popup

Report - 23.exe

Admin Tool (Sysinternals etc ...) UPX AntiDebug AntiVM PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.07.31 14:55 Machine s1_win7_x6403
Filename 23.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
 Behavior Score
12.4
ZERO API file : malware
VT API (file) 30 detected (AIDetectMalware, Malicious, score, Infected, Unsafe, Artemis, MalwareX, CLOUD, REMCOS, YXEG5Z, high, DCRat, VCTBTR, ZevbaF, bm0@aeC7m4ji, BScope, VBKrypt, Timw, susgen, PossibleThreat, confidence, 100%)
md5 367009ea6fe948f4c0773f4cd1274a5f
sha256 ace74890b732a42e4d481744266121b1bca84a36c730dc563813e26f781a7512
ssdeep 384:YwP/ceGdmYbLNqFWDyLzTvnMoCp57QcB/Po9LqHzH7v:YZedpZc+92Hzb
imphash 37ef2436c289dfdb700eec05dbef66a5
impfuzzy 24:n9wxQwzQjlwgOlVg4xE3NuLxrd5eS3OYTixAT/EWFNmpSW7M+zIhwfGgxmd+Zaut:nqxQwzQZwgwg4xE3kxrdZ3OYGxATBFN4
  Network IP location

Signature (24cnts)

Level Description
danger Executed a process and injected code into it
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch A process attempted to delay the analysis task.
watch Allocates execute permission to another process indicative of possible code injection
watch Appends a known CryptoMix ransomware file extension to files that have been encrypted
watch Attempts to access Bitcoin/ALTCoin wallets
watch Attempts to create or modify system certificates
watch Code injection by writing an executable or DLL to the memory of another process
watch Communicates with host for which no DNS query was performed
watch Executes one or more WMI queries
watch Looks for the Windows Idle Time to determine the uptime
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Queries for the computername
info Uses Windows APIs to generate a cryptographic key

Rules (12cnts)

Level Name Description Collection
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://poslisoubor.cz/gf.php?33f6c54a9a525e2c37453931c2aadebe/9.txt
whois
CZ Altnet s.r.o. 109.71.208.62 41656 clean
poslisoubor.cz
whois
CZ Altnet s.r.o. 109.71.208.62 clean
109.71.208.62
whois
CZ Altnet s.r.o. 109.71.208.62 clean
41.216.183.3
whois
NL FOP Samosenok Alexandr Sergeevich 41.216.183.3 mailcious

Suricata ids

ET DROP Spamhaus DROP Listed Traffic Inbound group 3
SURICATA TLS invalid record type
SURICATA TLS invalid record/traffic
SURICATA Applayer Detect protocol only one direction
ET MALWARE Generic AsyncRAT Style SSL Cert

PE API

IAT(Import Address Table) Library

MSVBVM60.DLL
 0x401000 _CIcos
 0x401004 _adj_fptan
 0x401008 __vbaAryMove
 0x40100c __vbaFreeVar
 0x401010 __vbaStrVarMove
 0x401014 __vbaLenBstr
 0x401018 __vbaFreeVarList
 0x40101c _adj_fdiv_m64
 0x401020 None
 0x401024 _adj_fprem1
 0x401028 __vbaStrCat
 0x40102c __vbaSetSystemError
 0x401030 None
 0x401034 _adj_fdiv_m32
 0x401038 __vbaAryDestruct
 0x40103c _adj_fdiv_m16i
 0x401040 __vbaObjSetAddref
 0x401044 _adj_fdivr_m16i
 0x401048 _CIsin
 0x40104c None
 0x401050 None
 0x401054 __vbaChkstk
 0x401058 EVENT_SINK_AddRef
 0x40105c __vbaGenerateBoundsError
 0x401060 __vbaVarTstEq
 0x401064 __vbaI2I4
 0x401068 __vbaObjVar
 0x40106c DllFunctionCall
 0x401070 __vbaLbound
 0x401074 _adj_fpatan
 0x401078 __vbaRedim
 0x40107c EVENT_SINK_Release
 0x401080 __vbaUI1I2
 0x401084 _CIsqrt
 0x401088 EVENT_SINK_QueryInterface
 0x40108c __vbaExceptHandler
 0x401090 _adj_fprem
 0x401094 _adj_fdivr_m64
 0x401098 None
 0x40109c None
 0x4010a0 __vbaFPException
 0x4010a4 __vbaUbound
 0x4010a8 __vbaStrVarVal
 0x4010ac __vbaVarCat
 0x4010b0 None
 0x4010b4 None
 0x4010b8 _CIlog
 0x4010bc __vbaErrorOverflow
 0x4010c0 __vbaVar2Vec
 0x4010c4 _adj_fdiv_m32i
 0x4010c8 _adj_fdivr_m32i
 0x4010cc __vbaStrCopy
 0x4010d0 __vbaFreeStrList
 0x4010d4 _adj_fdivr_m32
 0x4010d8 _adj_fdiv_r
 0x4010dc None
 0x4010e0 __vbaLateMemCall
 0x4010e4 __vbaAryLock
 0x4010e8 __vbaLateMemCallLd
 0x4010ec _CIatan
 0x4010f0 __vbaStrMove
 0x4010f4 __vbaUI1Str
 0x4010f8 _allmul
 0x4010fc _CItan
 0x401100 __vbaAryUnlock
 0x401104 _CIexp
 0x401108 __vbaFreeObj
 0x40110c __vbaFreeStr

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure