popup

Report - two0710.exe

Malicious Library PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.10.08 10:47 Machine s1_win7_x6401
Filename two0710.exe
Type PE32 executable (console) Intel 80386, for MS Windows
AI Score
6
 Behavior Score
7.8
ZERO API file : malware
VT API (file) 43 detected (AIDetectMalware, malicious, high confidence, GenericKD, PasswordStealer, Save, Kryptik, confidence, 100%, ZexaF, yuW@a4LYXMhi, Attribute, HighConfidence, HUOL, score, Eflw, XPACK, Gen5, SMOKELOADER, YXDJGZ, high, ai score=82, RedLine, Detected, Artemis, unsafe, Chgt, AlfB8UiyufG, Static AI, Malicious PE, PossibleThreat)
md5 f646c097913ec9dc3897ec3b5e452919
sha256 a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448
ssdeep 12288:kDoSU8AcJIoxecqF2kTJFLb1ChbNdP+kfXuBuKUv0HJg0YBmgMylojOPcoDYyFtz:kcFpQmyojOwUPXzqSd
imphash 562e65e023e87b36f1380397f644b9df
impfuzzy 24:WjKNDoryelqOovS2cfOdgFQ8Ryv4/J3IjT4+jluJsgETE:gQcfOdHeMc+jsJdETE
  Network IP location

Signature (19cnts)

Level Description
danger File has been identified by 43 AntiVirus engines on VirusTotal as malicious
watch Collects information about installed applications
watch Communicates with host for which no DNS query was performed
watch Executes one or more WMI queries
watch Harvests credentials from local FTP client softwares
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Executes one or more WMI queries which can be used to identify virtual machines
notice One or more potentially interesting buffers were extracted
notice Queries for potentially installed applications
notice Steals private information from local Internet browsers
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Tries to locate where the browsers are installed
info Uses Windows APIs to generate a cryptographic key

Rules (3cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
176.123.9.142
whois
MD Alexhost Srl 176.123.9.142 mailcious

Suricata ids

ET INFO Microsoft net.tcp Connection Initialization Activity
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC Activity - MSValue (Outbound)
ET MALWARE Redline Stealer Activity (Response)

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x40b000 WaitForSingleObject
 0x40b004 Sleep
 0x40b008 CreateThread
 0x40b00c lstrlenW
 0x40b010 VirtualProtect
 0x40b014 GetProcAddress
 0x40b018 LoadLibraryA
 0x40b01c VirtualAlloc
 0x40b020 LockResource
 0x40b024 LoadResource
 0x40b028 SizeofResource
 0x40b02c FindResourceW
 0x40b030 GetModuleHandleW
 0x40b034 GetModuleHandleA
 0x40b038 FreeConsole
 0x40b03c GetLastError
 0x40b040 HeapFree
 0x40b044 HeapAlloc
 0x40b048 GetCommandLineA
 0x40b04c HeapCreate
 0x40b050 VirtualFree
 0x40b054 DeleteCriticalSection
 0x40b058 LeaveCriticalSection
 0x40b05c EnterCriticalSection
 0x40b060 HeapReAlloc
 0x40b064 ExitProcess
 0x40b068 WriteFile
 0x40b06c GetStdHandle
 0x40b070 GetModuleFileNameA
 0x40b074 SetUnhandledExceptionFilter
 0x40b078 FreeEnvironmentStringsA
 0x40b07c GetEnvironmentStrings
 0x40b080 FreeEnvironmentStringsW
 0x40b084 WideCharToMultiByte
 0x40b088 GetEnvironmentStringsW
 0x40b08c SetHandleCount
 0x40b090 GetFileType
 0x40b094 GetStartupInfoA
 0x40b098 TlsGetValue
 0x40b09c TlsAlloc
 0x40b0a0 TlsSetValue
 0x40b0a4 TlsFree
 0x40b0a8 InterlockedIncrement
 0x40b0ac SetLastError
 0x40b0b0 GetCurrentThreadId
 0x40b0b4 InterlockedDecrement
 0x40b0b8 QueryPerformanceCounter
 0x40b0bc GetTickCount
 0x40b0c0 GetCurrentProcessId
 0x40b0c4 GetSystemTimeAsFileTime
 0x40b0c8 TerminateProcess
 0x40b0cc GetCurrentProcess
 0x40b0d0 UnhandledExceptionFilter
 0x40b0d4 IsDebuggerPresent
 0x40b0d8 InitializeCriticalSectionAndSpinCount
 0x40b0dc RtlUnwind
 0x40b0e0 GetCPInfo
 0x40b0e4 GetACP
 0x40b0e8 GetOEMCP
 0x40b0ec IsValidCodePage
 0x40b0f0 HeapSize
 0x40b0f4 GetLocaleInfoA
 0x40b0f8 LCMapStringA
 0x40b0fc MultiByteToWideChar
 0x40b100 LCMapStringW
 0x40b104 GetStringTypeA
 0x40b108 GetStringTypeW
USER32.dll
 0x40b110 GetWindowTextLengthW
ole32.dll
 0x40b118 CoMarshalHresult

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure