ScreenShot
| Created | 2023.11.07 11:30 | Machine | s1_win7_x6403 |
| Filename | tuc19.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | |||
| md5 | a8c3b73f59bdf41eb250cba92fa934f1 | ||
| sha256 | 7594f38bb18f4d19fba0a7531e3f507fec38d51dd37f4d098a765cc380842555 | ||
| ssdeep | 98304:pd6L0SvtWKyeH9P3gh9vgAfJyqzZb+PH18VEZHP2x7e:76L0Svt4EP3gh9vgigqzZbHVmHc7e | ||
| imphash | 80417b621299e3e1de617305557a3c68 | ||
| impfuzzy | 48:8cfp1rcQX0gebPCDr+ZbLdH9AOZGwt+Eu55T/lGB:8cfpdcqNebqDrmlHW2 | ||
Network IP location
Signature (12cnts)
| Level | Description |
|---|---|
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates executable files on the filesystem |
| notice | Drops an executable to the user AppData folder |
| notice | Queries for potentially installed applications |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (22cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Emotet_1_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Emotet_2_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | ConfuserEx_Zero | Confuser .NET | binaries (download) |
| watch | ConfuserEx_Zero | Confuser .NET | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | chm_file_format | chm file format | binaries (download) |
| info | DllRegisterServer_Zero | execute regsvr32.exe | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | mzp_file_format | MZP(Delphi) file format | binaries (download) |
| info | mzp_file_format | MZP(Delphi) file format | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
kernel32.dll
0x40c0b4 DeleteCriticalSection
0x40c0b8 LeaveCriticalSection
0x40c0bc EnterCriticalSection
0x40c0c0 InitializeCriticalSection
0x40c0c4 VirtualFree
0x40c0c8 VirtualAlloc
0x40c0cc LocalFree
0x40c0d0 LocalAlloc
0x40c0d4 WideCharToMultiByte
0x40c0d8 TlsSetValue
0x40c0dc TlsGetValue
0x40c0e0 MultiByteToWideChar
0x40c0e4 GetModuleHandleA
0x40c0e8 GetLastError
0x40c0ec GetCommandLineA
0x40c0f0 WriteFile
0x40c0f4 SetFilePointer
0x40c0f8 SetEndOfFile
0x40c0fc RtlUnwind
0x40c100 ReadFile
0x40c104 RaiseException
0x40c108 GetStdHandle
0x40c10c GetFileSize
0x40c110 GetSystemTime
0x40c114 GetFileType
0x40c118 ExitProcess
0x40c11c CreateFileA
0x40c120 CloseHandle
user32.dll
0x40c128 MessageBoxA
oleaut32.dll
0x40c130 VariantChangeTypeEx
0x40c134 VariantCopyInd
0x40c138 VariantClear
0x40c13c SysStringLen
0x40c140 SysAllocStringLen
advapi32.dll
0x40c148 RegQueryValueExA
0x40c14c RegOpenKeyExA
0x40c150 RegCloseKey
0x40c154 OpenProcessToken
0x40c158 LookupPrivilegeValueA
kernel32.dll
0x40c160 WriteFile
0x40c164 VirtualQuery
0x40c168 VirtualProtect
0x40c16c VirtualFree
0x40c170 VirtualAlloc
0x40c174 Sleep
0x40c178 SizeofResource
0x40c17c SetLastError
0x40c180 SetFilePointer
0x40c184 SetErrorMode
0x40c188 SetEndOfFile
0x40c18c RemoveDirectoryA
0x40c190 ReadFile
0x40c194 LockResource
0x40c198 LoadResource
0x40c19c LoadLibraryA
0x40c1a0 IsDBCSLeadByte
0x40c1a4 GetWindowsDirectoryA
0x40c1a8 GetVersionExA
0x40c1ac GetUserDefaultLangID
0x40c1b0 GetSystemInfo
0x40c1b4 GetSystemDefaultLCID
0x40c1b8 GetProcAddress
0x40c1bc GetModuleHandleA
0x40c1c0 GetModuleFileNameA
0x40c1c4 GetLocaleInfoA
0x40c1c8 GetLastError
0x40c1cc GetFullPathNameA
0x40c1d0 GetFileSize
0x40c1d4 GetFileAttributesA
0x40c1d8 GetExitCodeProcess
0x40c1dc GetEnvironmentVariableA
0x40c1e0 GetCurrentProcess
0x40c1e4 GetCommandLineA
0x40c1e8 InterlockedExchange
0x40c1ec FormatMessageA
0x40c1f0 FindResourceA
0x40c1f4 DeleteFileA
0x40c1f8 CreateProcessA
0x40c1fc CreateFileA
0x40c200 CreateDirectoryA
0x40c204 CloseHandle
user32.dll
0x40c20c TranslateMessage
0x40c210 SetWindowLongA
0x40c214 PeekMessageA
0x40c218 MsgWaitForMultipleObjects
0x40c21c MessageBoxA
0x40c220 LoadStringA
0x40c224 ExitWindowsEx
0x40c228 DispatchMessageA
0x40c22c DestroyWindow
0x40c230 CreateWindowExA
0x40c234 CallWindowProcA
0x40c238 CharPrevA
comctl32.dll
0x40c240 InitCommonControls
advapi32.dll
0x40c248 AdjustTokenPrivileges
EAT(Export Address Table) is none
kernel32.dll
0x40c0b4 DeleteCriticalSection
0x40c0b8 LeaveCriticalSection
0x40c0bc EnterCriticalSection
0x40c0c0 InitializeCriticalSection
0x40c0c4 VirtualFree
0x40c0c8 VirtualAlloc
0x40c0cc LocalFree
0x40c0d0 LocalAlloc
0x40c0d4 WideCharToMultiByte
0x40c0d8 TlsSetValue
0x40c0dc TlsGetValue
0x40c0e0 MultiByteToWideChar
0x40c0e4 GetModuleHandleA
0x40c0e8 GetLastError
0x40c0ec GetCommandLineA
0x40c0f0 WriteFile
0x40c0f4 SetFilePointer
0x40c0f8 SetEndOfFile
0x40c0fc RtlUnwind
0x40c100 ReadFile
0x40c104 RaiseException
0x40c108 GetStdHandle
0x40c10c GetFileSize
0x40c110 GetSystemTime
0x40c114 GetFileType
0x40c118 ExitProcess
0x40c11c CreateFileA
0x40c120 CloseHandle
user32.dll
0x40c128 MessageBoxA
oleaut32.dll
0x40c130 VariantChangeTypeEx
0x40c134 VariantCopyInd
0x40c138 VariantClear
0x40c13c SysStringLen
0x40c140 SysAllocStringLen
advapi32.dll
0x40c148 RegQueryValueExA
0x40c14c RegOpenKeyExA
0x40c150 RegCloseKey
0x40c154 OpenProcessToken
0x40c158 LookupPrivilegeValueA
kernel32.dll
0x40c160 WriteFile
0x40c164 VirtualQuery
0x40c168 VirtualProtect
0x40c16c VirtualFree
0x40c170 VirtualAlloc
0x40c174 Sleep
0x40c178 SizeofResource
0x40c17c SetLastError
0x40c180 SetFilePointer
0x40c184 SetErrorMode
0x40c188 SetEndOfFile
0x40c18c RemoveDirectoryA
0x40c190 ReadFile
0x40c194 LockResource
0x40c198 LoadResource
0x40c19c LoadLibraryA
0x40c1a0 IsDBCSLeadByte
0x40c1a4 GetWindowsDirectoryA
0x40c1a8 GetVersionExA
0x40c1ac GetUserDefaultLangID
0x40c1b0 GetSystemInfo
0x40c1b4 GetSystemDefaultLCID
0x40c1b8 GetProcAddress
0x40c1bc GetModuleHandleA
0x40c1c0 GetModuleFileNameA
0x40c1c4 GetLocaleInfoA
0x40c1c8 GetLastError
0x40c1cc GetFullPathNameA
0x40c1d0 GetFileSize
0x40c1d4 GetFileAttributesA
0x40c1d8 GetExitCodeProcess
0x40c1dc GetEnvironmentVariableA
0x40c1e0 GetCurrentProcess
0x40c1e4 GetCommandLineA
0x40c1e8 InterlockedExchange
0x40c1ec FormatMessageA
0x40c1f0 FindResourceA
0x40c1f4 DeleteFileA
0x40c1f8 CreateProcessA
0x40c1fc CreateFileA
0x40c200 CreateDirectoryA
0x40c204 CloseHandle
user32.dll
0x40c20c TranslateMessage
0x40c210 SetWindowLongA
0x40c214 PeekMessageA
0x40c218 MsgWaitForMultipleObjects
0x40c21c MessageBoxA
0x40c220 LoadStringA
0x40c224 ExitWindowsEx
0x40c228 DispatchMessageA
0x40c22c DestroyWindow
0x40c230 CreateWindowExA
0x40c234 CallWindowProcA
0x40c238 CharPrevA
comctl32.dll
0x40c240 InitCommonControls
advapi32.dll
0x40c248 AdjustTokenPrivileges
EAT(Export Address Table) is none