ScreenShot
| Created | 2024.08.17 22:34 | Machine | s1_win7_x6401 |
| Filename | PctOccurred.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 39 detected (Common, Runner, Malicious, score, Artemis, Autoit, V0sp, GenericKD, NSIS, grbub, Siggen29, LUMMASTEALER, YXEHNZ, ai score=88, Acll, 4PGVDA, Lumma, Chgt, FalseSign, Kzfl, confidence) | ||
| md5 | 31f04226973fdade2e7232918f11e5da | ||
| sha256 | 007c6dfe4466894d678c06e6b30df77225450225ddd8e904e731cab32e82c512 | ||
| ssdeep | 24576:VzZDpgqx9+kamgRQ+uYU8hwjxKmAERKk1LxkGTagw276kyJsAb3WIWI:VrBxbEQ+uYJqQERKk9mE/76KAbr | ||
| imphash | bf95d1fc1d10de18b32654b123ad5e1f | ||
| impfuzzy | 48:RlSYTMgUh4QbOR5OHALxlla/7LqQEFSv8rOAl6UyeXb0Wzn7+9SPJ4KQ/1byAknz:DVAg84QbsaI11I3BKsy | ||
Network IP location
Signature (18cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 39 AntiVirus engines on VirusTotal as malicious |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | Executes one or more WMI queries |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (44cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | memory |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
| notice | Hijack_Network | Hijack network configuration | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | Persistence | Install itself for autorun at Windows startup | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x408060 SetFileTime
0x408064 CompareFileTime
0x408068 SearchPathW
0x40806c GetShortPathNameW
0x408070 GetFullPathNameW
0x408074 MoveFileW
0x408078 SetCurrentDirectoryW
0x40807c GetFileAttributesW
0x408080 GetLastError
0x408084 CreateDirectoryW
0x408088 SetFileAttributesW
0x40808c Sleep
0x408090 GetTickCount
0x408094 GetFileSize
0x408098 GetModuleFileNameW
0x40809c GetCurrentProcess
0x4080a0 CopyFileW
0x4080a4 ExitProcess
0x4080a8 GetWindowsDirectoryW
0x4080ac GetTempPathW
0x4080b0 GetCommandLineW
0x4080b4 SetErrorMode
0x4080b8 lstrcpynA
0x4080bc CloseHandle
0x4080c0 lstrcpynW
0x4080c4 GetDiskFreeSpaceW
0x4080c8 GlobalUnlock
0x4080cc GlobalLock
0x4080d0 CreateThread
0x4080d4 LoadLibraryW
0x4080d8 CreateProcessW
0x4080dc lstrcmpiA
0x4080e0 CreateFileW
0x4080e4 GetTempFileNameW
0x4080e8 lstrcatW
0x4080ec GetProcAddress
0x4080f0 LoadLibraryA
0x4080f4 GetModuleHandleA
0x4080f8 OpenProcess
0x4080fc lstrcpyW
0x408100 GetVersionExW
0x408104 GetSystemDirectoryW
0x408108 GetVersion
0x40810c lstrcpyA
0x408110 RemoveDirectoryW
0x408114 lstrcmpiW
0x408118 lstrcmpW
0x40811c ExpandEnvironmentStringsW
0x408120 GlobalAlloc
0x408124 WaitForSingleObject
0x408128 GetExitCodeProcess
0x40812c GlobalFree
0x408130 GetModuleHandleW
0x408134 LoadLibraryExW
0x408138 FreeLibrary
0x40813c WritePrivateProfileStringW
0x408140 GetPrivateProfileStringW
0x408144 WideCharToMultiByte
0x408148 MulDiv
0x40814c lstrlenA
0x408150 WriteFile
0x408154 ReadFile
0x408158 MultiByteToWideChar
0x40815c SetFilePointer
0x408160 FindClose
0x408164 FindNextFileW
0x408168 FindFirstFileW
0x40816c DeleteFileW
0x408170 lstrlenW
USER32.dll
0x408194 ScreenToClient
0x408198 GetMessagePos
0x40819c CallWindowProcW
0x4081a0 IsWindowVisible
0x4081a4 LoadBitmapW
0x4081a8 CloseClipboard
0x4081ac SetClipboardData
0x4081b0 EmptyClipboard
0x4081b4 OpenClipboard
0x4081b8 TrackPopupMenu
0x4081bc GetWindowRect
0x4081c0 AppendMenuW
0x4081c4 CreatePopupMenu
0x4081c8 GetSystemMetrics
0x4081cc EndDialog
0x4081d0 EnableMenuItem
0x4081d4 GetSystemMenu
0x4081d8 SetClassLongW
0x4081dc IsWindowEnabled
0x4081e0 SetWindowPos
0x4081e4 DialogBoxParamW
0x4081e8 CheckDlgButton
0x4081ec CreateWindowExW
0x4081f0 SystemParametersInfoW
0x4081f4 RegisterClassW
0x4081f8 SetDlgItemTextW
0x4081fc GetDlgItemTextW
0x408200 MessageBoxIndirectW
0x408204 CharNextA
0x408208 CharUpperW
0x40820c CharPrevW
0x408210 DispatchMessageW
0x408214 PeekMessageW
0x408218 wsprintfA
0x40821c DestroyWindow
0x408220 CreateDialogParamW
0x408224 SetTimer
0x408228 SetWindowTextW
0x40822c PostQuitMessage
0x408230 SetForegroundWindow
0x408234 ShowWindow
0x408238 wsprintfW
0x40823c SendMessageTimeoutW
0x408240 LoadCursorW
0x408244 SetCursor
0x408248 GetWindowLongW
0x40824c GetSysColor
0x408250 CharNextW
0x408254 GetClassInfoW
0x408258 ExitWindowsEx
0x40825c FindWindowExW
0x408260 GetDlgItem
0x408264 SetWindowLongW
0x408268 LoadImageW
0x40826c GetDC
0x408270 EnableWindow
0x408274 InvalidateRect
0x408278 SendMessageW
0x40827c DefWindowProcW
0x408280 BeginPaint
0x408284 GetClientRect
0x408288 FillRect
0x40828c DrawTextW
0x408290 EndPaint
0x408294 IsWindow
GDI32.dll
0x40803c SetBkColor
0x408040 GetDeviceCaps
0x408044 DeleteObject
0x408048 CreateBrushIndirect
0x40804c CreateFontIndirectW
0x408050 SetBkMode
0x408054 SetTextColor
0x408058 SelectObject
SHELL32.dll
0x408178 SHBrowseForFolderW
0x40817c SHGetPathFromIDListW
0x408180 SHGetFileInfoW
0x408184 ShellExecuteW
0x408188 SHFileOperationW
0x40818c SHGetSpecialFolderLocation
ADVAPI32.dll
0x408000 RegEnumKeyW
0x408004 RegOpenKeyExW
0x408008 RegCloseKey
0x40800c RegDeleteKeyW
0x408010 RegDeleteValueW
0x408014 RegCreateKeyExW
0x408018 RegSetValueExW
0x40801c RegQueryValueExW
0x408020 RegEnumValueW
COMCTL32.dll
0x408028 ImageList_AddMasked
0x40802c ImageList_Destroy
0x408030 None
0x408034 ImageList_Create
ole32.dll
0x4082ac CoTaskMemFree
0x4082b0 OleInitialize
0x4082b4 OleUninitialize
0x4082b8 CoCreateInstance
VERSION.dll
0x40829c GetFileVersionInfoSizeW
0x4082a0 GetFileVersionInfoW
0x4082a4 VerQueryValueW
EAT(Export Address Table) is none
KERNEL32.dll
0x408060 SetFileTime
0x408064 CompareFileTime
0x408068 SearchPathW
0x40806c GetShortPathNameW
0x408070 GetFullPathNameW
0x408074 MoveFileW
0x408078 SetCurrentDirectoryW
0x40807c GetFileAttributesW
0x408080 GetLastError
0x408084 CreateDirectoryW
0x408088 SetFileAttributesW
0x40808c Sleep
0x408090 GetTickCount
0x408094 GetFileSize
0x408098 GetModuleFileNameW
0x40809c GetCurrentProcess
0x4080a0 CopyFileW
0x4080a4 ExitProcess
0x4080a8 GetWindowsDirectoryW
0x4080ac GetTempPathW
0x4080b0 GetCommandLineW
0x4080b4 SetErrorMode
0x4080b8 lstrcpynA
0x4080bc CloseHandle
0x4080c0 lstrcpynW
0x4080c4 GetDiskFreeSpaceW
0x4080c8 GlobalUnlock
0x4080cc GlobalLock
0x4080d0 CreateThread
0x4080d4 LoadLibraryW
0x4080d8 CreateProcessW
0x4080dc lstrcmpiA
0x4080e0 CreateFileW
0x4080e4 GetTempFileNameW
0x4080e8 lstrcatW
0x4080ec GetProcAddress
0x4080f0 LoadLibraryA
0x4080f4 GetModuleHandleA
0x4080f8 OpenProcess
0x4080fc lstrcpyW
0x408100 GetVersionExW
0x408104 GetSystemDirectoryW
0x408108 GetVersion
0x40810c lstrcpyA
0x408110 RemoveDirectoryW
0x408114 lstrcmpiW
0x408118 lstrcmpW
0x40811c ExpandEnvironmentStringsW
0x408120 GlobalAlloc
0x408124 WaitForSingleObject
0x408128 GetExitCodeProcess
0x40812c GlobalFree
0x408130 GetModuleHandleW
0x408134 LoadLibraryExW
0x408138 FreeLibrary
0x40813c WritePrivateProfileStringW
0x408140 GetPrivateProfileStringW
0x408144 WideCharToMultiByte
0x408148 MulDiv
0x40814c lstrlenA
0x408150 WriteFile
0x408154 ReadFile
0x408158 MultiByteToWideChar
0x40815c SetFilePointer
0x408160 FindClose
0x408164 FindNextFileW
0x408168 FindFirstFileW
0x40816c DeleteFileW
0x408170 lstrlenW
USER32.dll
0x408194 ScreenToClient
0x408198 GetMessagePos
0x40819c CallWindowProcW
0x4081a0 IsWindowVisible
0x4081a4 LoadBitmapW
0x4081a8 CloseClipboard
0x4081ac SetClipboardData
0x4081b0 EmptyClipboard
0x4081b4 OpenClipboard
0x4081b8 TrackPopupMenu
0x4081bc GetWindowRect
0x4081c0 AppendMenuW
0x4081c4 CreatePopupMenu
0x4081c8 GetSystemMetrics
0x4081cc EndDialog
0x4081d0 EnableMenuItem
0x4081d4 GetSystemMenu
0x4081d8 SetClassLongW
0x4081dc IsWindowEnabled
0x4081e0 SetWindowPos
0x4081e4 DialogBoxParamW
0x4081e8 CheckDlgButton
0x4081ec CreateWindowExW
0x4081f0 SystemParametersInfoW
0x4081f4 RegisterClassW
0x4081f8 SetDlgItemTextW
0x4081fc GetDlgItemTextW
0x408200 MessageBoxIndirectW
0x408204 CharNextA
0x408208 CharUpperW
0x40820c CharPrevW
0x408210 DispatchMessageW
0x408214 PeekMessageW
0x408218 wsprintfA
0x40821c DestroyWindow
0x408220 CreateDialogParamW
0x408224 SetTimer
0x408228 SetWindowTextW
0x40822c PostQuitMessage
0x408230 SetForegroundWindow
0x408234 ShowWindow
0x408238 wsprintfW
0x40823c SendMessageTimeoutW
0x408240 LoadCursorW
0x408244 SetCursor
0x408248 GetWindowLongW
0x40824c GetSysColor
0x408250 CharNextW
0x408254 GetClassInfoW
0x408258 ExitWindowsEx
0x40825c FindWindowExW
0x408260 GetDlgItem
0x408264 SetWindowLongW
0x408268 LoadImageW
0x40826c GetDC
0x408270 EnableWindow
0x408274 InvalidateRect
0x408278 SendMessageW
0x40827c DefWindowProcW
0x408280 BeginPaint
0x408284 GetClientRect
0x408288 FillRect
0x40828c DrawTextW
0x408290 EndPaint
0x408294 IsWindow
GDI32.dll
0x40803c SetBkColor
0x408040 GetDeviceCaps
0x408044 DeleteObject
0x408048 CreateBrushIndirect
0x40804c CreateFontIndirectW
0x408050 SetBkMode
0x408054 SetTextColor
0x408058 SelectObject
SHELL32.dll
0x408178 SHBrowseForFolderW
0x40817c SHGetPathFromIDListW
0x408180 SHGetFileInfoW
0x408184 ShellExecuteW
0x408188 SHFileOperationW
0x40818c SHGetSpecialFolderLocation
ADVAPI32.dll
0x408000 RegEnumKeyW
0x408004 RegOpenKeyExW
0x408008 RegCloseKey
0x40800c RegDeleteKeyW
0x408010 RegDeleteValueW
0x408014 RegCreateKeyExW
0x408018 RegSetValueExW
0x40801c RegQueryValueExW
0x408020 RegEnumValueW
COMCTL32.dll
0x408028 ImageList_AddMasked
0x40802c ImageList_Destroy
0x408030 None
0x408034 ImageList_Create
ole32.dll
0x4082ac CoTaskMemFree
0x4082b0 OleInitialize
0x4082b4 OleUninitialize
0x4082b8 CoCreateInstance
VERSION.dll
0x40829c GetFileVersionInfoSizeW
0x4082a0 GetFileVersionInfoW
0x4082a4 VerQueryValueW
EAT(Export Address Table) is none