ScreenShot
Created 2021.03.30 18:21 Machine s1_win7_x6401
Filename ezmumkw.rar
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
AI Score
2
Behavior Score
5.4
ZERO API file : clean
VT API (file) 9 detected (Malicious, Artemis, score, ET#88%, RDMK, cmRtazoLwrxLbTsawg66wQc3xi, Unsafe, 100%, Dridex)
md5 72a78f73900f015106d45b1d1d6149fe
sha256 6ccbc34952f3895fb847368112f920a4bdbc3c1ecab0c0ca1ea0d66da26ae0b1
ssdeep 6144:OGiMOQpsduhD3AZHC/uNbExd+4Zuwz1b0717WLmw6Xg6DqaIDnnlvghr5la:/VhDQZHC/uNY3/zRm8LYQOQlYLl
imphash 5cb457ca82de30b44453a66db17d2e56
impfuzzy 24:bEZMUo31fRiOovhEGMaoXDKlJgv9JSBZatRlJawxm3GKvZ/cgSRmTa1c:bEufHWEGLm9JSCtRLNqcTn1c
  Network IP location

Signature (15cnts)

Level Description
watch A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations.
watch Collects information about installed applications
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice File has been identified by 9 AntiVirus engines on VirusTotal as malicious
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Sends data using the HTTP POST Method
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info One or more processes crashed
info Queries for the computername
info This executable has a PDB path
info Tries to locate where the browsers are installed

Rules (14cnts)

Level Name Description Collection
notice Str_Win32_Http_API Match Windows Http API call binaries (upload)
notice Str_Win32_Internet_API Match Windows Inet API call binaries (upload)
info IsDLL (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check Signature Zero binaries (upload)
info PE_Header_Zero PE File Signature Zero binaries (upload)
info HasDebugData DebugData Check binaries (upload)
info HasRichSignature Rich Signature Check binaries (upload)
info IsWindowsGUI (no description) binaries (upload)
info network_http Communications over HTTP binaries (upload)
info network_tcp_socket Communications over RAW socket binaries (upload)
info Str_Win32_Wininet_Library Match Windows Inet API library declaration binaries (upload)
info Str_Win32_Winsock2_Library Match Winsock 2 API library declaration binaries (upload)
info win_files_operation Affect private profile binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://210.65.244.176/ TW Data Communication Business Group 210.65.244.176 598 mailcious
210.65.244.176 TW Data Communication Business Group 210.65.244.176 mailcious

Suricata ids



Similarity measure (PE file only) - Checking for service failure