Report - Lwsecure_beta.exe

Gen1 Malicious Library UPX PE File PE64 ftp OS Processor Check
ScreenShot
Created 2023.11.20 09:55 Machine s1_win7_x6403
Filename Lwsecure_beta.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score
1
Behavior Score
2.0
ZERO API file : malware
VT API (file) 38 detected (Penguish, GenericKD, Artemis, Rugmi, Ssmw, Redcap, lfont, LUMMASTEALER, YXDKRZ, ai score=89, Detected, Znyonm, 0A4TRV, unsafe, Chgt, CLOUD, MALICIOUS, confidence, 100%)
md5 5c320953f68110bc451f42495ef0a296
sha256 e6001e502a2913ee4a5f96c0203a146d84e41844675d3d65041e79aca532f20a
ssdeep 49152:OPX0ONuiBg8FsUMQMX/mH/xnJhMrqF3Ie73PpwfeTPYZylg5QrFRbZS2bvLra+Po:quirsUMti/jC2eiMmqQ7bZSoXPo
imphash 5f091eecefc1b49cd7a2a9cf6847cbb0
impfuzzy 96:dLa0ZccocDweXNIVLWj8NcgJ+CX1pZ0szuoLLtZPL+0BA7zDaVvX0fL4IcMV/7Ne:dxczLWcF7WofnPL+i4iVvX6jV/7NUEe
  Network IP location

Signature (5cnts)

Level Description
danger File has been identified by 38 AntiVirus engines on VirusTotal as malicious
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (7cnts)

Level Name Description Collection
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info ftp_command ftp command binaries (upload)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
app.physics.wisc.edu US WISC-MADISON-AS 128.104.160.19 clean
128.104.160.19 US WISC-MADISON-AS 128.104.160.19 clean

Suricata ids

PE API

IAT(Import Address Table) Library

COMCTL32.dll
 0x1401a9078 CreatePropertySheetPageW
 0x1401a9080 PropertySheetW
 0x1401a9088 InitCommonControlsEx
WS2_32.dll
 0x1401a9948 getaddrinfo
 0x1401a9950 freeaddrinfo
 0x1401a9958 ioctlsocket
 0x1401a9960 listen
 0x1401a9968 accept
 0x1401a9970 WSAPoll
 0x1401a9978 send
 0x1401a9980 getpeername
 0x1401a9988 connect
 0x1401a9990 WSAGetLastError
 0x1401a9998 ntohl
 0x1401a99a0 WSAAddressToStringW
 0x1401a99a8 htonl
 0x1401a99b0 htons
 0x1401a99b8 WSACleanup
 0x1401a99c0 WSAStartup
 0x1401a99c8 select
 0x1401a99d0 ntohs
 0x1401a99d8 getsockname
 0x1401a99e0 setsockopt
 0x1401a99e8 recv
 0x1401a99f0 ind
 0x1401a99f8 socket
 0x1401a9a00 WSASetLastError
 0x1401a9a08 closesocket
 0x1401a9a10 getsockopt
 0x1401a9a18 gethostname
IPHLPAPI.DLL
 0x1401a90e8 GetAdaptersInfo
 0x1401a90f0 GetAdaptersAddresses
SHLWAPI.dll
 0x1401a9668 PathIsURLW
 0x1401a9670 PathIsRelativeW
 0x1401a9678 PathRelativePathToW
 0x1401a9680 PathIsSameRootW
 0x1401a9688 PathRemoveBackslashW
 0x1401a9690 PathAddBackslashW
 0x1401a9698 PathAppendW
 0x1401a96a0 PathFileExistsW
RPCRT4.dll
 0x1401a9618 UuidCreate
 0x1401a9620 UuidToStringW
fwpuclnt.dll
 0x1401a9a28 FwpmTransactionCommit0
 0x1401a9a30 FwpmEngineClose0
 0x1401a9a38 FwpmEngineOpen0
 0x1401a9a40 FwpmTransactionBegin0
 0x1401a9a48 FwpmCalloutAdd0
 0x1401a9a50 FwpmSubLayerAdd0
 0x1401a9a58 FwpmFilterAdd0
KERNEL32.dll
 0x1401a9100 GetTimeFormatW
 0x1401a9108 GetDateFormatW
 0x1401a9110 GetModuleHandleW
 0x1401a9118 FindResourceW
 0x1401a9120 SizeofResource
 0x1401a9128 LoadResource
 0x1401a9130 LockResource
 0x1401a9138 FormatMessageA
 0x1401a9140 LocalFree
 0x1401a9148 GetLastError
 0x1401a9150 GetModuleFileNameW
 0x1401a9158 MultiByteToWideChar
 0x1401a9160 WideCharToMultiByte
 0x1401a9168 CreateFileW
 0x1401a9170 GetFileSize
 0x1401a9178 CloseHandle
 0x1401a9180 CreateFileMappingW
 0x1401a9188 MapViewOfFile
 0x1401a9190 UnmapViewOfFile
 0x1401a9198 CopyFileW
 0x1401a91a0 DeleteFileW
 0x1401a91a8 MoveFileExW
 0x1401a91b0 Sleep
 0x1401a91b8 DeviceIoControl
 0x1401a91c0 CancelIo
 0x1401a91c8 GetOverlappedResult
 0x1401a91d0 LoadLibraryW
 0x1401a91d8 GetProcAddress
 0x1401a91e0 VirtualProtect
 0x1401a91e8 WriteProcessMemory
 0x1401a91f0 GetCurrentProcess
 0x1401a91f8 GetCurrentThreadId
 0x1401a9200 GetCurrentProcessId
 0x1401a9208 EnterCriticalSection
 0x1401a9210 LeaveCriticalSection
 0x1401a9218 TryEnterCriticalSection
 0x1401a9220 GetLocalTime
 0x1401a9228 CreateDirectoryW
 0x1401a9230 GlobalAlloc
 0x1401a9238 GlobalLock
 0x1401a9240 GlobalUnlock
 0x1401a9248 GetFileTime
 0x1401a9250 InitializeCriticalSection
 0x1401a9258 DeleteCriticalSection
 0x1401a9260 ResumeThread
 0x1401a9268 SetThreadPriority
 0x1401a9270 GetTickCount
 0x1401a9278 SetProcessWorkingSetSize
 0x1401a9280 GetVersionExW
 0x1401a9288 GetSystemInfo
 0x1401a9290 OpenMutexW
 0x1401a9298 CreateMutexW
 0x1401a92a0 SetUnhandledExceptionFilter
 0x1401a92a8 CreateEventW
 0x1401a92b0 CreateThread
 0x1401a92b8 SetEvent
 0x1401a92c0 WaitForSingleObject
 0x1401a92c8 WaitForMultipleObjects
 0x1401a92d0 ResetEvent
 0x1401a92d8 FreeResource
 0x1401a92e0 MulDiv
 0x1401a92e8 ReleaseMutex
 0x1401a92f0 FormatMessageW
 0x1401a92f8 GetStartupInfoW
 0x1401a9300 GetEnvironmentStringsW
 0x1401a9308 TlsSetValue
 0x1401a9310 TlsGetValue
 0x1401a9318 TlsAlloc
 0x1401a9320 TerminateProcess
 0x1401a9328 CompareStringW
 0x1401a9330 RtlVirtualUnwind
 0x1401a9338 RtlCaptureContext
 0x1401a9340 InitializeCriticalSectionAndSpinCount
 0x1401a9348 RtlUnwindEx
 0x1401a9350 RtlLookupFunctionEntry
 0x1401a9358 RaiseException
 0x1401a9360 PeekNamedPipe
 0x1401a9368 GetFileInformationByHandle
 0x1401a9370 SetFilePointerEx
 0x1401a9378 IsProcessorFeaturePresent
 0x1401a9380 IsDebuggerPresent
 0x1401a9388 GetCommandLineW
 0x1401a9390 GetCPInfo
 0x1401a9398 FileTimeToSystemTime
 0x1401a93a0 GetDriveTypeW
 0x1401a93a8 FindFirstFileExW
 0x1401a93b0 FindClose
 0x1401a93b8 FileTimeToLocalFileTime
 0x1401a93c0 LoadLibraryExW
 0x1401a93c8 ExitThread
 0x1401a93d0 GetFileType
 0x1401a93d8 RtlPcToFileHeader
 0x1401a93e0 DecodePointer
 0x1401a93e8 EncodePointer
 0x1401a93f0 GetStringTypeW
 0x1401a93f8 ExpandEnvironmentStringsW
 0x1401a9400 SetLastError
 0x1401a9408 SleepEx
 0x1401a9410 DeleteFileA
 0x1401a9418 AreFileApisANSI
 0x1401a9420 GetSystemTime
 0x1401a9428 GetTempPathA
 0x1401a9430 GetVersionExA
 0x1401a9438 OutputDebugStringA
 0x1401a9440 GetFileAttributesExW
 0x1401a9448 GetDiskFreeSpaceA
 0x1401a9450 CreateFileMappingA
 0x1401a9458 LoadLibraryA
 0x1401a9460 GetDiskFreeSpaceW
 0x1401a9468 LockFileEx
 0x1401a9470 HeapSize
 0x1401a9478 GetTempPathW
 0x1401a9480 FlushFileBuffers
 0x1401a9488 GetFileAttributesW
 0x1401a9490 HeapValidate
 0x1401a9498 HeapCreate
 0x1401a94a0 GetFileAttributesA
 0x1401a94a8 HeapDestroy
 0x1401a94b0 GetSystemTimeAsFileTime
 0x1401a94b8 GetProcessHeap
 0x1401a94c0 UnlockFileEx
 0x1401a94c8 OutputDebugStringW
 0x1401a94d0 LockFile
 0x1401a94d8 UnlockFile
 0x1401a94e0 HeapFree
 0x1401a94e8 QueryPerformanceCounter
 0x1401a94f0 SystemTimeToFileTime
 0x1401a94f8 HeapAlloc
 0x1401a9500 FreeLibrary
 0x1401a9508 SetEndOfFile
 0x1401a9510 HeapReAlloc
 0x1401a9518 GetFullPathNameA
 0x1401a9520 GetFullPathNameW
 0x1401a9528 ReadFile
 0x1401a9530 WriteFile
 0x1401a9538 SetEnvironmentVariableA
 0x1401a9540 SetFilePointer
 0x1401a9548 CreateFileA
 0x1401a9550 FreeEnvironmentStringsW
 0x1401a9558 GetConsoleCP
 0x1401a9560 GetConsoleMode
 0x1401a9568 LCMapStringW
 0x1401a9570 IsValidLocale
 0x1401a9578 GetLocaleInfoW
 0x1401a9580 ReadConsoleW
 0x1401a9588 GetUserDefaultLCID
 0x1401a9590 EnumSystemLocalesW
 0x1401a9598 GetStdHandle
 0x1401a95a0 ExitProcess
 0x1401a95a8 IsValidCodePage
 0x1401a95b0 GetModuleHandleExW
 0x1401a95b8 GetACP
 0x1401a95c0 GetOEMCP
 0x1401a95c8 UnhandledExceptionFilter
 0x1401a95d0 SetStdHandle
 0x1401a95d8 GetTimeZoneInformation
 0x1401a95e0 GetCurrentDirectoryW
 0x1401a95e8 SetEnvironmentVariableW
 0x1401a95f0 WriteConsoleW
 0x1401a95f8 TlsFree
USER32.dll
 0x1401a96b0 ReleaseDC
 0x1401a96b8 GetDesktopWindow
 0x1401a96c0 CheckRadioButton
 0x1401a96c8 SystemParametersInfoW
 0x1401a96d0 IsWindowVisible
 0x1401a96d8 GetDC
 0x1401a96e0 DestroyWindow
 0x1401a96e8 SetDlgItemTextA
 0x1401a96f0 SendMessageW
 0x1401a96f8 LoadIconW
 0x1401a9700 EndDialog
 0x1401a9708 GetParent
 0x1401a9710 LoadStringW
 0x1401a9718 EnableWindow
 0x1401a9720 GetWindowTextLengthW
 0x1401a9728 GetDlgItem
 0x1401a9730 SetDlgItemTextW
 0x1401a9738 SetDlgItemInt
 0x1401a9740 GetDlgItemInt
 0x1401a9748 TranslateMessage
 0x1401a9750 GetMessageW
 0x1401a9758 SendNotifyMessageW
 0x1401a9760 CheckMenuItem
 0x1401a9768 GetCursorPos
 0x1401a9770 GetAncestor
 0x1401a9778 WindowFromPoint
 0x1401a9780 GetSystemMetrics
 0x1401a9788 RegisterWindowMessageW
 0x1401a9790 PostQuitMessage
 0x1401a9798 KillTimer
 0x1401a97a0 LoadImageW
 0x1401a97a8 SetTimer
 0x1401a97b0 AnimateWindow
 0x1401a97b8 InsertMenuItemW
 0x1401a97c0 PostMessageW
 0x1401a97c8 InsertMenuW
 0x1401a97d0 GetSubMenu
 0x1401a97d8 LoadMenuW
 0x1401a97e0 SetWindowTextW
 0x1401a97e8 DestroyMenu
 0x1401a97f0 TrackPopupMenuEx
 0x1401a97f8 SetForegroundWindow
 0x1401a9800 AppendMenuW
 0x1401a9808 CreatePopupMenu
 0x1401a9810 CloseClipboard
 0x1401a9818 SetClipboardData
 0x1401a9820 EmptyClipboard
 0x1401a9828 OpenClipboard
 0x1401a9830 CreateDialogParamW
 0x1401a9838 CreateWindowExW
 0x1401a9840 MapDialogRect
 0x1401a9848 ShowWindow
 0x1401a9850 SetWindowPos
 0x1401a9858 CallWindowProcW
 0x1401a9860 SendDlgItemMessageW
 0x1401a9868 GetDlgItemTextW
 0x1401a9870 GetMenu
 0x1401a9878 MoveWindow
 0x1401a9880 SetFocus
 0x1401a9888 EndDeferWindowPos
 0x1401a9890 DeferWindowPos
 0x1401a9898 BeginDeferWindowPos
 0x1401a98a0 GetWindowRect
 0x1401a98a8 MessageBoxW
 0x1401a98b0 DialogBoxParamW
 0x1401a98b8 RegisterClassW
 0x1401a98c0 LoadCursorW
 0x1401a98c8 DefWindowProcW
 0x1401a98d0 EndPaint
 0x1401a98d8 FillRect
 0x1401a98e0 BeginPaint
 0x1401a98e8 GetClientRect
 0x1401a98f0 GetDlgCtrlID
 0x1401a98f8 InvalidateRect
 0x1401a9900 GetWindowLongW
 0x1401a9908 SetWindowLongW
 0x1401a9910 CheckDlgButton
 0x1401a9918 SetWindowLongPtrW
 0x1401a9920 GetWindowTextW
 0x1401a9928 IsDlgButtonChecked
 0x1401a9930 GetWindowLongPtrW
 0x1401a9938 DispatchMessageW
GDI32.dll
 0x1401a90b8 GetDeviceCaps
 0x1401a90c0 GetStockObject
 0x1401a90c8 DeleteObject
 0x1401a90d0 CreateSolidBrush
 0x1401a90d8 CreateFontIndirectW
COMDLG32.dll
 0x1401a9098 ChooseColorW
 0x1401a90a0 GetOpenFileNameW
 0x1401a90a8 GetSaveFileNameW
ADVAPI32.dll
 0x1401a9000 DeleteService
 0x1401a9008 RegQueryValueExW
 0x1401a9010 RegCloseKey
 0x1401a9018 RegDeleteValueW
 0x1401a9020 ControlService
 0x1401a9028 QueryServiceStatus
 0x1401a9030 QueryServiceConfigW
 0x1401a9038 CloseServiceHandle
 0x1401a9040 OpenServiceW
 0x1401a9048 CreateServiceW
 0x1401a9050 OpenSCManagerW
 0x1401a9058 StartServiceW
 0x1401a9060 RegOpenKeyExW
 0x1401a9068 RegSetValueExW
SHELL32.dll
 0x1401a9630 None
 0x1401a9638 ShellExecuteW
 0x1401a9640 Shell_NotifyIconW
 0x1401a9648 None
 0x1401a9650 SHBrowseForFolderW
 0x1401a9658 SHGetPathFromIDListW
ole32.dll
 0x1401a9a68 CreateStreamOnHGlobal
 0x1401a9a70 CoInitializeEx
OLEAUT32.dll
 0x1401a9608 OleLoadPicture

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure