popup

Report - Statement.exe

njRAT backdoor Generic Malware Malicious Library Antivirus UPX PE File MSOffice File CAB PE32 OS Name Check OS Processor Check DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.09.27 13:43 Machine s1_win7_x6403
Filename Statement.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
 Behavior Score
6.0
ZERO API file : mailcious
VT API (file) 21 detected (ScreenConnect, Unsafe, grayware, confidence, RemoteAdmin, ConnectWise, Hacktool, CLOUD, Siggen29, Tool, Convagent, Static AI, Suspicious PE, edgo, Detected, MultiInjector, Eldorado, MALICIOUS, BScope, susgen)
md5 dc34163c9eef55d069bea41db98cc414
sha256 934a35f92555d0004e1fb78fd91f6dd33036afa329c0900969adb07305231f74
ssdeep 49152:/Dex5xKkEJkGYYpT0+TFiH7efP0x58IJL+md3rHgDNMKLo8SsxG/XcW32gqkAfoO:N4s6efPQ53JLbd3LINMLaGUW39f0
imphash 9771ee6344923fa220489ab01239bdfd
impfuzzy 24:Hur+UvYDFMUntMS17hlJeDc+pl39T7oLU0OovbOPZvvQEvTZEQQ:HuCtMS17Oc+pp97N3tRvT6N
  Network IP location

Signature (17cnts)

Level Description
warning File has been identified by 21 AntiVirus engines on VirusTotal as malicious
watch Creates known Upatre files
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Connects to a Dynamic DNS Domain
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice One or more potentially interesting buffers were extracted
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed
info Queries for the computername
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path
info Uses Windows APIs to generate a cryptographic key

Rules (20cnts)

Level Name Description Collection
danger Win_Backdoor_njRAT_Zero Win Backdoor njRAT binaries (upload)
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Antivirus Contains references to security software binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info CAB_file_format CAB archive file binaries (download)
info CAB_file_format CAB archive file binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info Microsoft_Office_File_Zero Microsoft Office File binaries (download)
info Microsoft_Office_File_Zero Microsoft Office File binaries (upload)
info OS_Name_Check_Zero OS Name Check Signature binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
dsmf2.zapto.org
whois
Unknown 79.110.49.42 clean
79.110.49.42
whois
Unknown 79.110.49.42 clean

Suricata ids

ET POLICY DNS Query to DynDNS Domain *.zapto .org
ET DROP Spamhaus DROP Listed Traffic Inbound group 8

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x40d134 CorBindToRuntimeEx
KERNEL32.dll
 0x40d000 GetModuleFileNameA
 0x40d004 DecodePointer
 0x40d008 SizeofResource
 0x40d00c LockResource
 0x40d010 LoadLibraryW
 0x40d014 LoadResource
 0x40d018 FindResourceW
 0x40d01c GetProcAddress
 0x40d020 WriteConsoleW
 0x40d024 SetFilePointerEx
 0x40d028 GetConsoleMode
 0x40d02c GetConsoleCP
 0x40d030 FlushFileBuffers
 0x40d034 HeapReAlloc
 0x40d038 HeapSize
 0x40d03c UnhandledExceptionFilter
 0x40d040 SetUnhandledExceptionFilter
 0x40d044 GetCurrentProcess
 0x40d048 TerminateProcess
 0x40d04c IsProcessorFeaturePresent
 0x40d050 QueryPerformanceCounter
 0x40d054 GetCurrentProcessId
 0x40d058 GetCurrentThreadId
 0x40d05c GetSystemTimeAsFileTime
 0x40d060 InitializeSListHead
 0x40d064 IsDebuggerPresent
 0x40d068 GetStartupInfoW
 0x40d06c GetModuleHandleW
 0x40d070 RtlUnwind
 0x40d074 GetLastError
 0x40d078 SetLastError
 0x40d07c EncodePointer
 0x40d080 EnterCriticalSection
 0x40d084 LeaveCriticalSection
 0x40d088 DeleteCriticalSection
 0x40d08c InitializeCriticalSectionAndSpinCount
 0x40d090 TlsAlloc
 0x40d094 TlsGetValue
 0x40d098 TlsSetValue
 0x40d09c TlsFree
 0x40d0a0 FreeLibrary
 0x40d0a4 LoadLibraryExW
 0x40d0a8 RaiseException
 0x40d0ac GetStdHandle
 0x40d0b0 WriteFile
 0x40d0b4 CreateFileW
 0x40d0b8 MultiByteToWideChar
 0x40d0bc WideCharToMultiByte
 0x40d0c0 ExitProcess
 0x40d0c4 GetModuleHandleExW
 0x40d0c8 GetACP
 0x40d0cc CloseHandle
 0x40d0d0 HeapAlloc
 0x40d0d4 HeapFree
 0x40d0d8 FindClose
 0x40d0dc FindFirstFileExA
 0x40d0e0 FindNextFileA
 0x40d0e4 IsValidCodePage
 0x40d0e8 GetOEMCP
 0x40d0ec GetCPInfo
 0x40d0f0 GetCommandLineA
 0x40d0f4 GetCommandLineW
 0x40d0f8 GetEnvironmentStringsW
 0x40d0fc FreeEnvironmentStringsW
 0x40d100 LCMapStringW
 0x40d104 SetStdHandle
 0x40d108 GetFileType
 0x40d10c GetStringTypeW
 0x40d110 GetProcessHeap
OLEAUT32.dll
 0x40d118 VariantInit
 0x40d11c SafeArrayUnaccessData
 0x40d120 SafeArrayCreateVector
 0x40d124 SafeArrayDestroy
 0x40d128 VariantClear
 0x40d12c SafeArrayAccessData

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure