ScreenShot
| Created | 2023.09.30 12:58 | Machine | s1_win7_x6403 |
| Filename | Services.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 37 detected (AIDetectMalware, GenericKD, Artemis, RedLineStealer, Vmp6, VMProtect, ZexaF, @J0@aKjs31jO, ABRisk, NYOS, Attribute, HighConfidence, malicious, high confidence, AU suspicious, DropperX, Siggen21, PRIVATELOADER, YXDI3Z, high, score, Static AI, Suspicious PE, Znyonm, Detected, BScope, TrojanPSW, Coins, ai score=81, unsafe, Generic@AI, RDML, OleDoKY, 5poeqwjOhiYanA, PossibleThreat) | ||
| md5 | b9a096baebdf8e44368e9724da8e56dd | ||
| sha256 | 2157d146a890d32c5ba49f31fa1840e5b0d56e4dd0bbf5f8b14cc4e482a47bef | ||
| ssdeep | 98304:OJhDwVgp97vYIP8nq5g88RzpufFdx37e5vQCxt2xWwESu:OYVgLs1qlYp0Ff37exTjJ | ||
| imphash | a30456d356096db6c5256124ce90b11d | ||
| impfuzzy | 6:/oPBT8ba1bK1eFML1Kf/JLGMZ/OiBJAEnERGDW:gPBT3ZGMZGqAJcDW | ||
Network IP location
Signature (26cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 37 AntiVirus engines on VirusTotal as malicious |
| watch | Attempts to create or modify system certificates |
| watch | Communicates with host for which no DNS query was performed |
| watch | Installs itself for autorun at Windows startup |
| watch | Network communications indicative of possible code injection originated from the process services.exe |
| watch | Uses Sysinternals tools in order to add additional command line functionality |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An executable file was downloaded by the process services.exe |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Looks up the external IP address |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Sends data using the HTTP POST Method |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is likely packed with VMProtect |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (8cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (28cnts) ?
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
ET INFO Executable Download from dotted-quad Host
ET INFO Packed Executable Download
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET INFO TLS Handshake Failure
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET)
ET INFO Executable Download from dotted-quad Host
ET INFO Packed Executable Download
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x61f000 CreateProcessA
ADVAPI32.dll
0x61f008 CreateServiceA
SHELL32.dll
0x61f010 SHGetSpecialFolderPathA
SETUPAPI.dll
0x61f018 SetupDiGetClassDevsA
KERNEL32.dll
0x61f020 LocalAlloc
0x61f024 LocalFree
0x61f028 GetModuleFileNameW
0x61f02c ExitProcess
0x61f030 LoadLibraryA
0x61f034 GetModuleHandleA
0x61f038 GetProcAddress
EAT(Export Address Table) is none
KERNEL32.dll
0x61f000 CreateProcessA
ADVAPI32.dll
0x61f008 CreateServiceA
SHELL32.dll
0x61f010 SHGetSpecialFolderPathA
SETUPAPI.dll
0x61f018 SetupDiGetClassDevsA
KERNEL32.dll
0x61f020 LocalAlloc
0x61f024 LocalFree
0x61f028 GetModuleFileNameW
0x61f02c ExitProcess
0x61f030 LoadLibraryA
0x61f034 GetModuleHandleA
0x61f038 GetProcAddress
EAT(Export Address Table) is none