Report - Downdd.exe

CoinMiner AutoIt Generic Malware UPX PE File PE32
ScreenShot
Created 2024.06.21 09:35 Machine s1_win7_x6401
Filename Downdd.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
AI Score
5
Behavior Score
3.0
ZERO API file : malware
VT API (file) 53 detected (AIDetectMalware, lNoD, malicious, moderate confidence, score, Nymeria, Unsafe, Vsgl, many, Autoit, NBT suspicious, Artemis, TrjGen, koswjz, Siggen5, high, Detected, CoinMiner, Hider, REXR@5364l6, Wacapew, R2WKDE, IJBN, IMWorm, Sohanad, R002H09ET24, GenAsa, i9rai7w7, ai score=84, susgen, confidence, 100%)
md5 f6be85b0254a308f77189fc96fa6f38e
sha256 6db6a1f73e471e2068a0a420fe6134327171e9a11bbd1a5b360298c5b6a1b069
ssdeep 24576:ofK9zUHFpi8/cVt692Qbp9EPXcHJCOoMmBorv9CYmVzsuY:ofKtqFpiucf6zxsOFyorv9FJuY
imphash 6058ac660564f64af764bdf1e4fe5d2b
impfuzzy 12:VA/DzqYOZkKDD75maKxLAkcOcTQQnd3mxCHXT:V0DBaPD7VKxLAkcOs2k3T
  Network IP location

Signature (7cnts)

Level Description
danger File has been identified by 53 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
notice The executable is compressed using UPX
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info The executable uses a known packer

Rules (6cnts)

Level Name Description Collection
danger CoinMiner_IN CoinMiner binaries (upload)
warning AutoIt autoit binaries (upload)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.DLL
 0x4cf18c LoadLibraryA
 0x4cf190 GetProcAddress
 0x4cf194 VirtualProtect
 0x4cf198 VirtualAlloc
 0x4cf19c VirtualFree
 0x4cf1a0 ExitProcess
ADVAPI32.dll
 0x4cf1a8 GetAce
COMCTL32.dll
 0x4cf1b0 ImageList_Remove
COMDLG32.dll
 0x4cf1b8 GetSaveFileNameW
GDI32.dll
 0x4cf1c0 LineTo
MPR.dll
 0x4cf1c8 WNetUseConnectionW
ole32.dll
 0x4cf1d0 CoInitialize
OLEAUT32.dll
 0x4cf1d8 SysFreeString
PSAPI.DLL
 0x4cf1e0 EnumProcesses
SHELL32.dll
 0x4cf1e8 DragFinish
USER32.dll
 0x4cf1f0 GetDC
USERENV.dll
 0x4cf1f8 LoadUserProfileW
VERSION.dll
 0x4cf200 VerQueryValueW
WININET.dll
 0x4cf208 FtpOpenFileW
WINMM.dll
 0x4cf210 timeGetTime
WSOCK32.dll
 0x4cf218 recv

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure