ScreenShot
| Created | 2023.08.28 07:37 | Machine | s1_win7_x6403 |
| Filename | religionprosig.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 20 detected (Common, malicious, high confidence, score, Vqy9, Attribute, HighConfidence, qwiobx, FalseSign, Cnhl, Nekark, lntgz, AMADEY, YXDHZZ, Artemis, moderate, Casdet, unsafe, confidence) | ||
| md5 | 3eb7278ffb8ab7d3f190a56756239e64 | ||
| sha256 | 4881dd4ae775b3a32eff68d859c28f215567bb409dde2fdd9f92d65f3f679050 | ||
| ssdeep | 98304:UYnLcGFW5laRMD5uNPZvTR33Xv/sroQY3cJe:tnLcGs5la2DaVZv/sMF3H | ||
| imphash | 4cea7ae85c87ddc7295d39ff9cda31d1 | ||
| impfuzzy | 48:mPkNSpUOU4iLeyMuM9QBt3S1W8KEl4LTFGACupNXR6x9pg1go5E95dSva5pUrz+L:ikmUZ4iLfMuMqBt3S1WwfSbmaeGipT | ||
Network IP location
Signature (23cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 20 AntiVirus engines on VirusTotal as malicious |
| watch | Creates a suspicious Powershell process |
| watch | Installs itself for autorun at Windows startup |
| watch | Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Poweshell is sending data to a remote host |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | URL downloaded by powershell script |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (41cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Emotet_RL_Gen_Zero | Win32 Trojan Emotet | binaries (upload) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (upload) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | memory |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | CAB_file_format | CAB archive file | binaries (upload) |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PowerShell | PowerShell script | scripts |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
PE API
IAT(Import Address Table) Library
ADVAPI32.dll
0x140009150 GetTokenInformation
0x140009158 RegDeleteValueA
0x140009160 RegOpenKeyExA
0x140009168 RegQueryInfoKeyA
0x140009170 FreeSid
0x140009178 OpenProcessToken
0x140009180 RegSetValueExA
0x140009188 RegCreateKeyExA
0x140009190 LookupPrivilegeValueA
0x140009198 AllocateAndInitializeSid
0x1400091a0 RegQueryValueExA
0x1400091a8 EqualSid
0x1400091b0 RegCloseKey
0x1400091b8 AdjustTokenPrivileges
KERNEL32.dll
0x140009210 _lopen
0x140009218 _llseek
0x140009220 CompareStringA
0x140009228 GetLastError
0x140009230 GetFileAttributesA
0x140009238 GetSystemDirectoryA
0x140009240 LoadLibraryA
0x140009248 DeleteFileA
0x140009250 GlobalAlloc
0x140009258 GlobalFree
0x140009260 CloseHandle
0x140009268 WritePrivateProfileStringA
0x140009270 IsDBCSLeadByte
0x140009278 GetWindowsDirectoryA
0x140009280 SetFileAttributesA
0x140009288 GetProcAddress
0x140009290 GlobalLock
0x140009298 LocalFree
0x1400092a0 RemoveDirectoryA
0x1400092a8 FreeLibrary
0x1400092b0 _lclose
0x1400092b8 CreateDirectoryA
0x1400092c0 GetPrivateProfileIntA
0x1400092c8 GetPrivateProfileStringA
0x1400092d0 GlobalUnlock
0x1400092d8 ReadFile
0x1400092e0 SizeofResource
0x1400092e8 WriteFile
0x1400092f0 GetDriveTypeA
0x1400092f8 LoadLibraryExA
0x140009300 SetFileTime
0x140009308 SetFilePointer
0x140009310 FindResourceA
0x140009318 CreateMutexA
0x140009320 GetVolumeInformationA
0x140009328 WaitForSingleObject
0x140009330 GetCurrentDirectoryA
0x140009338 FreeResource
0x140009340 GetVersion
0x140009348 SetCurrentDirectoryA
0x140009350 GetTempPathA
0x140009358 LocalFileTimeToFileTime
0x140009360 CreateFileA
0x140009368 SetEvent
0x140009370 TerminateThread
0x140009378 GetVersionExA
0x140009380 LockResource
0x140009388 GetSystemInfo
0x140009390 CreateThread
0x140009398 ResetEvent
0x1400093a0 LoadResource
0x1400093a8 ExitProcess
0x1400093b0 GetModuleHandleW
0x1400093b8 CreateProcessA
0x1400093c0 FormatMessageA
0x1400093c8 GetTempFileNameA
0x1400093d0 DosDateTimeToFileTime
0x1400093d8 CreateEventA
0x1400093e0 GetExitCodeProcess
0x1400093e8 ExpandEnvironmentStringsA
0x1400093f0 LocalAlloc
0x1400093f8 lstrcmpA
0x140009400 FindNextFileA
0x140009408 GetCurrentProcess
0x140009410 FindFirstFileA
0x140009418 GetModuleFileNameA
0x140009420 GetShortPathNameA
0x140009428 Sleep
0x140009430 GetStartupInfoW
0x140009438 RtlCaptureContext
0x140009440 RtlLookupFunctionEntry
0x140009448 RtlVirtualUnwind
0x140009450 UnhandledExceptionFilter
0x140009458 SetUnhandledExceptionFilter
0x140009460 TerminateProcess
0x140009468 QueryPerformanceCounter
0x140009470 GetCurrentProcessId
0x140009478 GetCurrentThreadId
0x140009480 GetSystemTimeAsFileTime
0x140009488 GetTickCount
0x140009490 EnumResourceLanguagesA
0x140009498 GetDiskFreeSpaceA
0x1400094a0 MulDiv
0x1400094a8 FindClose
GDI32.dll
0x140009200 GetDeviceCaps
USER32.dll
0x1400094b8 ShowWindow
0x1400094c0 MsgWaitForMultipleObjects
0x1400094c8 SetWindowPos
0x1400094d0 GetDC
0x1400094d8 GetWindowRect
0x1400094e0 DispatchMessageA
0x1400094e8 GetSystemMetrics
0x1400094f0 CallWindowProcA
0x1400094f8 SetWindowTextA
0x140009500 MessageBoxA
0x140009508 SendDlgItemMessageA
0x140009510 SendMessageA
0x140009518 GetDlgItem
0x140009520 DialogBoxIndirectParamA
0x140009528 GetWindowLongPtrA
0x140009530 SetWindowLongPtrA
0x140009538 SetForegroundWindow
0x140009540 ReleaseDC
0x140009548 EnableWindow
0x140009550 CharNextA
0x140009558 LoadStringA
0x140009560 CharPrevA
0x140009568 EndDialog
0x140009570 MessageBeep
0x140009578 ExitWindowsEx
0x140009580 SetDlgItemTextA
0x140009588 CharUpperA
0x140009590 GetDesktopWindow
0x140009598 PeekMessageA
0x1400095a0 GetDlgItemTextA
msvcrt.dll
0x1400095d0 ?terminate@@YAXXZ
0x1400095d8 _commode
0x1400095e0 _fmode
0x1400095e8 _acmdln
0x1400095f0 __C_specific_handler
0x1400095f8 memset
0x140009600 __setusermatherr
0x140009608 _ismbblead
0x140009610 _cexit
0x140009618 _exit
0x140009620 exit
0x140009628 __set_app_type
0x140009630 __getmainargs
0x140009638 _amsg_exit
0x140009640 _XcptFilter
0x140009648 memcpy_s
0x140009650 _vsnprintf
0x140009658 _initterm
0x140009660 memcpy
COMCTL32.dll
0x1400091c8 None
Cabinet.dll
0x1400091d8 None
0x1400091e0 None
0x1400091e8 None
0x1400091f0 None
VERSION.dll
0x1400095b0 VerQueryValueA
0x1400095b8 GetFileVersionInfoSizeA
0x1400095c0 GetFileVersionInfoA
EAT(Export Address Table) is none
ADVAPI32.dll
0x140009150 GetTokenInformation
0x140009158 RegDeleteValueA
0x140009160 RegOpenKeyExA
0x140009168 RegQueryInfoKeyA
0x140009170 FreeSid
0x140009178 OpenProcessToken
0x140009180 RegSetValueExA
0x140009188 RegCreateKeyExA
0x140009190 LookupPrivilegeValueA
0x140009198 AllocateAndInitializeSid
0x1400091a0 RegQueryValueExA
0x1400091a8 EqualSid
0x1400091b0 RegCloseKey
0x1400091b8 AdjustTokenPrivileges
KERNEL32.dll
0x140009210 _lopen
0x140009218 _llseek
0x140009220 CompareStringA
0x140009228 GetLastError
0x140009230 GetFileAttributesA
0x140009238 GetSystemDirectoryA
0x140009240 LoadLibraryA
0x140009248 DeleteFileA
0x140009250 GlobalAlloc
0x140009258 GlobalFree
0x140009260 CloseHandle
0x140009268 WritePrivateProfileStringA
0x140009270 IsDBCSLeadByte
0x140009278 GetWindowsDirectoryA
0x140009280 SetFileAttributesA
0x140009288 GetProcAddress
0x140009290 GlobalLock
0x140009298 LocalFree
0x1400092a0 RemoveDirectoryA
0x1400092a8 FreeLibrary
0x1400092b0 _lclose
0x1400092b8 CreateDirectoryA
0x1400092c0 GetPrivateProfileIntA
0x1400092c8 GetPrivateProfileStringA
0x1400092d0 GlobalUnlock
0x1400092d8 ReadFile
0x1400092e0 SizeofResource
0x1400092e8 WriteFile
0x1400092f0 GetDriveTypeA
0x1400092f8 LoadLibraryExA
0x140009300 SetFileTime
0x140009308 SetFilePointer
0x140009310 FindResourceA
0x140009318 CreateMutexA
0x140009320 GetVolumeInformationA
0x140009328 WaitForSingleObject
0x140009330 GetCurrentDirectoryA
0x140009338 FreeResource
0x140009340 GetVersion
0x140009348 SetCurrentDirectoryA
0x140009350 GetTempPathA
0x140009358 LocalFileTimeToFileTime
0x140009360 CreateFileA
0x140009368 SetEvent
0x140009370 TerminateThread
0x140009378 GetVersionExA
0x140009380 LockResource
0x140009388 GetSystemInfo
0x140009390 CreateThread
0x140009398 ResetEvent
0x1400093a0 LoadResource
0x1400093a8 ExitProcess
0x1400093b0 GetModuleHandleW
0x1400093b8 CreateProcessA
0x1400093c0 FormatMessageA
0x1400093c8 GetTempFileNameA
0x1400093d0 DosDateTimeToFileTime
0x1400093d8 CreateEventA
0x1400093e0 GetExitCodeProcess
0x1400093e8 ExpandEnvironmentStringsA
0x1400093f0 LocalAlloc
0x1400093f8 lstrcmpA
0x140009400 FindNextFileA
0x140009408 GetCurrentProcess
0x140009410 FindFirstFileA
0x140009418 GetModuleFileNameA
0x140009420 GetShortPathNameA
0x140009428 Sleep
0x140009430 GetStartupInfoW
0x140009438 RtlCaptureContext
0x140009440 RtlLookupFunctionEntry
0x140009448 RtlVirtualUnwind
0x140009450 UnhandledExceptionFilter
0x140009458 SetUnhandledExceptionFilter
0x140009460 TerminateProcess
0x140009468 QueryPerformanceCounter
0x140009470 GetCurrentProcessId
0x140009478 GetCurrentThreadId
0x140009480 GetSystemTimeAsFileTime
0x140009488 GetTickCount
0x140009490 EnumResourceLanguagesA
0x140009498 GetDiskFreeSpaceA
0x1400094a0 MulDiv
0x1400094a8 FindClose
GDI32.dll
0x140009200 GetDeviceCaps
USER32.dll
0x1400094b8 ShowWindow
0x1400094c0 MsgWaitForMultipleObjects
0x1400094c8 SetWindowPos
0x1400094d0 GetDC
0x1400094d8 GetWindowRect
0x1400094e0 DispatchMessageA
0x1400094e8 GetSystemMetrics
0x1400094f0 CallWindowProcA
0x1400094f8 SetWindowTextA
0x140009500 MessageBoxA
0x140009508 SendDlgItemMessageA
0x140009510 SendMessageA
0x140009518 GetDlgItem
0x140009520 DialogBoxIndirectParamA
0x140009528 GetWindowLongPtrA
0x140009530 SetWindowLongPtrA
0x140009538 SetForegroundWindow
0x140009540 ReleaseDC
0x140009548 EnableWindow
0x140009550 CharNextA
0x140009558 LoadStringA
0x140009560 CharPrevA
0x140009568 EndDialog
0x140009570 MessageBeep
0x140009578 ExitWindowsEx
0x140009580 SetDlgItemTextA
0x140009588 CharUpperA
0x140009590 GetDesktopWindow
0x140009598 PeekMessageA
0x1400095a0 GetDlgItemTextA
msvcrt.dll
0x1400095d0 ?terminate@@YAXXZ
0x1400095d8 _commode
0x1400095e0 _fmode
0x1400095e8 _acmdln
0x1400095f0 __C_specific_handler
0x1400095f8 memset
0x140009600 __setusermatherr
0x140009608 _ismbblead
0x140009610 _cexit
0x140009618 _exit
0x140009620 exit
0x140009628 __set_app_type
0x140009630 __getmainargs
0x140009638 _amsg_exit
0x140009640 _XcptFilter
0x140009648 memcpy_s
0x140009650 _vsnprintf
0x140009658 _initterm
0x140009660 memcpy
COMCTL32.dll
0x1400091c8 None
Cabinet.dll
0x1400091d8 None
0x1400091e0 None
0x1400091e8 None
0x1400091f0 None
VERSION.dll
0x1400095b0 VerQueryValueA
0x1400095b8 GetFileVersionInfoSizeA
0x1400095c0 GetFileVersionInfoA
EAT(Export Address Table) is none