Report - lamp.exe

Stealc Gen1 Generic Malware Malicious Library UPX Malicious Packer Anti_VM PE File PE32 DLL OS Processor Check
ScreenShot
Created 2024.09.04 10:08 Machine s1_win7_x6403
Filename lamp.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
Behavior Score
12.4
ZERO API file : malware
VT API (file) 36 detected (AIDetectMalware, Malicious, score, Unsafe, Jaik, Attribute, HighConfidence, high confidence, Themida, PWSX, Kryptik@AI, RDML, ADpNLyPZ6cEpxLMQjcAoZA, Real Protect, high, Stealc, Static AI, Malicious PE, Detected, ai score=86, R661988, ZexaF, VDWaaO41B4c, Probably Heur, ExeHeaderL)
md5 54dd56c2c79350de18dc0be27360520d
sha256 4dd18eb9b199c980ea742761d2faddc7d977b7f938ba158852cc7be6d0b681b4
ssdeep 49152:nso3sEFO4iNDPvNrb7KnjPU4ECoK8efYTc:RFFWNbNK7Uc8Er
imphash 2eabe9054cad5152567f0699947a2c5b
impfuzzy 3:sBv:A
  Network IP location

Signature (28cnts)

Level Description
danger File has been identified by 36 AntiVirus engines on VirusTotal as malicious
watch Checks for the presence of known devices from debuggers and forensic tools
watch Checks for the presence of known windows from debuggers and forensic tools
watch Checks the CPU name from registry
watch Checks the version of Bios
watch Collects information about installed applications
watch Communicates with host for which no DNS query was performed
watch Detects VMWare through the in instruction feature
watch Harvests credentials from local email clients
watch Harvests credentials from local FTP client softwares
notice A process attempted to delay the analysis task.
notice Allocates read-write-execute memory (usually to unpack itself)
notice An executable file was downloaded by the process lamp.exe
notice Creates executable files on the filesystem
notice Expresses interest in specific running processes
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Searches running processes potentially to identify processes for sandbox evasion
notice Sends data using the HTTP POST Method
notice Steals private information from local Internet browsers
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Tries to locate where the browsers are installed

Rules (12cnts)

Level Name Description Collection
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch UPX_Zero UPX packed file binaries (download)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (10cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://185.215.113.100/0d60be0de163924d/nss3.dll Unknown 185.215.113.100 clean
http://185.215.113.100/0d60be0de163924d/freebl3.dll Unknown 185.215.113.100 clean
http://185.215.113.100/e2b1563c6670f193.php Unknown 185.215.113.100 41968 mailcious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll Unknown 185.215.113.100 clean
http://185.215.113.100/0d60be0de163924d/sqlite3.dll Unknown 185.215.113.100 clean
http://185.215.113.100/ Unknown 185.215.113.100 41969 mailcious
http://185.215.113.100/0d60be0de163924d/mozglue.dll Unknown 185.215.113.100 clean
http://185.215.113.100/0d60be0de163924d/softokn3.dll Unknown 185.215.113.100 clean
http://185.215.113.100/0d60be0de163924d/msvcp140.dll Unknown 185.215.113.100 clean
185.215.113.100 Unknown 185.215.113.100 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x63f030 lstrcpy

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure