popup

Report - st.exe

  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.03.09 15:24 Machine s1_win7_x6401
Filename st.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
10
 Behavior Score
10.2
ZERO API file : malware
VT API (file) 58 detected (AIDetect, malware1, malicious, high confidence, DeepScan, Andromeda, Unsafe, Tepfer, Save, TrojanPSW, Kryptik, Eldorado, Attribute, HighConfidence, DropperX, Mint, igirvk, CLOUD, R + Troj, AutoG, Malware@#20ancth38ve6o, clrko, R002C0WKT20, Swisyn, Static AI, Malicious PE, czuv, ProcessHijack, By1@aq, PSWTroj, kcloud, Azorult, score, Glupteba, R356808, Lockbit, ai score=87, BScope, Bruteforce, HHUR, qqpass, Qqrob, Hqaz, susgen, HHUN, GdSda, confidence, 100%, HwoCsR8A)
md5 94016e834271793465e36252c9d2f73e
sha256 3165b8d9ba511ac3f03f759a1cd159f268bbe7600eb9949cfd60142acecb25eb
ssdeep 6144:fVLR9m5AiNLMZl08H7vYZQ+UPnynkJjSy0yxQcGCMs:fVdGkNHkG+Gny2S8QU
imphash 5e94b7a3d72659a8df71e4d09dc4dd28
impfuzzy 24:DbG2qQLr1KBSMvd5NTnvbZMnqV443lBtWGhlncvDc/J3IAjHuOZyvDkRS6jMilvO:uR7dhBVBtWG3cet1uDgSYgA6
  Network IP location

Signature (18cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
danger File has been identified by 58 AntiVirus engines on VirusTotal as malicious
danger Executed a process and injected code into it
watch Allocates execute permission to another process indicative of possible code injection
watch Communicates with host for which no DNS query was performed
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Looks up the external IP address
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Potentially malicious URLs were found in the process memory dump
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Yara rule detected in process memory
info Checks if process is being debugged by a debugger
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (51cnts)

Level Name Description Collection
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature Zero binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info win_hook Affect hook table memory
info create_com_service Create a COM server memory
info create_service Create a windows service memory
info cred_local Steal credential memory
info escalate_priv Escalade priviledges memory
info HasOverlay Overlay Check binaries (upload)
info hijack_network Hijack network configuration memory
info inject_thread Code injection with CreateRemoteThread in a remote process memory
info IsWindowsGUI (no description) binaries (upload)
info keylogger Run a keylogger memory
info migrate_apc APC queue tasks migration memory
info network_dga Communication using dga memory
info network_dns Communications use DNS memory
info network_dropper File downloader/dropper memory
info network_ftp Communications over FTP memory
info network_http Communications over HTTP memory
info network_p2p_win Communications over P2P network memory
info network_tcp_listen Listen for incoming communication memory
info network_tcp_socket Communications over RAW socket memory
info network_toredo Communications over Toredo network memory
info network_udp_sock Communications over UDP network memory
info screenshot Take screenshot memory
info sniff_audio Record Audio memory
info spreading_file Malware can spread east-west file memory
info spreading_share Malware can spread east-west using share drive memory
info Str_Win32_Wininet_Library Match Windows Inet API library declaration memory
info Str_Win32_Winsock2_Library Match Winsock 2 API library declaration memory
info win_files_operation Affect private profile binaries (upload)
info win_files_operation Affect private profile memory
info win_mutex Create or check mutex binaries (upload)
info win_mutex Create or check mutex memory
info win_private_profile Affect private profile memory
info win_registry Affect system registries memory
info win_token Affect system token memory

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://api.ipify.org/?format=xml
whois
US AMAZON-AES 54.225.155.255 clean
api.ipify.org
whois
US AMAZON-AES 54.235.189.250 clean
50.19.252.36
whois
US AMAZON-AES 50.19.252.36 clean
45.67.231.4
whois
NL Serverius Holding B.V. 45.67.231.4 mailcious

Suricata ids

ET POLICY External IP Lookup (ipify .org)

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401000 CreateFileA
 0x401004 SetDefaultCommConfigA
 0x401008 CreateMutexW
 0x40100c HeapCompact
 0x401010 GetLocaleInfoA
 0x401014 WriteConsoleOutputCharacterA
 0x401018 HeapAlloc
 0x40101c EndUpdateResourceW
 0x401020 InterlockedCompareExchange
 0x401024 GetTickCount
 0x401028 GetConsoleTitleA
 0x40102c WriteFile
 0x401030 CreateActCtxW
 0x401034 ReadConsoleInputA
 0x401038 GetSystemPowerStatus
 0x40103c GetSystemWindowsDirectoryA
 0x401040 GetFileAttributesW
 0x401044 SetSystemPowerState
 0x401048 GetGeoInfoA
 0x40104c GetModuleFileNameW
 0x401050 lstrlenW
 0x401054 SetTapePosition
 0x401058 LCMapStringA
 0x40105c AttachConsole
 0x401060 VirtualAlloc
 0x401064 BeginUpdateResourceW
 0x401068 ResetEvent
 0x40106c LoadLibraryA
 0x401070 SetConsoleCtrlHandler
 0x401074 SetConsoleWindowInfo
 0x401078 GetTapeParameters
 0x40107c WaitForMultipleObjects
 0x401080 GetVolumePathNamesForVolumeNameA
 0x401084 GetModuleHandleA
 0x401088 RequestDeviceWakeup
 0x40108c CreateMailslotA
 0x401090 ReleaseMutex
 0x401094 CloseHandle
 0x401098 GetWindowsDirectoryW
 0x40109c GetPrivateProfileSectionW
 0x4010a0 WriteProcessMemory
 0x4010a4 lstrcpyW
 0x4010a8 TerminateProcess
 0x4010ac GetCurrentProcess
 0x4010b0 UnhandledExceptionFilter
 0x4010b4 SetUnhandledExceptionFilter
 0x4010b8 IsDebuggerPresent
 0x4010bc GetStartupInfoW
 0x4010c0 RaiseException
 0x4010c4 RtlUnwind
 0x4010c8 GetLastError
 0x4010cc HeapFree
 0x4010d0 EnterCriticalSection
 0x4010d4 LeaveCriticalSection
 0x4010d8 GetModuleHandleW
 0x4010dc GetProcAddress
 0x4010e0 TlsGetValue
 0x4010e4 TlsAlloc
 0x4010e8 TlsSetValue
 0x4010ec TlsFree
 0x4010f0 InterlockedIncrement
 0x4010f4 SetLastError
 0x4010f8 GetCurrentThreadId
 0x4010fc InterlockedDecrement
 0x401100 SetFilePointer
 0x401104 Sleep
 0x401108 ExitProcess
 0x40110c GetStdHandle
 0x401110 GetModuleFileNameA
 0x401114 FreeEnvironmentStringsW
 0x401118 GetEnvironmentStringsW
 0x40111c GetCommandLineW
 0x401120 SetHandleCount
 0x401124 GetFileType
 0x401128 GetStartupInfoA
 0x40112c DeleteCriticalSection
 0x401130 HeapCreate
 0x401134 VirtualFree
 0x401138 QueryPerformanceCounter
 0x40113c GetCurrentProcessId
 0x401140 GetSystemTimeAsFileTime
 0x401144 HeapReAlloc
 0x401148 GetCPInfo
 0x40114c GetACP
 0x401150 GetOEMCP
 0x401154 IsValidCodePage
 0x401158 MultiByteToWideChar
 0x40115c SetStdHandle
 0x401160 WideCharToMultiByte
 0x401164 GetConsoleCP
 0x401168 GetConsoleMode
 0x40116c FlushFileBuffers
 0x401170 HeapSize
 0x401174 InitializeCriticalSectionAndSpinCount
 0x401178 LCMapStringW
 0x40117c GetStringTypeA
 0x401180 GetStringTypeW
 0x401184 WriteConsoleA
 0x401188 GetConsoleOutputCP
 0x40118c WriteConsoleW
USER32.dll
 0x401194 GetAltTabInfoW

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure