ScreenShot
| Created | 2024.08.08 14:07 | Machine | s1_win7_x6403 |
| Filename | logon.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 20 detected (AIDetectMalware, Unsafe, Malicious, Artemis, CLOUD, Wacatac, BScope, Lcnw, susgen, confidence, 100%) | ||
| md5 | ceccc726e628b9592af475cc27d0a7ae | ||
| sha256 | ccb40eb0137e156af89b0e0dbdac4192152dd19540efecdb56eeaa0384e5d55f | ||
| ssdeep | 3072:WgGMUZwVAMYiEkbIuQSrYfgJ7b7mZdVpvF5QjgJ9r5O:NHt4kc0/Sj1gEi | ||
| imphash | f4f7f76aa0a06aa9cec19206195b4f24 | ||
| impfuzzy | 24:US2RiwusOuQepB+ZfaloNl/t0fErAeOovpDc/J3IS2cfWyvZjMZ9SvLFQHOT45Kj:USOsepIZfaUpt0sr2Jkcfv2SncUb9xn | ||
Network IP location
Signature (2cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 20 AntiVirus engines on VirusTotal as malicious |
| info | Command line console output was observed |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
IPHLPAPI.DLL
0x421010 GetAdaptersInfo
0x421014 GetNumberOfInterfaces
0x421018 GetNetworkParams
KERNEL32.dll
0x421020 AllocConsole
0x421024 GetStdHandle
0x421028 CloseHandle
0x42102c WideCharToMultiByte
0x421030 lstrlenW
0x421034 GetCurrentProcess
0x421038 WriteConsoleA
0x42103c GetModuleFileNameA
0x421040 GetLastError
0x421044 Sleep
0x421048 GetTempPathA
0x42104c GetEnvironmentVariableA
0x421050 FreeConsole
0x421054 InitializeCriticalSection
0x421058 SetEnvironmentVariableA
0x42105c CompareStringW
0x421060 CompareStringA
0x421064 GetLocaleInfoW
0x421068 CreateFileA
0x42106c IsValidLocale
0x421070 EnumSystemLocalesA
0x421074 GetLocaleInfoA
0x421078 GetUserDefaultLCID
0x42107c GetStringTypeW
0x421080 GetStringTypeA
0x421084 LCMapStringW
0x421088 LCMapStringA
0x42108c GetTimeZoneInformation
0x421090 LoadLibraryA
0x421094 WriteConsoleW
0x421098 GetConsoleOutputCP
0x42109c MultiByteToWideChar
0x4210a0 InitializeCriticalSectionAndSpinCount
0x4210a4 TerminateProcess
0x4210a8 UnhandledExceptionFilter
0x4210ac SetUnhandledExceptionFilter
0x4210b0 IsDebuggerPresent
0x4210b4 RaiseException
0x4210b8 HeapFree
0x4210bc RtlUnwind
0x4210c0 HeapAlloc
0x4210c4 HeapReAlloc
0x4210c8 FindClose
0x4210cc FileTimeToSystemTime
0x4210d0 FileTimeToLocalFileTime
0x4210d4 GetDriveTypeA
0x4210d8 FindFirstFileA
0x4210dc SetEndOfFile
0x4210e0 GetProcessHeap
0x4210e4 GetCommandLineA
0x4210e8 GetModuleHandleW
0x4210ec GetProcAddress
0x4210f0 TlsGetValue
0x4210f4 TlsAlloc
0x4210f8 TlsSetValue
0x4210fc TlsFree
0x421100 InterlockedIncrement
0x421104 SetLastError
0x421108 GetCurrentThreadId
0x42110c InterlockedDecrement
0x421110 HeapCreate
0x421114 VirtualFree
0x421118 DeleteCriticalSection
0x42111c LeaveCriticalSection
0x421120 EnterCriticalSection
0x421124 VirtualAlloc
0x421128 SetHandleCount
0x42112c GetFileType
0x421130 GetStartupInfoA
0x421134 WriteFile
0x421138 GetConsoleCP
0x42113c GetConsoleMode
0x421140 FlushFileBuffers
0x421144 ReadFile
0x421148 SetFilePointer
0x42114c ExitProcess
0x421150 HeapSize
0x421154 GetFullPathNameA
0x421158 GetCurrentDirectoryA
0x42115c GetCPInfo
0x421160 GetACP
0x421164 GetOEMCP
0x421168 IsValidCodePage
0x42116c SetStdHandle
0x421170 FreeEnvironmentStringsA
0x421174 GetEnvironmentStrings
0x421178 FreeEnvironmentStringsW
0x42117c GetEnvironmentStringsW
0x421180 QueryPerformanceCounter
0x421184 GetTickCount
0x421188 GetCurrentProcessId
0x42118c GetSystemTimeAsFileTime
0x421190 CreateFileW
ADVAPI32.dll
0x421000 GetTokenInformation
0x421004 OpenProcessToken
0x421008 LookupAccountSidA
WS2_32.dll
0x4211a4 inet_ntoa
0x4211a8 WSAStartup
0x4211ac gethostname
0x4211b0 inet_addr
0x4211b4 getsockname
0x4211b8 closesocket
0x4211bc recvfrom
0x4211c0 socket
0x4211c4 sendto
0x4211c8 htonl
0x4211cc htons
0x4211d0 connect
0x4211d4 WSACleanup
0x4211d8 select
0x4211dc WSAGetLastError
NETAPI32.dll
0x421198 NetWkstaUserGetInfo
0x42119c NetApiBufferFree
EAT(Export Address Table) is none
IPHLPAPI.DLL
0x421010 GetAdaptersInfo
0x421014 GetNumberOfInterfaces
0x421018 GetNetworkParams
KERNEL32.dll
0x421020 AllocConsole
0x421024 GetStdHandle
0x421028 CloseHandle
0x42102c WideCharToMultiByte
0x421030 lstrlenW
0x421034 GetCurrentProcess
0x421038 WriteConsoleA
0x42103c GetModuleFileNameA
0x421040 GetLastError
0x421044 Sleep
0x421048 GetTempPathA
0x42104c GetEnvironmentVariableA
0x421050 FreeConsole
0x421054 InitializeCriticalSection
0x421058 SetEnvironmentVariableA
0x42105c CompareStringW
0x421060 CompareStringA
0x421064 GetLocaleInfoW
0x421068 CreateFileA
0x42106c IsValidLocale
0x421070 EnumSystemLocalesA
0x421074 GetLocaleInfoA
0x421078 GetUserDefaultLCID
0x42107c GetStringTypeW
0x421080 GetStringTypeA
0x421084 LCMapStringW
0x421088 LCMapStringA
0x42108c GetTimeZoneInformation
0x421090 LoadLibraryA
0x421094 WriteConsoleW
0x421098 GetConsoleOutputCP
0x42109c MultiByteToWideChar
0x4210a0 InitializeCriticalSectionAndSpinCount
0x4210a4 TerminateProcess
0x4210a8 UnhandledExceptionFilter
0x4210ac SetUnhandledExceptionFilter
0x4210b0 IsDebuggerPresent
0x4210b4 RaiseException
0x4210b8 HeapFree
0x4210bc RtlUnwind
0x4210c0 HeapAlloc
0x4210c4 HeapReAlloc
0x4210c8 FindClose
0x4210cc FileTimeToSystemTime
0x4210d0 FileTimeToLocalFileTime
0x4210d4 GetDriveTypeA
0x4210d8 FindFirstFileA
0x4210dc SetEndOfFile
0x4210e0 GetProcessHeap
0x4210e4 GetCommandLineA
0x4210e8 GetModuleHandleW
0x4210ec GetProcAddress
0x4210f0 TlsGetValue
0x4210f4 TlsAlloc
0x4210f8 TlsSetValue
0x4210fc TlsFree
0x421100 InterlockedIncrement
0x421104 SetLastError
0x421108 GetCurrentThreadId
0x42110c InterlockedDecrement
0x421110 HeapCreate
0x421114 VirtualFree
0x421118 DeleteCriticalSection
0x42111c LeaveCriticalSection
0x421120 EnterCriticalSection
0x421124 VirtualAlloc
0x421128 SetHandleCount
0x42112c GetFileType
0x421130 GetStartupInfoA
0x421134 WriteFile
0x421138 GetConsoleCP
0x42113c GetConsoleMode
0x421140 FlushFileBuffers
0x421144 ReadFile
0x421148 SetFilePointer
0x42114c ExitProcess
0x421150 HeapSize
0x421154 GetFullPathNameA
0x421158 GetCurrentDirectoryA
0x42115c GetCPInfo
0x421160 GetACP
0x421164 GetOEMCP
0x421168 IsValidCodePage
0x42116c SetStdHandle
0x421170 FreeEnvironmentStringsA
0x421174 GetEnvironmentStrings
0x421178 FreeEnvironmentStringsW
0x42117c GetEnvironmentStringsW
0x421180 QueryPerformanceCounter
0x421184 GetTickCount
0x421188 GetCurrentProcessId
0x42118c GetSystemTimeAsFileTime
0x421190 CreateFileW
ADVAPI32.dll
0x421000 GetTokenInformation
0x421004 OpenProcessToken
0x421008 LookupAccountSidA
WS2_32.dll
0x4211a4 inet_ntoa
0x4211a8 WSAStartup
0x4211ac gethostname
0x4211b0 inet_addr
0x4211b4 getsockname
0x4211b8 closesocket
0x4211bc recvfrom
0x4211c0 socket
0x4211c4 sendto
0x4211c8 htonl
0x4211cc htons
0x4211d0 connect
0x4211d4 WSACleanup
0x4211d8 select
0x4211dc WSAGetLastError
NETAPI32.dll
0x421198 NetWkstaUserGetInfo
0x42119c NetApiBufferFree
EAT(Export Address Table) is none