ScreenShot
| Created | 2021.03.27 16:05 | Machine | s1_win7_x6401 |
| Filename | customer3.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 35 detected (AIDetect, malware1, malicious, high confidence, Rasftuby, ScriptKD, Save, RATX, Runner, sbdjj, Unsafe, Score, ai score=81, Wacatac, H6XZVZ, R360804, BrowserModifier, CLOUD, VGwPhdfUXzA) | ||
| md5 | 762ab2472d5f4811ee77c0b67f1f05c7 | ||
| sha256 | ef33f52d8cf80365437ba252815126056981fe95b5814f6a900b43887abe78a9 | ||
| ssdeep | 24576:Y2G/nvxW3WsTXfP3JQ5dF6AXyUo5uoyF6mXy+o5+xfRY:YbA3DX3JQDwIUewAU+rY | ||
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 | ||
| impfuzzy | 48:J9jOX8LKc1XFjsX1Pfc++6WQYgeBtDXMunCHFa:JdJLKc1XFgX1Pfc++VVdBtDXMunMFa | ||
Network IP location
Signature (32cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 35 AntiVirus engines on VirusTotal as malicious |
| watch | Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) |
| watch | One or more non-whitelisted processes were created |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An application raised an exception which may be indicative of an exploit crash |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Executes one or more WMI queries |
| notice | Foreign language identified in PE resource |
| notice | Performs some HTTP requests |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Steals private information from local Internet browsers |
| notice | Terminates another process |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Tries to locate where the browsers are installed |
Rules (74cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | infoStealer_browser_Zero | browser info stealer | memory |
| watch | Chrome_User_Data_Check_Zero | Google Chrome User Data Check | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (upload) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (download) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | vmdetect | Possibly employs anti-virtualization techniques | memory |
| info | win_hook | Affect hook table | memory |
| info | bitcoin | Perform crypto currency mining | memory |
| info | create_com_service | Create a COM server | memory |
| info | create_service | Create a windows service | memory |
| info | cred_local | Steal credential | memory |
| info | escalate_priv | Escalade priviledges | binaries (upload) |
| info | escalate_priv | Escalade priviledges | memory |
| info | HasDebugData | DebugData Check | binaries (download) |
| info | HasDebugData | DebugData Check | binaries (upload) |
| info | HasOverlay | Overlay Check | binaries (download) |
| info | HasOverlay | Overlay Check | binaries (upload) |
| info | HasRichSignature | Rich Signature Check | binaries (download) |
| info | HasRichSignature | Rich Signature Check | binaries (upload) |
| info | inject_thread | Code injection with CreateRemoteThread in a remote process | memory |
| info | IsConsole | (no description) | binaries (download) |
| info | IsPacked | Entropy Check | binaries (upload) |
| info | IsWindowsGUI | (no description) | binaries (download) |
| info | IsWindowsGUI | (no description) | binaries (upload) |
| info | keylogger | Run a keylogger | memory |
| info | migrate_apc | APC queue tasks migration | memory |
| info | network_dga | Communication using dga | memory |
| info | network_dns | Communications use DNS | binaries (download) |
| info | network_dns | Communications use DNS | memory |
| info | network_dropper | File downloader/dropper | memory |
| info | network_ftp | Communications over FTP | memory |
| info | network_http | Communications over HTTP | memory |
| info | network_p2p_win | Communications over P2P network | memory |
| info | network_tcp_listen | Listen for incoming communication | memory |
| info | network_tcp_socket | Communications over RAW socket | binaries (download) |
| info | network_tcp_socket | Communications over RAW socket | memory |
| info | network_udp_sock | Communications over UDP network | memory |
| info | screenshot | Take screenshot | binaries (upload) |
| info | screenshot | Take screenshot | memory |
| info | sniff_audio | Record Audio | memory |
| info | spreading_file | Malware can spread east-west file | memory |
| info | spreading_share | Malware can spread east-west using share drive | memory |
| info | Str_Win32_Wininet_Library | Match Windows Inet API library declaration | memory |
| info | Str_Win32_Winsock2_Library | Match Winsock 2 API library declaration | binaries (download) |
| info | Str_Win32_Winsock2_Library | Match Winsock 2 API library declaration | memory |
| info | win_files_operation | Affect private profile | binaries (upload) |
| info | win_files_operation | Affect private profile | memory |
| info | win_mutex | Create or check mutex | memory |
| info | win_private_profile | Affect private profile | memory |
| info | win_registry | Affect system registries | binaries (download) |
| info | win_registry | Affect system registries | binaries (upload) |
| info | win_registry | Affect system registries | memory |
| info | win_token | Affect system token | binaries (upload) |
| info | win_token | Affect system token | memory |
Network (6cnts) ?
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x433000 GetLastError
0x433004 SetLastError
0x433008 FormatMessageW
0x43300c GetCurrentProcess
0x433010 DeviceIoControl
0x433014 SetFileTime
0x433018 CloseHandle
0x43301c CreateDirectoryW
0x433020 RemoveDirectoryW
0x433024 CreateFileW
0x433028 DeleteFileW
0x43302c CreateHardLinkW
0x433030 GetShortPathNameW
0x433034 GetLongPathNameW
0x433038 MoveFileW
0x43303c GetFileType
0x433040 GetStdHandle
0x433044 WriteFile
0x433048 ReadFile
0x43304c FlushFileBuffers
0x433050 SetEndOfFile
0x433054 SetFilePointer
0x433058 SetFileAttributesW
0x43305c GetFileAttributesW
0x433060 FindClose
0x433064 FindFirstFileW
0x433068 FindNextFileW
0x43306c GetVersionExW
0x433070 GetCurrentDirectoryW
0x433074 GetFullPathNameW
0x433078 FoldStringW
0x43307c GetModuleFileNameW
0x433080 GetModuleHandleW
0x433084 FindResourceW
0x433088 FreeLibrary
0x43308c GetProcAddress
0x433090 GetCurrentProcessId
0x433094 ExitProcess
0x433098 SetThreadExecutionState
0x43309c Sleep
0x4330a0 LoadLibraryW
0x4330a4 GetSystemDirectoryW
0x4330a8 CompareStringW
0x4330ac AllocConsole
0x4330b0 FreeConsole
0x4330b4 AttachConsole
0x4330b8 WriteConsoleW
0x4330bc GetProcessAffinityMask
0x4330c0 CreateThread
0x4330c4 SetThreadPriority
0x4330c8 InitializeCriticalSection
0x4330cc EnterCriticalSection
0x4330d0 LeaveCriticalSection
0x4330d4 DeleteCriticalSection
0x4330d8 SetEvent
0x4330dc ResetEvent
0x4330e0 ReleaseSemaphore
0x4330e4 WaitForSingleObject
0x4330e8 CreateEventW
0x4330ec CreateSemaphoreW
0x4330f0 GetSystemTime
0x4330f4 SystemTimeToTzSpecificLocalTime
0x4330f8 TzSpecificLocalTimeToSystemTime
0x4330fc SystemTimeToFileTime
0x433100 FileTimeToLocalFileTime
0x433104 LocalFileTimeToFileTime
0x433108 FileTimeToSystemTime
0x43310c GetCPInfo
0x433110 IsDBCSLeadByte
0x433114 MultiByteToWideChar
0x433118 WideCharToMultiByte
0x43311c GlobalAlloc
0x433120 LockResource
0x433124 GlobalLock
0x433128 GlobalUnlock
0x43312c GlobalFree
0x433130 LoadResource
0x433134 SizeofResource
0x433138 SetCurrentDirectoryW
0x43313c GetExitCodeProcess
0x433140 GetLocalTime
0x433144 GetTickCount
0x433148 MapViewOfFile
0x43314c UnmapViewOfFile
0x433150 CreateFileMappingW
0x433154 OpenFileMappingW
0x433158 GetCommandLineW
0x43315c SetEnvironmentVariableW
0x433160 ExpandEnvironmentStringsW
0x433164 GetTempPathW
0x433168 MoveFileExW
0x43316c GetLocaleInfoW
0x433170 GetTimeFormatW
0x433174 GetDateFormatW
0x433178 GetNumberFormatW
0x43317c SetFilePointerEx
0x433180 GetConsoleMode
0x433184 GetConsoleCP
0x433188 HeapSize
0x43318c SetStdHandle
0x433190 GetProcessHeap
0x433194 RaiseException
0x433198 GetSystemInfo
0x43319c VirtualProtect
0x4331a0 VirtualQuery
0x4331a4 LoadLibraryExA
0x4331a8 IsProcessorFeaturePresent
0x4331ac IsDebuggerPresent
0x4331b0 UnhandledExceptionFilter
0x4331b4 SetUnhandledExceptionFilter
0x4331b8 GetStartupInfoW
0x4331bc QueryPerformanceCounter
0x4331c0 GetCurrentThreadId
0x4331c4 GetSystemTimeAsFileTime
0x4331c8 InitializeSListHead
0x4331cc TerminateProcess
0x4331d0 RtlUnwind
0x4331d4 EncodePointer
0x4331d8 InitializeCriticalSectionAndSpinCount
0x4331dc TlsAlloc
0x4331e0 TlsGetValue
0x4331e4 TlsSetValue
0x4331e8 TlsFree
0x4331ec LoadLibraryExW
0x4331f0 QueryPerformanceFrequency
0x4331f4 GetModuleHandleExW
0x4331f8 GetModuleFileNameA
0x4331fc GetACP
0x433200 HeapFree
0x433204 HeapAlloc
0x433208 HeapReAlloc
0x43320c GetStringTypeW
0x433210 LCMapStringW
0x433214 FindFirstFileExA
0x433218 FindNextFileA
0x43321c IsValidCodePage
0x433220 GetOEMCP
0x433224 GetCommandLineA
0x433228 GetEnvironmentStringsW
0x43322c FreeEnvironmentStringsW
0x433230 DecodePointer
gdiplus.dll
0x433238 GdiplusShutdown
0x43323c GdiplusStartup
0x433240 GdipCreateHBITMAPFromBitmap
0x433244 GdipCreateBitmapFromStreamICM
0x433248 GdipCreateBitmapFromStream
0x43324c GdipDisposeImage
0x433250 GdipCloneImage
0x433254 GdipFree
0x433258 GdipAlloc
EAT(Export Address Table) Library
KERNEL32.dll
0x433000 GetLastError
0x433004 SetLastError
0x433008 FormatMessageW
0x43300c GetCurrentProcess
0x433010 DeviceIoControl
0x433014 SetFileTime
0x433018 CloseHandle
0x43301c CreateDirectoryW
0x433020 RemoveDirectoryW
0x433024 CreateFileW
0x433028 DeleteFileW
0x43302c CreateHardLinkW
0x433030 GetShortPathNameW
0x433034 GetLongPathNameW
0x433038 MoveFileW
0x43303c GetFileType
0x433040 GetStdHandle
0x433044 WriteFile
0x433048 ReadFile
0x43304c FlushFileBuffers
0x433050 SetEndOfFile
0x433054 SetFilePointer
0x433058 SetFileAttributesW
0x43305c GetFileAttributesW
0x433060 FindClose
0x433064 FindFirstFileW
0x433068 FindNextFileW
0x43306c GetVersionExW
0x433070 GetCurrentDirectoryW
0x433074 GetFullPathNameW
0x433078 FoldStringW
0x43307c GetModuleFileNameW
0x433080 GetModuleHandleW
0x433084 FindResourceW
0x433088 FreeLibrary
0x43308c GetProcAddress
0x433090 GetCurrentProcessId
0x433094 ExitProcess
0x433098 SetThreadExecutionState
0x43309c Sleep
0x4330a0 LoadLibraryW
0x4330a4 GetSystemDirectoryW
0x4330a8 CompareStringW
0x4330ac AllocConsole
0x4330b0 FreeConsole
0x4330b4 AttachConsole
0x4330b8 WriteConsoleW
0x4330bc GetProcessAffinityMask
0x4330c0 CreateThread
0x4330c4 SetThreadPriority
0x4330c8 InitializeCriticalSection
0x4330cc EnterCriticalSection
0x4330d0 LeaveCriticalSection
0x4330d4 DeleteCriticalSection
0x4330d8 SetEvent
0x4330dc ResetEvent
0x4330e0 ReleaseSemaphore
0x4330e4 WaitForSingleObject
0x4330e8 CreateEventW
0x4330ec CreateSemaphoreW
0x4330f0 GetSystemTime
0x4330f4 SystemTimeToTzSpecificLocalTime
0x4330f8 TzSpecificLocalTimeToSystemTime
0x4330fc SystemTimeToFileTime
0x433100 FileTimeToLocalFileTime
0x433104 LocalFileTimeToFileTime
0x433108 FileTimeToSystemTime
0x43310c GetCPInfo
0x433110 IsDBCSLeadByte
0x433114 MultiByteToWideChar
0x433118 WideCharToMultiByte
0x43311c GlobalAlloc
0x433120 LockResource
0x433124 GlobalLock
0x433128 GlobalUnlock
0x43312c GlobalFree
0x433130 LoadResource
0x433134 SizeofResource
0x433138 SetCurrentDirectoryW
0x43313c GetExitCodeProcess
0x433140 GetLocalTime
0x433144 GetTickCount
0x433148 MapViewOfFile
0x43314c UnmapViewOfFile
0x433150 CreateFileMappingW
0x433154 OpenFileMappingW
0x433158 GetCommandLineW
0x43315c SetEnvironmentVariableW
0x433160 ExpandEnvironmentStringsW
0x433164 GetTempPathW
0x433168 MoveFileExW
0x43316c GetLocaleInfoW
0x433170 GetTimeFormatW
0x433174 GetDateFormatW
0x433178 GetNumberFormatW
0x43317c SetFilePointerEx
0x433180 GetConsoleMode
0x433184 GetConsoleCP
0x433188 HeapSize
0x43318c SetStdHandle
0x433190 GetProcessHeap
0x433194 RaiseException
0x433198 GetSystemInfo
0x43319c VirtualProtect
0x4331a0 VirtualQuery
0x4331a4 LoadLibraryExA
0x4331a8 IsProcessorFeaturePresent
0x4331ac IsDebuggerPresent
0x4331b0 UnhandledExceptionFilter
0x4331b4 SetUnhandledExceptionFilter
0x4331b8 GetStartupInfoW
0x4331bc QueryPerformanceCounter
0x4331c0 GetCurrentThreadId
0x4331c4 GetSystemTimeAsFileTime
0x4331c8 InitializeSListHead
0x4331cc TerminateProcess
0x4331d0 RtlUnwind
0x4331d4 EncodePointer
0x4331d8 InitializeCriticalSectionAndSpinCount
0x4331dc TlsAlloc
0x4331e0 TlsGetValue
0x4331e4 TlsSetValue
0x4331e8 TlsFree
0x4331ec LoadLibraryExW
0x4331f0 QueryPerformanceFrequency
0x4331f4 GetModuleHandleExW
0x4331f8 GetModuleFileNameA
0x4331fc GetACP
0x433200 HeapFree
0x433204 HeapAlloc
0x433208 HeapReAlloc
0x43320c GetStringTypeW
0x433210 LCMapStringW
0x433214 FindFirstFileExA
0x433218 FindNextFileA
0x43321c IsValidCodePage
0x433220 GetOEMCP
0x433224 GetCommandLineA
0x433228 GetEnvironmentStringsW
0x43322c FreeEnvironmentStringsW
0x433230 DecodePointer
gdiplus.dll
0x433238 GdiplusShutdown
0x43323c GdiplusStartup
0x433240 GdipCreateHBITMAPFromBitmap
0x433244 GdipCreateBitmapFromStreamICM
0x433248 GdipCreateBitmapFromStream
0x43324c GdipDisposeImage
0x433250 GdipCloneImage
0x433254 GdipFree
0x433258 GdipAlloc
EAT(Export Address Table) Library