Report - TMS_AU003.exe

Malicious Library Downloader Admin Tool (Sysinternals etc ...) UPX PE File DllRegisterServer dll PE32 MZP Format OS Processor Check
ScreenShot
Created 2024.08.19 14:25 Machine s1_win7_x6401
Filename TMS_AU003.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
2.0
ZERO API file : mailcious
VT API (file) 5 detected (AIDetectMalware, Malicious, Generic@AI, RDML, DrRZ6EJHaRtVBjdn2AkkeQ, susgen, confidence)
md5 c010213e251fe238f0d14997e095ecd1
sha256 ee16275cf92fb9d0ba98035d4f08529d11fa38b8e7f99526f199f717ea11f13e
ssdeep 24576:vyKEOC44qnUf3TJklC/V+2wnDQvEa/rK9wL:v+qUfDdwDQvH
imphash 0afc776b8330817a39ec500a606aa390
impfuzzy 192:f3L7smG1sTBbuuArSUvK9aqooqE6pEPbOQadO:f3s1sNAA9oyPbOQt
  Network IP location

Signature (7cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice File has been identified by 5 AntiVirus engines on VirusTotal as malicious
notice Foreign language identified in PE resource
info Checks amount of memory in system
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (9cnts)

Level Name Description Collection
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Network_Downloader File Downloader binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DllRegisterServer_Zero execute regsvr32.exe binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x521154 DeleteCriticalSection
 0x521158 LeaveCriticalSection
 0x52115c EnterCriticalSection
 0x521160 InitializeCriticalSection
 0x521164 VirtualFree
 0x521168 VirtualAlloc
 0x52116c LocalFree
 0x521170 LocalAlloc
 0x521174 GetVersion
 0x521178 GetCurrentThreadId
 0x52117c InterlockedDecrement
 0x521180 InterlockedIncrement
 0x521184 VirtualQuery
 0x521188 WideCharToMultiByte
 0x52118c MultiByteToWideChar
 0x521190 lstrlenA
 0x521194 lstrcpynA
 0x521198 LoadLibraryExA
 0x52119c GetThreadLocale
 0x5211a0 GetStartupInfoA
 0x5211a4 GetProcAddress
 0x5211a8 GetModuleHandleA
 0x5211ac GetModuleFileNameA
 0x5211b0 GetLocaleInfoA
 0x5211b4 GetCommandLineA
 0x5211b8 FreeLibrary
 0x5211bc FindFirstFileA
 0x5211c0 FindClose
 0x5211c4 ExitProcess
 0x5211c8 ExitThread
 0x5211cc CreateThread
 0x5211d0 WriteFile
 0x5211d4 UnhandledExceptionFilter
 0x5211d8 RtlUnwind
 0x5211dc RaiseException
 0x5211e0 GetStdHandle
user32.dll
 0x5211e8 GetKeyboardType
 0x5211ec LoadStringA
 0x5211f0 MessageBoxA
 0x5211f4 CharNextA
advapi32.dll
 0x5211fc RegQueryValueExA
 0x521200 RegOpenKeyExA
 0x521204 RegCloseKey
oleaut32.dll
 0x52120c SysFreeString
 0x521210 SysReAllocStringLen
 0x521214 SysAllocStringLen
kernel32.dll
 0x52121c TlsSetValue
 0x521220 TlsGetValue
 0x521224 LocalAlloc
 0x521228 GetModuleHandleA
advapi32.dll
 0x521230 RegQueryValueExA
 0x521234 RegQueryValueA
 0x521238 RegOpenKeyExA
 0x52123c RegCloseKey
kernel32.dll
 0x521244 lstrcpyA
 0x521248 WritePrivateProfileStringA
 0x52124c WriteFile
 0x521250 WaitForSingleObject
 0x521254 VirtualQuery
 0x521258 VirtualAlloc
 0x52125c Sleep
 0x521260 SizeofResource
 0x521264 SetThreadLocale
 0x521268 SetFilePointer
 0x52126c SetEvent
 0x521270 SetErrorMode
 0x521274 SetEndOfFile
 0x521278 ResumeThread
 0x52127c ResetEvent
 0x521280 ReadFile
 0x521284 MultiByteToWideChar
 0x521288 MulDiv
 0x52128c LockResource
 0x521290 LoadResource
 0x521294 LoadLibraryA
 0x521298 LeaveCriticalSection
 0x52129c InitializeCriticalSection
 0x5212a0 GlobalUnlock
 0x5212a4 GlobalReAlloc
 0x5212a8 GlobalHandle
 0x5212ac GlobalLock
 0x5212b0 GlobalFree
 0x5212b4 GlobalFindAtomA
 0x5212b8 GlobalDeleteAtom
 0x5212bc GlobalAlloc
 0x5212c0 GlobalAddAtomA
 0x5212c4 GetVersionExA
 0x5212c8 GetVersion
 0x5212cc GetTimeZoneInformation
 0x5212d0 GetTickCount
 0x5212d4 GetThreadLocale
 0x5212d8 GetTempPathA
 0x5212dc GetSystemInfo
 0x5212e0 GetStringTypeExA
 0x5212e4 GetStdHandle
 0x5212e8 GetProcAddress
 0x5212ec GetPrivateProfileStringA
 0x5212f0 GetModuleHandleA
 0x5212f4 GetModuleFileNameA
 0x5212f8 GetLocaleInfoA
 0x5212fc GetLocalTime
 0x521300 GetLastError
 0x521304 GetFullPathNameA
 0x521308 GetFileSize
 0x52130c GetExitCodeThread
 0x521310 GetDiskFreeSpaceA
 0x521314 GetDateFormatA
 0x521318 GetCurrentThreadId
 0x52131c GetCurrentProcessId
 0x521320 GetCPInfo
 0x521324 GetACP
 0x521328 FreeResource
 0x52132c InterlockedIncrement
 0x521330 InterlockedExchange
 0x521334 InterlockedDecrement
 0x521338 FreeLibrary
 0x52133c FormatMessageA
 0x521340 FindResourceA
 0x521344 FindFirstFileA
 0x521348 FindClose
 0x52134c FileTimeToLocalFileTime
 0x521350 FileTimeToDosDateTime
 0x521354 EnumCalendarInfoA
 0x521358 EnterCriticalSection
 0x52135c DeleteFileA
 0x521360 DeleteCriticalSection
 0x521364 CreateThread
 0x521368 CreateFileA
 0x52136c CreateEventA
 0x521370 CompareStringA
 0x521374 CloseHandle
version.dll
 0x52137c VerQueryValueA
 0x521380 GetFileVersionInfoSizeA
 0x521384 GetFileVersionInfoA
gdi32.dll
 0x52138c UnrealizeObject
 0x521390 StretchBlt
 0x521394 SetWindowOrgEx
 0x521398 SetViewportOrgEx
 0x52139c SetTextColor
 0x5213a0 SetStretchBltMode
 0x5213a4 SetROP2
 0x5213a8 SetPixel
 0x5213ac SetDIBColorTable
 0x5213b0 SetBrushOrgEx
 0x5213b4 SetBkMode
 0x5213b8 SetBkColor
 0x5213bc SelectPalette
 0x5213c0 SelectObject
 0x5213c4 SaveDC
 0x5213c8 RestoreDC
 0x5213cc RectVisible
 0x5213d0 RealizePalette
 0x5213d4 PatBlt
 0x5213d8 MoveToEx
 0x5213dc MaskBlt
 0x5213e0 LineTo
 0x5213e4 IntersectClipRect
 0x5213e8 GetWindowOrgEx
 0x5213ec GetTextMetricsA
 0x5213f0 GetTextExtentPoint32A
 0x5213f4 GetSystemPaletteEntries
 0x5213f8 GetStockObject
 0x5213fc GetPixel
 0x521400 GetPaletteEntries
 0x521404 GetObjectA
 0x521408 GetDeviceCaps
 0x52140c GetDIBits
 0x521410 GetDIBColorTable
 0x521414 GetDCOrgEx
 0x521418 GetCurrentPositionEx
 0x52141c GetClipBox
 0x521420 GetBrushOrgEx
 0x521424 GetBitmapBits
 0x521428 ExcludeClipRect
 0x52142c DeleteObject
 0x521430 DeleteDC
 0x521434 CreateSolidBrush
 0x521438 CreatePenIndirect
 0x52143c CreatePalette
 0x521440 CreateHalftonePalette
 0x521444 CreateFontIndirectA
 0x521448 CreateDIBitmap
 0x52144c CreateDIBSection
 0x521450 CreateCompatibleDC
 0x521454 CreateCompatibleBitmap
 0x521458 CreateBrushIndirect
 0x52145c CreateBitmap
 0x521460 BitBlt
user32.dll
 0x521468 CreateWindowExA
 0x52146c WindowFromPoint
 0x521470 WinHelpA
 0x521474 WaitMessage
 0x521478 UpdateWindow
 0x52147c UnregisterClassA
 0x521480 UnhookWindowsHookEx
 0x521484 TranslateMessage
 0x521488 TranslateMDISysAccel
 0x52148c TrackPopupMenu
 0x521490 SystemParametersInfoA
 0x521494 ShowWindow
 0x521498 ShowScrollBar
 0x52149c ShowOwnedPopups
 0x5214a0 ShowCursor
 0x5214a4 SetWindowsHookExA
 0x5214a8 SetWindowTextA
 0x5214ac SetWindowPos
 0x5214b0 SetWindowPlacement
 0x5214b4 SetWindowLongA
 0x5214b8 SetTimer
 0x5214bc SetScrollRange
 0x5214c0 SetScrollPos
 0x5214c4 SetScrollInfo
 0x5214c8 SetRect
 0x5214cc SetPropA
 0x5214d0 SetParent
 0x5214d4 SetMenuItemInfoA
 0x5214d8 SetMenu
 0x5214dc SetForegroundWindow
 0x5214e0 SetFocus
 0x5214e4 SetCursor
 0x5214e8 SetClassLongA
 0x5214ec SetCapture
 0x5214f0 SetActiveWindow
 0x5214f4 SendMessageA
 0x5214f8 ScrollWindow
 0x5214fc ScreenToClient
 0x521500 RemovePropA
 0x521504 RemoveMenu
 0x521508 ReleaseDC
 0x52150c ReleaseCapture
 0x521510 RegisterWindowMessageA
 0x521514 RegisterClipboardFormatA
 0x521518 RegisterClassA
 0x52151c RedrawWindow
 0x521520 PtInRect
 0x521524 PostQuitMessage
 0x521528 PostMessageA
 0x52152c PeekMessageA
 0x521530 OffsetRect
 0x521534 OemToCharA
 0x521538 MsgWaitForMultipleObjects
 0x52153c MessageBoxA
 0x521540 MapWindowPoints
 0x521544 MapVirtualKeyA
 0x521548 LoadStringA
 0x52154c LoadKeyboardLayoutA
 0x521550 LoadIconA
 0x521554 LoadCursorA
 0x521558 LoadBitmapA
 0x52155c KillTimer
 0x521560 IsZoomed
 0x521564 IsWindowVisible
 0x521568 IsWindowEnabled
 0x52156c IsWindow
 0x521570 IsRectEmpty
 0x521574 IsIconic
 0x521578 IsDialogMessageA
 0x52157c IsChild
 0x521580 InvalidateRect
 0x521584 IntersectRect
 0x521588 InsertMenuItemA
 0x52158c InsertMenuA
 0x521590 InflateRect
 0x521594 GetWindowThreadProcessId
 0x521598 GetWindowTextA
 0x52159c GetWindowRect
 0x5215a0 GetWindowPlacement
 0x5215a4 GetWindowLongA
 0x5215a8 GetWindowDC
 0x5215ac GetTopWindow
 0x5215b0 GetSystemMetrics
 0x5215b4 GetSystemMenu
 0x5215b8 GetSysColorBrush
 0x5215bc GetSysColor
 0x5215c0 GetSubMenu
 0x5215c4 GetScrollRange
 0x5215c8 GetScrollPos
 0x5215cc GetScrollInfo
 0x5215d0 GetPropA
 0x5215d4 GetParent
 0x5215d8 GetWindow
 0x5215dc GetMenuStringA
 0x5215e0 GetMenuState
 0x5215e4 GetMenuItemInfoA
 0x5215e8 GetMenuItemID
 0x5215ec GetMenuItemCount
 0x5215f0 GetMenu
 0x5215f4 GetLastActivePopup
 0x5215f8 GetKeyboardState
 0x5215fc GetKeyboardLayoutList
 0x521600 GetKeyboardLayout
 0x521604 GetKeyState
 0x521608 GetKeyNameTextA
 0x52160c GetIconInfo
 0x521610 GetForegroundWindow
 0x521614 GetFocus
 0x521618 GetDesktopWindow
 0x52161c GetDCEx
 0x521620 GetDC
 0x521624 GetCursorPos
 0x521628 GetCursor
 0x52162c GetClientRect
 0x521630 GetClassNameA
 0x521634 GetClassInfoA
 0x521638 GetCapture
 0x52163c GetActiveWindow
 0x521640 FrameRect
 0x521644 FindWindowA
 0x521648 FillRect
 0x52164c EqualRect
 0x521650 EnumWindows
 0x521654 EnumThreadWindows
 0x521658 EndPaint
 0x52165c EnableWindow
 0x521660 EnableScrollBar
 0x521664 EnableMenuItem
 0x521668 DrawTextA
 0x52166c DrawMenuBar
 0x521670 DrawIconEx
 0x521674 DrawIcon
 0x521678 DrawFrameControl
 0x52167c DrawEdge
 0x521680 DispatchMessageA
 0x521684 DestroyWindow
 0x521688 DestroyMenu
 0x52168c DestroyIcon
 0x521690 DestroyCursor
 0x521694 DeleteMenu
 0x521698 DefWindowProcA
 0x52169c DefMDIChildProcA
 0x5216a0 DefFrameProcA
 0x5216a4 CreatePopupMenu
 0x5216a8 CreateMenu
 0x5216ac CreateIcon
 0x5216b0 ClientToScreen
 0x5216b4 CheckMenuItem
 0x5216b8 CallWindowProcA
 0x5216bc CallNextHookEx
 0x5216c0 BeginPaint
 0x5216c4 CharNextA
 0x5216c8 CharLowerA
 0x5216cc CharUpperBuffA
 0x5216d0 CharToOemA
 0x5216d4 AdjustWindowRectEx
 0x5216d8 ActivateKeyboardLayout
ole32.dll
 0x5216e0 IsEqualGUID
 0x5216e4 CoTaskMemFree
 0x5216e8 StringFromCLSID
 0x5216ec CoCreateGuid
kernel32.dll
 0x5216f4 Sleep
oleaut32.dll
 0x5216fc SafeArrayPtrOfIndex
 0x521700 SafeArrayPutElement
 0x521704 SafeArrayGetElement
 0x521708 SafeArrayUnaccessData
 0x52170c SafeArrayAccessData
 0x521710 SafeArrayGetUBound
 0x521714 SafeArrayGetLBound
 0x521718 SafeArrayCreate
 0x52171c VariantChangeType
 0x521720 VariantCopyInd
 0x521724 VariantCopy
 0x521728 VariantClear
 0x52172c VariantInit
ole32.dll
 0x521734 CoCreateInstance
 0x521738 CoGetMalloc
 0x52173c CoUninitialize
 0x521740 CoInitialize
 0x521744 IsEqualGUID
oleaut32.dll
 0x52174c CreateErrorInfo
 0x521750 GetErrorInfo
 0x521754 SetErrorInfo
 0x521758 SafeArrayCopy
 0x52175c SafeArrayUnaccessData
 0x521760 SafeArrayAccessData
 0x521764 SafeArrayGetUBound
 0x521768 SafeArrayDestroy
 0x52176c SafeArrayCreate
 0x521770 SysFreeString
comctl32.dll
 0x521778 ImageList_SetIconSize
 0x52177c ImageList_GetIconSize
 0x521780 ImageList_Write
 0x521784 ImageList_Read
 0x521788 ImageList_GetDragImage
 0x52178c ImageList_DragShowNolock
 0x521790 ImageList_SetDragCursorImage
 0x521794 ImageList_DragMove
 0x521798 ImageList_DragLeave
 0x52179c ImageList_DragEnter
 0x5217a0 ImageList_EndDrag
 0x5217a4 ImageList_BeginDrag
 0x5217a8 ImageList_Remove
 0x5217ac ImageList_DrawEx
 0x5217b0 ImageList_Draw
 0x5217b4 ImageList_GetBkColor
 0x5217b8 ImageList_SetBkColor
 0x5217bc ImageList_ReplaceIcon
 0x5217c0 ImageList_Add
 0x5217c4 ImageList_GetImageCount
 0x5217c8 ImageList_Destroy
 0x5217cc ImageList_Create

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure