x14001f7d8 FindResourceW
0x14001f7e0 GetShortPathNameW
0x14001f7e8 GetSystemDirectoryW
0x14001f7f0 EnterCriticalSection
0x14001f7f8 CloseHandle
0x14001f800 LeaveCriticalSection
0x14001f808 InitializeCriticalSection
0x14001f810 WaitForSingleObject
0x14001f818 TerminateThread
0x14001f820 CreateThread
0x14001f828 Sleep
0x14001f830 WideCharToMultiByte
0x14001f838 HeapAlloc
0x14001f840 HeapFree
0x14001f848 LoadLibraryW
0x14001f850 GetProcAddress
0x14001f858 GetCurrentProcessId
0x14001f860 GetCurrentThreadId
0x14001f868 GetModuleFileNameW
0x14001f870 PeekNamedPipe
0x14001f878 TerminateProcess
0x14001f880 GetEnvironmentVariableW
0x14001f888 SetEnvironmentVariableW
0x14001f890 GetCurrentProcess
0x14001f898 DuplicateHandle
0x14001f8a0 CreatePipe
0x14001f8a8 CreateProcessW
0x14001f8b0 GetExitCodeProcess
0x14001f8b8 RtlLookupFunctionEntry
0x14001f8c0 RtlVirtualUnwind
0x14001f8c8 RemoveVectoredExceptionHandler
0x14001f8d0 AddVectoredExceptionHandler
0x14001f8d8 HeapSize
0x14001f8e0 MultiByteToWideChar
0x14001f8e8 CreateDirectoryW
0x14001f8f0 SetFileAttributesW
0x14001f8f8 GetTempPathW
0x14001f900 DeleteFileW
0x14001f908 GetCurrentDirectoryW
0x14001f910 SetCurrentDirectoryW
0x14001f918 CreateFileW
0x14001f920 SetFilePointer
0x14001f928 TlsFree
0x14001f930 TlsGetValue
0x14001f938 TlsSetValue
0x14001f940 TlsAlloc
0x14001f948 HeapReAlloc
0x14001f950 DeleteCriticalSection
0x14001f958 GetLastError
0x14001f960 SetLastError
0x14001f968 UnregisterWait
0x14001f970 GetCurrentThread
0x14001f978 RegisterWaitForSingleObject
SHELL32.DLL
0x14001f988 ShellExecuteExW
0x14001f990 SHGetFolderLocation
0x14001f998 SHGetPathFromIDListW
WINMM.DLL
0x14001f9a8 timeBeginPeriod
OLE32.DLL
0x14001f9b8 CoInitialize
0x14001f9c0 CoTaskMemFree
SHLWAPI.DLL
0x14001f9d0 PathAddBackslashW
0x14001f9d8 PathRenameExtensionW
0x14001f9e0 PathQuoteSpacesW
0x14001f9e8 PathRemoveArgsW
0x14001f9f0 PathRemoveBackslashW
USER32.DLL
0x14001fa00 CharUpperW
0x14001fa08 CharLowerW
0x14001fa10 MessageBoxW
0x14001fa18 DefWindowProcW
0x14001fa20 GetWindowLongPtrW
0x14001fa28 GetWindowTextLengthW
0x14001fa30 GetWindowTextW
0x14001fa38 EnableWindow
0x14001fa40 DestroyWindow
0x14001fa48 UnregisterClassW
0x14001fa50 LoadIconW
0x14001fa58 LoadCursorW
0x14001fa60 RegisterClassExW
0x14001fa68 IsWindowEnabled
0x14001fa70 GetSystemMetrics
0x14001fa78 CreateWindowExW
0x14001fa80 SetWindowLongPtrW
0x14001fa88 SendMessageW
0x14001fa90 SetFocus
0x14001fa98 CreateAcceleratorTableW
0x14001faa0 SetForegroundWindow
0x14001faa8 BringWindowToTop
0x14001fab0 GetMessageW
0x14001fab8 TranslateAcceleratorW
0x14001fac0 TranslateMessage
0x14001fac8 DispatchMessageW
0x14001fad0 DestroyAcceleratorTable
0x14001fad8 PostMessageW
0x14001fae0 GetForegroundWindow
0x14001fae8 GetWindowThreadProcessId
0x14001faf0 IsWindowVisible
0x14001faf8 EnumWindows
0x14001fb00 SetWindowPos
GDI32.DLL
0x14001fb10 GetStockObject
COMCTL32.DLL
0x14001fb20 InitCommonControlsEx
EAT(Export Address Table) is none