ScreenShot
Created | 2024.08.05 10:51 | Machine | s1_win7_x6401 |
Filename | systems.exe | ||
Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
AI Score |
|
Behavior Score |
|
ZERO API | file : malware | ||
VT API (file) | 48 detected (AIDetectMalware, Dynara, malicious, high confidence, score, GenericKD, Unsafe, Kryptik, Vopi, Attribute, HighConfidence, AIZW, aqzf, AGEN, AMADEY, YXEHCZ, Real Protect, Detected, ai score=81, Bladabindi, ABTrojan, FZVK, ZexaF, Dq0@aKWLCmn, MachineLearning, Anomalous, Gencirc, Static AI, Malicious PE, susgen, Chgt, confidence, ALPE) | ||
md5 | 454a942056f6d69c4a06ffedffea974a | ||
sha256 | 2b9de0299a80e370e454b8512ee65abf2eac12ab3fe681201c25745978b199ed | ||
ssdeep | 12288:Fh1Lk70TnvjcwkhK/wO+FkH6GQx0Xs8eqUVd:Rk70TrcwkMY9xfJ3 | ||
imphash | bf5a4aa99e5b160f8521cadd6bfe73b8 | ||
impfuzzy | 24:gdqnuDoDyBNYnb2JOovS2cfEt4UjMAH/J3KyvbaFQHOTqlnpCwuCAaTCEQ4EPM:gQ8NIbXQcfEt4ITbuWlpChaTHQ0 |
Network IP location
Signature (36cnts)
Level | Description |
---|---|
danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
danger | File has been identified by 48 AntiVirus engines on VirusTotal as malicious |
danger | Executed a process and injected code into it |
watch | A process attempted to delay the analysis task. |
watch | Allocates execute permission to another process indicative of possible code injection |
watch | Appends a known CryptoMix ransomware file extension to files that have been encrypted |
watch | Attempts to access Bitcoin/ALTCoin wallets |
watch | Creates or sets a registry key to a long series of bytes |
watch | Deletes executed files from disk |
watch | Executes one or more WMI queries |
watch | Installs itself for autorun at Windows startup |
watch | Looks for the Windows Idle Time to determine the uptime |
watch | Potential code injection by writing to the memory of another process |
watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
watch | The process powershell.exe wrote an executable file to disk |
watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
notice | A process created a hidden window |
notice | Allocates read-write-execute memory (usually to unpack itself) |
notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
notice | Creates a shortcut to an executable file |
notice | Creates a suspicious process |
notice | Creates executable files on the filesystem |
notice | Creates hidden or system file |
notice | Drops a binary and executes it |
notice | Drops an executable to the user AppData folder |
notice | One or more potentially interesting buffers were extracted |
notice | The binary likely contains encrypted or compressed data indicative of a packer |
notice | Uses Windows utilities for basic Windows functionality |
notice | Yara rule detected in process memory |
info | Checks amount of memory in system |
info | Checks if process is being debugged by a debugger |
info | Command line console output was observed |
info | One or more processes crashed |
info | Queries for the computername |
info | This executable has a PDB path |
info | Uses Windows APIs to generate a cryptographic key |
Rules (48cnts)
Level | Name | Description | Collection |
---|---|---|---|
danger | MALWARE_Win_VT_RedLine | Detects RedLine infostealer | binaries (download) |
danger | MALWARE_Win_VT_RedLine | Detects RedLine infostealer | binaries (upload) |
warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
warning | UltraVNC_Zero | UltraVNC | binaries (download) |
warning | UltraVNC_Zero | UltraVNC | binaries (upload) |
watch | Antivirus | Contains references to security software | binaries (download) |
watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
watch | Network_Downloader | File Downloader | memory |
watch | UPX_Zero | UPX packed file | binaries (download) |
watch | UPX_Zero | UPX packed file | binaries (upload) |
notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
notice | Create_Service | Create a windows service | memory |
notice | Escalate_priviledges | Escalate priviledges | memory |
notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
notice | KeyLogger | Run a KeyLogger | memory |
notice | local_credential_Steal | Steal credential | memory |
notice | Network_DGA | Communication using DGA | memory |
notice | Network_DNS | Communications use DNS | memory |
notice | Network_FTP | Communications over FTP | memory |
notice | Network_HTTP | Communications over HTTP | memory |
notice | Network_P2P_Win | Communications over P2P network | memory |
notice | Network_TCP_Socket | Communications over RAW Socket | memory |
notice | ScreenShot | Take ScreenShot | memory |
notice | Sniff_Audio | Record Audio | memory |
notice | Str_Win32_Http_API | Match Windows Http API call | memory |
notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
info | anti_dbg | Checks if being debugged | memory |
info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
info | Check_Dlls | (no description) | memory |
info | DebuggerCheck__GlobalFlags | (no description) | memory |
info | DebuggerCheck__QueryInfo | (no description) | memory |
info | DebuggerCheck__RemoteAPI | (no description) | memory |
info | DebuggerException__ConsoleCtrl | (no description) | memory |
info | DebuggerException__SetConsoleCtrl | (no description) | memory |
info | DebuggerHiding__Active | (no description) | memory |
info | DebuggerHiding__Thread | (no description) | memory |
info | disable_dep | Bypass DEP | memory |
info | IsPE32 | (no description) | binaries (download) |
info | IsPE32 | (no description) | binaries (upload) |
info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
info | PE_Header_Zero | PE File Signature | binaries (download) |
info | PE_Header_Zero | PE File Signature | binaries (upload) |
info | SEH__vectored | (no description) | memory |
info | ThreadControl__Context | (no description) | memory |
info | win_hook | Affect hook table | memory |
Network (4cnts) ?
Suricata ids
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET HUNTING Telegram API Domain in DNS Lookup
SURICATA TLS invalid record type
SURICATA TLS invalid record/traffic
SURICATA Applayer Detect protocol only one direction
ET INFO TLS Handshake Failure
ET MALWARE Generic AsyncRAT Style SSL Cert
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET HUNTING Telegram API Domain in DNS Lookup
SURICATA TLS invalid record type
SURICATA TLS invalid record/traffic
SURICATA Applayer Detect protocol only one direction
ET INFO TLS Handshake Failure
ET MALWARE Generic AsyncRAT Style SSL Cert
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41b000 RaiseException
0x41b004 GetLastError
0x41b008 MultiByteToWideChar
0x41b00c lstrlenA
0x41b010 InterlockedDecrement
0x41b014 GetProcAddress
0x41b018 LoadLibraryA
0x41b01c FreeResource
0x41b020 SizeofResource
0x41b024 LockResource
0x41b028 LoadResource
0x41b02c FindResourceA
0x41b030 GetModuleHandleA
0x41b034 Module32Next
0x41b038 CloseHandle
0x41b03c Module32First
0x41b040 CreateToolhelp32Snapshot
0x41b044 GetCurrentProcessId
0x41b048 SetEndOfFile
0x41b04c GetStringTypeW
0x41b050 GetStringTypeA
0x41b054 LCMapStringW
0x41b058 LCMapStringA
0x41b05c GetLocaleInfoA
0x41b060 HeapFree
0x41b064 GetProcessHeap
0x41b068 HeapAlloc
0x41b06c GetCommandLineA
0x41b070 HeapCreate
0x41b074 VirtualFree
0x41b078 DeleteCriticalSection
0x41b07c LeaveCriticalSection
0x41b080 EnterCriticalSection
0x41b084 VirtualAlloc
0x41b088 HeapReAlloc
0x41b08c HeapSize
0x41b090 TerminateProcess
0x41b094 GetCurrentProcess
0x41b098 UnhandledExceptionFilter
0x41b09c SetUnhandledExceptionFilter
0x41b0a0 IsDebuggerPresent
0x41b0a4 GetModuleHandleW
0x41b0a8 Sleep
0x41b0ac ExitProcess
0x41b0b0 WriteFile
0x41b0b4 GetStdHandle
0x41b0b8 GetModuleFileNameA
0x41b0bc WideCharToMultiByte
0x41b0c0 GetConsoleCP
0x41b0c4 GetConsoleMode
0x41b0c8 ReadFile
0x41b0cc TlsGetValue
0x41b0d0 TlsAlloc
0x41b0d4 TlsSetValue
0x41b0d8 TlsFree
0x41b0dc InterlockedIncrement
0x41b0e0 SetLastError
0x41b0e4 GetCurrentThreadId
0x41b0e8 FlushFileBuffers
0x41b0ec SetFilePointer
0x41b0f0 SetHandleCount
0x41b0f4 GetFileType
0x41b0f8 GetStartupInfoA
0x41b0fc RtlUnwind
0x41b100 FreeEnvironmentStringsA
0x41b104 GetEnvironmentStrings
0x41b108 FreeEnvironmentStringsW
0x41b10c GetEnvironmentStringsW
0x41b110 QueryPerformanceCounter
0x41b114 GetTickCount
0x41b118 GetSystemTimeAsFileTime
0x41b11c InitializeCriticalSectionAndSpinCount
0x41b120 GetCPInfo
0x41b124 GetACP
0x41b128 GetOEMCP
0x41b12c IsValidCodePage
0x41b130 CompareStringA
0x41b134 CompareStringW
0x41b138 SetEnvironmentVariableA
0x41b13c WriteConsoleA
0x41b140 GetConsoleOutputCP
0x41b144 WriteConsoleW
0x41b148 SetStdHandle
0x41b14c CreateFileA
ole32.dll
0x41b17c OleInitialize
OLEAUT32.dll
0x41b154 SafeArrayCreate
0x41b158 SafeArrayAccessData
0x41b15c SafeArrayUnaccessData
0x41b160 SafeArrayDestroy
0x41b164 SafeArrayCreateVector
0x41b168 VariantClear
0x41b16c VariantInit
0x41b170 SysFreeString
0x41b174 SysAllocString
EAT(Export Address Table) is none
KERNEL32.dll
0x41b000 RaiseException
0x41b004 GetLastError
0x41b008 MultiByteToWideChar
0x41b00c lstrlenA
0x41b010 InterlockedDecrement
0x41b014 GetProcAddress
0x41b018 LoadLibraryA
0x41b01c FreeResource
0x41b020 SizeofResource
0x41b024 LockResource
0x41b028 LoadResource
0x41b02c FindResourceA
0x41b030 GetModuleHandleA
0x41b034 Module32Next
0x41b038 CloseHandle
0x41b03c Module32First
0x41b040 CreateToolhelp32Snapshot
0x41b044 GetCurrentProcessId
0x41b048 SetEndOfFile
0x41b04c GetStringTypeW
0x41b050 GetStringTypeA
0x41b054 LCMapStringW
0x41b058 LCMapStringA
0x41b05c GetLocaleInfoA
0x41b060 HeapFree
0x41b064 GetProcessHeap
0x41b068 HeapAlloc
0x41b06c GetCommandLineA
0x41b070 HeapCreate
0x41b074 VirtualFree
0x41b078 DeleteCriticalSection
0x41b07c LeaveCriticalSection
0x41b080 EnterCriticalSection
0x41b084 VirtualAlloc
0x41b088 HeapReAlloc
0x41b08c HeapSize
0x41b090 TerminateProcess
0x41b094 GetCurrentProcess
0x41b098 UnhandledExceptionFilter
0x41b09c SetUnhandledExceptionFilter
0x41b0a0 IsDebuggerPresent
0x41b0a4 GetModuleHandleW
0x41b0a8 Sleep
0x41b0ac ExitProcess
0x41b0b0 WriteFile
0x41b0b4 GetStdHandle
0x41b0b8 GetModuleFileNameA
0x41b0bc WideCharToMultiByte
0x41b0c0 GetConsoleCP
0x41b0c4 GetConsoleMode
0x41b0c8 ReadFile
0x41b0cc TlsGetValue
0x41b0d0 TlsAlloc
0x41b0d4 TlsSetValue
0x41b0d8 TlsFree
0x41b0dc InterlockedIncrement
0x41b0e0 SetLastError
0x41b0e4 GetCurrentThreadId
0x41b0e8 FlushFileBuffers
0x41b0ec SetFilePointer
0x41b0f0 SetHandleCount
0x41b0f4 GetFileType
0x41b0f8 GetStartupInfoA
0x41b0fc RtlUnwind
0x41b100 FreeEnvironmentStringsA
0x41b104 GetEnvironmentStrings
0x41b108 FreeEnvironmentStringsW
0x41b10c GetEnvironmentStringsW
0x41b110 QueryPerformanceCounter
0x41b114 GetTickCount
0x41b118 GetSystemTimeAsFileTime
0x41b11c InitializeCriticalSectionAndSpinCount
0x41b120 GetCPInfo
0x41b124 GetACP
0x41b128 GetOEMCP
0x41b12c IsValidCodePage
0x41b130 CompareStringA
0x41b134 CompareStringW
0x41b138 SetEnvironmentVariableA
0x41b13c WriteConsoleA
0x41b140 GetConsoleOutputCP
0x41b144 WriteConsoleW
0x41b148 SetStdHandle
0x41b14c CreateFileA
ole32.dll
0x41b17c OleInitialize
OLEAUT32.dll
0x41b154 SafeArrayCreate
0x41b158 SafeArrayAccessData
0x41b15c SafeArrayUnaccessData
0x41b160 SafeArrayDestroy
0x41b164 SafeArrayCreateVector
0x41b168 VariantClear
0x41b16c VariantInit
0x41b170 SysFreeString
0x41b174 SysAllocString
EAT(Export Address Table) is none