popup

Report - lazagne.exe

Gen1 Generic Malware Malicious Library UPX PE64 PE File OS Processor Check DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.04.30 07:38 Machine s1_win7_x6403
Filename lazagne.exe
Type PE32+ executable (console) x86-64, for MS Windows
AI Score
2
 Behavior Score
2.6
ZERO API file : mailcious
VT API (file) 52 detected (AIDetectMalware, Hacktool, LaZagne, Malicious, score, HTool, Misc, unsafe, Clyp, high confidence, multiple detections, Passwd, fzsvkt, PrivacyRisk, Tool, Pwdump, Detected, ai score=100, Python, Volatilecedar, Malware@#1y7bgipppfgn5, Eldorado, R297990, Neshta, FileInfector, Ewnw, Igent, bVOuld, Static AI, Malicious PE, susgen)
md5 68d3bf2c363144ec6874ab360fdda00a
sha256 ed2f501408a7a6e1a854c29c4b0bc5648a6aa8612432df829008931b3e34bf56
ssdeep 196608:MG4YKWwsbycm/iAjf+UAYt+sIqXrgiQZGHluk6s:cYBwSdm6AIsf3QZAlJ
imphash a62ff465f3ead2e578f02d3a2d749b7b
impfuzzy 24:daDaODu9Wu9T/2bjar9UM02tMS1hUJnc+pl3rOovbKlvUTfUTlONoEqMo6iMuEZm:akR9xtMS1hEc+ppaRNUT2ONfiQh0
  Network IP location

Signature (5cnts)

Level Description
danger File has been identified by 52 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (13cnts)

Level Name Description Collection
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x140023000 GetLastError
 0x140023008 SetDllDirectoryW
 0x140023010 GetModuleFileNameW
 0x140023018 GetProcAddress
 0x140023020 GetCommandLineW
 0x140023028 GetEnvironmentVariableW
 0x140023030 SetEnvironmentVariableW
 0x140023038 ExpandEnvironmentStringsW
 0x140023040 GetTempPathW
 0x140023048 WaitForSingleObject
 0x140023050 Sleep
 0x140023058 GetExitCodeProcess
 0x140023060 CreateProcessW
 0x140023068 GetStartupInfoW
 0x140023070 LoadLibraryExW
 0x140023078 GetShortPathNameW
 0x140023080 FormatMessageW
 0x140023088 LoadLibraryA
 0x140023090 MultiByteToWideChar
 0x140023098 WideCharToMultiByte
 0x1400230a0 SetEndOfFile
 0x1400230a8 HeapReAlloc
 0x1400230b0 RtlCaptureContext
 0x1400230b8 RtlLookupFunctionEntry
 0x1400230c0 RtlVirtualUnwind
 0x1400230c8 UnhandledExceptionFilter
 0x1400230d0 SetUnhandledExceptionFilter
 0x1400230d8 GetCurrentProcess
 0x1400230e0 TerminateProcess
 0x1400230e8 IsProcessorFeaturePresent
 0x1400230f0 QueryPerformanceCounter
 0x1400230f8 GetCurrentProcessId
 0x140023100 GetCurrentThreadId
 0x140023108 GetSystemTimeAsFileTime
 0x140023110 InitializeSListHead
 0x140023118 IsDebuggerPresent
 0x140023120 GetModuleHandleW
 0x140023128 RtlUnwindEx
 0x140023130 SetLastError
 0x140023138 EnterCriticalSection
 0x140023140 LeaveCriticalSection
 0x140023148 DeleteCriticalSection
 0x140023150 InitializeCriticalSectionAndSpinCount
 0x140023158 TlsAlloc
 0x140023160 TlsGetValue
 0x140023168 TlsSetValue
 0x140023170 TlsFree
 0x140023178 FreeLibrary
 0x140023180 GetCommandLineA
 0x140023188 ReadFile
 0x140023190 CreateFileW
 0x140023198 GetDriveTypeW
 0x1400231a0 GetFileType
 0x1400231a8 CloseHandle
 0x1400231b0 PeekNamedPipe
 0x1400231b8 SystemTimeToTzSpecificLocalTime
 0x1400231c0 FileTimeToSystemTime
 0x1400231c8 GetFullPathNameW
 0x1400231d0 GetFullPathNameA
 0x1400231d8 CreateDirectoryW
 0x1400231e0 RemoveDirectoryW
 0x1400231e8 FindClose
 0x1400231f0 FindFirstFileExW
 0x1400231f8 FindNextFileW
 0x140023200 SetStdHandle
 0x140023208 SetConsoleCtrlHandler
 0x140023210 DeleteFileW
 0x140023218 GetStdHandle
 0x140023220 WriteFile
 0x140023228 ExitProcess
 0x140023230 GetModuleHandleExW
 0x140023238 GetACP
 0x140023240 HeapFree
 0x140023248 HeapAlloc
 0x140023250 GetConsoleMode
 0x140023258 ReadConsoleW
 0x140023260 SetFilePointerEx
 0x140023268 GetConsoleCP
 0x140023270 CompareStringW
 0x140023278 LCMapStringW
 0x140023280 GetCurrentDirectoryW
 0x140023288 FlushFileBuffers
 0x140023290 SetEnvironmentVariableA
 0x140023298 GetFileAttributesExW
 0x1400232a0 IsValidCodePage
 0x1400232a8 GetOEMCP
 0x1400232b0 GetCPInfo
 0x1400232b8 GetEnvironmentStringsW
 0x1400232c0 FreeEnvironmentStringsW
 0x1400232c8 GetStringTypeW
 0x1400232d0 GetProcessHeap
 0x1400232d8 WriteConsoleW
 0x1400232e0 GetTimeZoneInformation
 0x1400232e8 HeapSize
 0x1400232f0 RaiseException
WS2_32.dll
 0x140023300 ntohl

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure