ScreenShot
| Created | 2024.07.26 12:03 | Machine | s1_win7_x6403 |
| Filename | newtpp.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | |||
| md5 | e2e3268f813a0c5128ff8347cbaa58c8 | ||
| sha256 | d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3 | ||
| ssdeep | 1536:W9mw4/inFmav82TmKtj+5qUPsY3BCHYJhcWPA4G9kj3K1:CmwohOBiPsWMH4ogj3K | ||
| imphash | e3b708193fe03ba1bfd096b4ae42f3b9 | ||
| impfuzzy | 96:Fs0acR+KxcVqpxM/Eu9X1f6OgntK/W9Hdcp63omkDK7k1qKdI:M40V9Fw0/sHromkDK741a | ||
Network IP location
Signature (29cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | Disables Windows Security features |
| danger | Stops Windows services |
| watch | Attempts to disable Windows Auto Updates |
| watch | Attempts to remove evidence of file being downloaded from the Internet |
| watch | Attempts to stop active services |
| watch | Communicates with host for which no DNS query was performed |
| watch | Installs itself for autorun at Windows startup |
| watch | Makes SMTP requests |
| watch | Modifies security center warnings |
| notice | A process attempted to delay the analysis task. |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Creates hidden or system file |
| notice | Drops an executable to the user AppData folder |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Looks up the external IP address |
| notice | Performs some HTTP requests |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (16cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (download) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PowerShell | PowerShell script | scripts |
Network (80cnts) ?
Suricata ids
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
SURICATA Applayer Detect protocol only one direction
ET MALWARE Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
SURICATA Applayer Detect protocol only one direction
ET MALWARE Win32/Phorpiex Template 9 Active - Outbound Malicious Email Spam
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
PE API
IAT(Import Address Table) Library
WS2_32.dll
0x410220 gethostname
0x410224 recvfrom
0x410228 setsockopt
0x41022c closesocket
0x410230 htons
0x410234 shutdown
0x410238 WSAStartup
0x41023c connect
0x410240 WSAWaitForMultipleEvents
0x410244 listen
0x410248 WSASocketA
0x41024c WSACreateEvent
0x410250 WSAGetOverlappedResult
0x410254 WSAEventSelect
0x410258 WSAEnumNetworkEvents
0x41025c WSAGetLastError
0x410260 WSASend
0x410264 WSARecv
0x410268 WSACloseEvent
0x41026c accept
0x410270 getpeername
0x410274 getsockname
0x410278 inet_addr
0x41027c gethostbyname
0x410280 inet_ntoa
0x410284 socket
0x410288 ind
0x41028c sendto
0x410290 ioctlsocket
0x410294 recv
0x410298 send
SHLWAPI.dll
0x410168 StrStrIA
0x41016c StrCmpNW
0x410170 StrStrW
0x410174 PathFileExistsW
0x410178 StrChrA
0x41017c PathFindFileNameW
0x410180 StrCmpNIA
0x410184 PathMatchSpecW
urlmon.dll
0x410318 URLDownloadToFileW
WININET.dll
0x4101e4 HttpOpenRequestA
0x4101e8 HttpSendRequestA
0x4101ec InternetConnectA
0x4101f0 InternetCloseHandle
0x4101f4 DeleteUrlCacheEntry
0x4101f8 InternetReadFile
0x4101fc InternetOpenA
0x410200 InternetCrackUrlA
0x410204 HttpAddRequestHeadersA
0x410208 HttpQueryInfoA
0x41020c InternetOpenUrlA
0x410210 DeleteUrlCacheEntryW
0x410214 InternetOpenUrlW
0x410218 InternetOpenW
ntdll.dll
0x4102b0 strlen
0x4102b4 isdigit
0x4102b8 isalpha
0x4102bc memcpy
0x4102c0 memset
0x4102c4 NtQueryVirtualMemory
0x4102c8 RtlUnwind
0x4102cc _chkstk
0x4102d0 _aulldiv
0x4102d4 wcslen
0x4102d8 wcscmp
0x4102dc _allshl
0x4102e0 _aullshr
0x4102e4 strstr
0x4102e8 strcmp
0x4102ec memmove
0x4102f0 memcmp
0x4102f4 RtlTimeToSecondsSince1980
0x4102f8 NtQuerySystemTime
0x4102fc mbstowcs
msvcrt.dll
0x4102a0 _vscprintf
0x4102a4 srand
0x4102a8 rand
KERNEL32.dll
0x41002c GetQueuedCompletionStatus
0x410030 PostQueuedCompletionStatus
0x410034 GetSystemInfo
0x410038 lstrcmpW
0x41003c SetEvent
0x410040 CreateProcessW
0x410044 GetLocaleInfoA
0x410048 DeleteCriticalSection
0x41004c GetCurrentThread
0x410050 GetThreadPriority
0x410054 SetThreadPriority
0x410058 GetCurrentProcess
0x41005c DuplicateHandle
0x410060 IsBadReadPtr
0x410064 InterlockedExchangeAdd
0x410068 InterlockedIncrement
0x41006c WaitForSingleObject
0x410070 InterlockedDecrement
0x410074 InterlockedExchange
0x410078 HeapFree
0x41007c HeapValidate
0x410080 HeapReAlloc
0x410084 GetProcessHeaps
0x410088 HeapCreate
0x41008c HeapSetInformation
0x410090 GetCurrentProcessId
0x410094 HeapAlloc
0x410098 CreateMutexA
0x41009c GetLastError
0x4100a0 ExitProcess
0x4100a4 ExpandEnvironmentStringsW
0x4100a8 CreateEventA
0x4100ac CreateThread
0x4100b0 GetModuleFileNameW
0x4100b4 GetVolumeInformationW
0x4100b8 GetDiskFreeSpaceExW
0x4100bc SetFileAttributesW
0x4100c0 DeleteFileW
0x4100c4 CopyFileW
0x4100c8 lstrcmpiW
0x4100cc CreateDirectoryW
0x4100d0 FindFirstFileW
0x4100d4 CreateIoCompletionPort
0x4100d8 MoveFileExW
0x4100dc FindNextFileW
0x4100e0 FindClose
0x4100e4 RemoveDirectoryW
0x4100e8 GetLogicalDrives
0x4100ec GetDriveTypeW
0x4100f0 QueryDosDeviceW
0x4100f4 lstrcpyW
0x4100f8 WriteFile
0x4100fc FlushFileBuffers
0x410100 EnterCriticalSection
0x410104 LeaveCriticalSection
0x410108 InitializeCriticalSection
0x41010c CreateFileW
0x410110 CreateFileMappingW
0x410114 MapViewOfFile
0x410118 GlobalUnlock
0x41011c GlobalLock
0x410120 GlobalAlloc
0x410124 lstrlenA
0x410128 lstrlenW
0x41012c lstrcpynW
0x410130 MultiByteToWideChar
0x410134 ExitThread
0x410138 GetTickCount
0x41013c Sleep
0x410140 GetModuleHandleW
0x410144 CloseHandle
0x410148 UnmapViewOfFile
0x41014c GetFileSize
USER32.dll
0x41018c RegisterClassExW
0x410190 CreateWindowExW
0x410194 GetMessageA
0x410198 TranslateMessage
0x41019c wsprintfW
0x4101a0 DefWindowProcA
0x4101a4 ChangeClipboardChain
0x4101a8 RegisterRawInputDevices
0x4101ac GetClipboardData
0x4101b0 DispatchMessageA
0x4101b4 EmptyClipboard
0x4101b8 SetClipboardData
0x4101bc CloseClipboard
0x4101c0 IsClipboardFormatAvailable
0x4101c4 SendMessageA
0x4101c8 SetWindowLongW
0x4101cc SetClipboardViewer
0x4101d0 GetWindowLongW
0x4101d4 wsprintfA
0x4101d8 wvsprintfA
0x4101dc OpenClipboard
ADVAPI32.dll
0x410000 CryptReleaseContext
0x410004 RegQueryValueExW
0x410008 RegOpenKeyExW
0x41000c RegOpenKeyExA
0x410010 RegCreateKeyExW
0x410014 CryptAcquireContextW
0x410018 CryptGenRandom
0x41001c RegCloseKey
0x410020 RegSetValueExW
0x410024 RegSetValueExA
SHELL32.dll
0x410160 ShellExecuteW
ole32.dll
0x410304 CoInitializeEx
0x410308 CoUninitialize
0x41030c CoInitialize
0x410310 CoCreateInstance
OLEAUT32.dll
0x410154 SysFreeString
0x410158 SysAllocString
EAT(Export Address Table) is none
WS2_32.dll
0x410220 gethostname
0x410224 recvfrom
0x410228 setsockopt
0x41022c closesocket
0x410230 htons
0x410234 shutdown
0x410238 WSAStartup
0x41023c connect
0x410240 WSAWaitForMultipleEvents
0x410244 listen
0x410248 WSASocketA
0x41024c WSACreateEvent
0x410250 WSAGetOverlappedResult
0x410254 WSAEventSelect
0x410258 WSAEnumNetworkEvents
0x41025c WSAGetLastError
0x410260 WSASend
0x410264 WSARecv
0x410268 WSACloseEvent
0x41026c accept
0x410270 getpeername
0x410274 getsockname
0x410278 inet_addr
0x41027c gethostbyname
0x410280 inet_ntoa
0x410284 socket
0x410288 ind
0x41028c sendto
0x410290 ioctlsocket
0x410294 recv
0x410298 send
SHLWAPI.dll
0x410168 StrStrIA
0x41016c StrCmpNW
0x410170 StrStrW
0x410174 PathFileExistsW
0x410178 StrChrA
0x41017c PathFindFileNameW
0x410180 StrCmpNIA
0x410184 PathMatchSpecW
urlmon.dll
0x410318 URLDownloadToFileW
WININET.dll
0x4101e4 HttpOpenRequestA
0x4101e8 HttpSendRequestA
0x4101ec InternetConnectA
0x4101f0 InternetCloseHandle
0x4101f4 DeleteUrlCacheEntry
0x4101f8 InternetReadFile
0x4101fc InternetOpenA
0x410200 InternetCrackUrlA
0x410204 HttpAddRequestHeadersA
0x410208 HttpQueryInfoA
0x41020c InternetOpenUrlA
0x410210 DeleteUrlCacheEntryW
0x410214 InternetOpenUrlW
0x410218 InternetOpenW
ntdll.dll
0x4102b0 strlen
0x4102b4 isdigit
0x4102b8 isalpha
0x4102bc memcpy
0x4102c0 memset
0x4102c4 NtQueryVirtualMemory
0x4102c8 RtlUnwind
0x4102cc _chkstk
0x4102d0 _aulldiv
0x4102d4 wcslen
0x4102d8 wcscmp
0x4102dc _allshl
0x4102e0 _aullshr
0x4102e4 strstr
0x4102e8 strcmp
0x4102ec memmove
0x4102f0 memcmp
0x4102f4 RtlTimeToSecondsSince1980
0x4102f8 NtQuerySystemTime
0x4102fc mbstowcs
msvcrt.dll
0x4102a0 _vscprintf
0x4102a4 srand
0x4102a8 rand
KERNEL32.dll
0x41002c GetQueuedCompletionStatus
0x410030 PostQueuedCompletionStatus
0x410034 GetSystemInfo
0x410038 lstrcmpW
0x41003c SetEvent
0x410040 CreateProcessW
0x410044 GetLocaleInfoA
0x410048 DeleteCriticalSection
0x41004c GetCurrentThread
0x410050 GetThreadPriority
0x410054 SetThreadPriority
0x410058 GetCurrentProcess
0x41005c DuplicateHandle
0x410060 IsBadReadPtr
0x410064 InterlockedExchangeAdd
0x410068 InterlockedIncrement
0x41006c WaitForSingleObject
0x410070 InterlockedDecrement
0x410074 InterlockedExchange
0x410078 HeapFree
0x41007c HeapValidate
0x410080 HeapReAlloc
0x410084 GetProcessHeaps
0x410088 HeapCreate
0x41008c HeapSetInformation
0x410090 GetCurrentProcessId
0x410094 HeapAlloc
0x410098 CreateMutexA
0x41009c GetLastError
0x4100a0 ExitProcess
0x4100a4 ExpandEnvironmentStringsW
0x4100a8 CreateEventA
0x4100ac CreateThread
0x4100b0 GetModuleFileNameW
0x4100b4 GetVolumeInformationW
0x4100b8 GetDiskFreeSpaceExW
0x4100bc SetFileAttributesW
0x4100c0 DeleteFileW
0x4100c4 CopyFileW
0x4100c8 lstrcmpiW
0x4100cc CreateDirectoryW
0x4100d0 FindFirstFileW
0x4100d4 CreateIoCompletionPort
0x4100d8 MoveFileExW
0x4100dc FindNextFileW
0x4100e0 FindClose
0x4100e4 RemoveDirectoryW
0x4100e8 GetLogicalDrives
0x4100ec GetDriveTypeW
0x4100f0 QueryDosDeviceW
0x4100f4 lstrcpyW
0x4100f8 WriteFile
0x4100fc FlushFileBuffers
0x410100 EnterCriticalSection
0x410104 LeaveCriticalSection
0x410108 InitializeCriticalSection
0x41010c CreateFileW
0x410110 CreateFileMappingW
0x410114 MapViewOfFile
0x410118 GlobalUnlock
0x41011c GlobalLock
0x410120 GlobalAlloc
0x410124 lstrlenA
0x410128 lstrlenW
0x41012c lstrcpynW
0x410130 MultiByteToWideChar
0x410134 ExitThread
0x410138 GetTickCount
0x41013c Sleep
0x410140 GetModuleHandleW
0x410144 CloseHandle
0x410148 UnmapViewOfFile
0x41014c GetFileSize
USER32.dll
0x41018c RegisterClassExW
0x410190 CreateWindowExW
0x410194 GetMessageA
0x410198 TranslateMessage
0x41019c wsprintfW
0x4101a0 DefWindowProcA
0x4101a4 ChangeClipboardChain
0x4101a8 RegisterRawInputDevices
0x4101ac GetClipboardData
0x4101b0 DispatchMessageA
0x4101b4 EmptyClipboard
0x4101b8 SetClipboardData
0x4101bc CloseClipboard
0x4101c0 IsClipboardFormatAvailable
0x4101c4 SendMessageA
0x4101c8 SetWindowLongW
0x4101cc SetClipboardViewer
0x4101d0 GetWindowLongW
0x4101d4 wsprintfA
0x4101d8 wvsprintfA
0x4101dc OpenClipboard
ADVAPI32.dll
0x410000 CryptReleaseContext
0x410004 RegQueryValueExW
0x410008 RegOpenKeyExW
0x41000c RegOpenKeyExA
0x410010 RegCreateKeyExW
0x410014 CryptAcquireContextW
0x410018 CryptGenRandom
0x41001c RegCloseKey
0x410020 RegSetValueExW
0x410024 RegSetValueExA
SHELL32.dll
0x410160 ShellExecuteW
ole32.dll
0x410304 CoInitializeEx
0x410308 CoUninitialize
0x41030c CoInitialize
0x410310 CoCreateInstance
OLEAUT32.dll
0x410154 SysFreeString
0x410158 SysAllocString
EAT(Export Address Table) is none