ScreenShot
| Created | 2021.03.12 16:30 | Machine | s1_win7_x6401 |
| Filename | HDggVMlF.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 49 detected (AIDetect, malware1, malicious, high confidence, Delf, FSEP, Unsafe, Save, Eldorado, Coins, fitdqk, PWSX, Gencirc, Azorult, COINSTEAL, SMPIS, Static AI, Suspicious PE, XPACK, Stimilina, KBot, score, R260844, ai score=88, TrojanPSW, PasswordStealer, RDMK, cmRtazrKjzlYWUrz4B64t0OUQ5zA, GenAsa, zpkWsvf3gpo, susgen, Genetic, confidence, 100%, QVM05) | ||
| md5 | 6980f0a8333b9ebe6718c7142fc1b963 | ||
| sha256 | 3631857b05872e653e961bf5f6313b091860b76448c555cefa67741de18eaedc | ||
| ssdeep | 3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgioq:faO1tme++wiX | ||
| imphash | 6d1f2b41411eacafcf447fc002d8cb00 | ||
| impfuzzy | 24:8cfpwYz5nv6OovsgO0MXg+4Qw3J1w2+u2Ag2mZDq2CflOOCntY5F4OwxA:8cfp95nlngO0Mw+4QuPhl2ulOOT5F4RA | ||
Network IP location
Signature (24cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 49 AntiVirus engines on VirusTotal as malicious |
| watch | Appends a known CryptoMix ransomware file extension to files that have been encrypted |
| watch | Attempts to access Bitcoin/ALTCoin wallets |
| watch | Checks the CPU name from registry |
| watch | Collects information about installed applications |
| watch | Harvests credentials from local email clients |
| watch | Harvests credentials from local FTP client softwares |
| watch | Harvests information related to installed instant messenger clients |
| notice | Creates executable files on the filesystem |
| notice | Drops an executable to the user AppData folder |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Queries for potentially installed applications |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The executable uses a known packer |
| info | Tries to locate where the browsers are installed |
Rules (85cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| notice | Str_Win32_Http_API | Match Windows Http API call | binaries (upload) |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | binaries (upload) |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (download) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (download) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
| info | borland_delphi | Borland Delphi 2.0 - 7.0 / 2005 - 2007 | binaries (upload) |
| info | create_com_service | Create a COM server | memory |
| info | create_service | Create a windows service | memory |
| info | cred_ff | Steal Firefox credential | binaries (download) |
| info | cred_local | Steal credential | memory |
| info | escalate_priv | Escalade priviledges | memory |
| info | HasDebugData | DebugData Check | binaries (download) |
| info | HasDigitalSignature | DigitalSignature Check | binaries (download) |
| info | HasOverlay | Overlay Check | binaries (download) |
| info | HasRichSignature | Rich Signature Check | binaries (download) |
| info | hijack_network | Hijack network configuration | memory |
| info | ImportTableIsBad | ImportTable Check | binaries (download) |
| info | inject_thread | Code injection with CreateRemoteThread in a remote process | memory |
| info | IsConsole | (no description) | binaries (download) |
| info | IsPacked | Entropy Check | binaries (download) |
| info | IsWindowsGUI | (no description) | binaries (download) |
| info | IsWindowsGUI | (no description) | binaries (upload) |
| info | keylogger | Run a keylogger | binaries (upload) |
| info | keylogger | Run a keylogger | memory |
| info | migrate_apc | APC queue tasks migration | binaries (download) |
| info | migrate_apc | APC queue tasks migration | memory |
| info | network_dga | Communication using dga | memory |
| info | network_dns | Communications use DNS | binaries (download) |
| info | network_dns | Communications use DNS | binaries (upload) |
| info | network_dns | Communications use DNS | memory |
| info | network_dropper | File downloader/dropper | memory |
| info | network_ftp | Communications over FTP | memory |
| info | network_http | Communications over HTTP | binaries (upload) |
| info | network_http | Communications over HTTP | memory |
| info | network_p2p_win | Communications over P2P network | memory |
| info | network_tcp_listen | Listen for incoming communication | binaries (download) |
| info | network_tcp_listen | Listen for incoming communication | memory |
| info | network_tcp_socket | Communications over RAW socket | binaries (download) |
| info | network_tcp_socket | Communications over RAW socket | binaries (upload) |
| info | network_tcp_socket | Communications over RAW socket | memory |
| info | network_toredo | Communications over Toredo network | memory |
| info | network_udp_sock | Communications over UDP network | memory |
| info | screenshot | Take screenshot | binaries (upload) |
| info | screenshot | Take screenshot | memory |
| info | sniff_audio | Record Audio | memory |
| info | spreading_file | Malware can spread east-west file | memory |
| info | spreading_share | Malware can spread east-west using share drive | memory |
| info | Str_Win32_Wininet_Library | Match Windows Inet API library declaration | binaries (upload) |
| info | Str_Win32_Wininet_Library | Match Windows Inet API library declaration | memory |
| info | Str_Win32_Winsock2_Library | Match Winsock 2 API library declaration | binaries (download) |
| info | Str_Win32_Winsock2_Library | Match Winsock 2 API library declaration | binaries (upload) |
| info | Str_Win32_Winsock2_Library | Match Winsock 2 API library declaration | memory |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (download) |
| info | win_files_operation | Affect private profile | binaries (download) |
| info | win_files_operation | Affect private profile | binaries (upload) |
| info | win_files_operation | Affect private profile | memory |
| info | win_mutex | Create or check mutex | binaries (download) |
| info | win_mutex | Create or check mutex | binaries (upload) |
| info | win_mutex | Create or check mutex | memory |
| info | win_private_profile | Affect private profile | memory |
| info | win_registry | Affect system registries | binaries (download) |
| info | win_registry | Affect system registries | binaries (upload) |
| info | win_registry | Affect system registries | memory |
| info | win_token | Affect system token | binaries (download) |
| info | win_token | Affect system token | memory |
Network (3cnts) ?
Suricata ids
ET MALWARE AZORult v3.3 Server Response M3
PE API
IAT(Import Address Table) Library
kernel32.dll
0x41d0dc DeleteCriticalSection
0x41d0e0 LeaveCriticalSection
0x41d0e4 EnterCriticalSection
0x41d0e8 InitializeCriticalSection
0x41d0ec VirtualFree
0x41d0f0 VirtualAlloc
0x41d0f4 LocalFree
0x41d0f8 LocalAlloc
0x41d0fc GetTickCount
0x41d100 QueryPerformanceCounter
0x41d104 GetVersion
0x41d108 GetCurrentThreadId
0x41d10c WideCharToMultiByte
0x41d110 MultiByteToWideChar
0x41d114 GetThreadLocale
0x41d118 GetStartupInfoA
0x41d11c GetModuleFileNameA
0x41d120 GetLocaleInfoA
0x41d124 GetCommandLineA
0x41d128 FreeLibrary
0x41d12c ExitProcess
0x41d130 WriteFile
0x41d134 UnhandledExceptionFilter
0x41d138 RtlUnwind
0x41d13c RaiseException
0x41d140 GetStdHandle
user32.dll
0x41d148 GetKeyboardType
0x41d14c MessageBoxA
0x41d150 CharNextA
advapi32.dll
0x41d158 RegQueryValueExA
0x41d15c RegOpenKeyExA
0x41d160 RegCloseKey
oleaut32.dll
0x41d168 SysFreeString
0x41d16c SysReAllocStringLen
0x41d170 SysAllocStringLen
kernel32.dll
0x41d178 GetModuleHandleA
advapi32.dll
0x41d180 RegOpenKeyExA
0x41d184 RegEnumKeyA
0x41d188 FreeSid
kernel32.dll
0x41d190 WriteFile
0x41d194 Sleep
0x41d198 LocalFree
0x41d19c LoadLibraryExW
0x41d1a0 LoadLibraryA
0x41d1a4 GlobalUnlock
0x41d1a8 GlobalLock
0x41d1ac GetTickCount
0x41d1b0 GetSystemInfo
0x41d1b4 GetProcAddress
0x41d1b8 GetModuleHandleA
0x41d1bc GetModuleFileNameA
0x41d1c0 GetFileAttributesW
0x41d1c4 GetCurrentProcessId
0x41d1c8 GetCurrentProcess
0x41d1cc FreeLibrary
0x41d1d0 FindNextFileW
0x41d1d4 FindFirstFileW
0x41d1d8 FindClose
0x41d1dc ExitProcess
0x41d1e0 DeleteFileW
0x41d1e4 CreateDirectoryW
0x41d1e8 CopyFileW
gdi32.dll
0x41d1f0 SelectObject
0x41d1f4 DeleteObject
0x41d1f8 DeleteDC
0x41d1fc CreateCompatibleDC
0x41d200 CreateCompatibleBitmap
0x41d204 BitBlt
user32.dll
0x41d20c ReleaseDC
0x41d210 GetSystemMetrics
0x41d214 GetDC
0x41d218 CharToOemBuffA
ole32.dll
0x41d220 OleInitialize
0x41d224 CoCreateInstance
EAT(Export Address Table) is none
kernel32.dll
0x41d0dc DeleteCriticalSection
0x41d0e0 LeaveCriticalSection
0x41d0e4 EnterCriticalSection
0x41d0e8 InitializeCriticalSection
0x41d0ec VirtualFree
0x41d0f0 VirtualAlloc
0x41d0f4 LocalFree
0x41d0f8 LocalAlloc
0x41d0fc GetTickCount
0x41d100 QueryPerformanceCounter
0x41d104 GetVersion
0x41d108 GetCurrentThreadId
0x41d10c WideCharToMultiByte
0x41d110 MultiByteToWideChar
0x41d114 GetThreadLocale
0x41d118 GetStartupInfoA
0x41d11c GetModuleFileNameA
0x41d120 GetLocaleInfoA
0x41d124 GetCommandLineA
0x41d128 FreeLibrary
0x41d12c ExitProcess
0x41d130 WriteFile
0x41d134 UnhandledExceptionFilter
0x41d138 RtlUnwind
0x41d13c RaiseException
0x41d140 GetStdHandle
user32.dll
0x41d148 GetKeyboardType
0x41d14c MessageBoxA
0x41d150 CharNextA
advapi32.dll
0x41d158 RegQueryValueExA
0x41d15c RegOpenKeyExA
0x41d160 RegCloseKey
oleaut32.dll
0x41d168 SysFreeString
0x41d16c SysReAllocStringLen
0x41d170 SysAllocStringLen
kernel32.dll
0x41d178 GetModuleHandleA
advapi32.dll
0x41d180 RegOpenKeyExA
0x41d184 RegEnumKeyA
0x41d188 FreeSid
kernel32.dll
0x41d190 WriteFile
0x41d194 Sleep
0x41d198 LocalFree
0x41d19c LoadLibraryExW
0x41d1a0 LoadLibraryA
0x41d1a4 GlobalUnlock
0x41d1a8 GlobalLock
0x41d1ac GetTickCount
0x41d1b0 GetSystemInfo
0x41d1b4 GetProcAddress
0x41d1b8 GetModuleHandleA
0x41d1bc GetModuleFileNameA
0x41d1c0 GetFileAttributesW
0x41d1c4 GetCurrentProcessId
0x41d1c8 GetCurrentProcess
0x41d1cc FreeLibrary
0x41d1d0 FindNextFileW
0x41d1d4 FindFirstFileW
0x41d1d8 FindClose
0x41d1dc ExitProcess
0x41d1e0 DeleteFileW
0x41d1e4 CreateDirectoryW
0x41d1e8 CopyFileW
gdi32.dll
0x41d1f0 SelectObject
0x41d1f4 DeleteObject
0x41d1f8 DeleteDC
0x41d1fc CreateCompatibleDC
0x41d200 CreateCompatibleBitmap
0x41d204 BitBlt
user32.dll
0x41d20c ReleaseDC
0x41d210 GetSystemMetrics
0x41d214 GetDC
0x41d218 CharToOemBuffA
ole32.dll
0x41d220 OleInitialize
0x41d224 CoCreateInstance
EAT(Export Address Table) is none