Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

1.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.806039795276499
Filename:	1.exe
Filesize:	750592
MD5:	60ff6dcfe9ed4741b4ffb91cd3bd6895
SHA1:	89bec9456328957250b9ec8b30ec87495ab1a2e1
SHA256:	6d923f02c2252e4a2ea98a8685fc5237354e2853791855f1a451a390dd85cbb9
SHA512:	e8621aa3346c9fe7438ba383a8e77c1cad73cf79e91b13f93688422317846a58de0b5f6cce859b924829c8aa77c3a0ac0822cc23a93166b31b3fc53141f5bea4
SSDEEP:	12288:qhOgu0A2s2qPVGNbTuMuKBD7hpvAOezBmEjpvbNOuopsfqH2YGJL7bWz:qbuFPST0sDd1ezBmEFTgsf6hG57bWz
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_..............P..T..........Vf... ........@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Antivirus / Scanner detection for submitted sample	AV Detection
Sample uses process hollowing technique	HIPS / PFW / Operating System Protection Evasion	Shared Modules
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
.NET source code references suspicious native API functions	HIPS / PFW / Operating System Protection Evasion	Native API
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Machine Learning detection for sample	AV Detection
.NET source code contains potential unpacker	Data Obfuscation	Software Packing
.NET source code contains method to dynamically call methods (often used by packers)	Data Obfuscation
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion
.NET source code contains very large array initializations	System Summary	Disable or Modify Tools
.NET source code contains very large strings	System Summary
Tries to detect virtualization through RDTSC time measurements	Malware Analysis System Evasion
Modifies the context of a thread in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara signature match	System Summary
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Detected potential crypto function	System Summary	Encrypted Channel
Found potential string decryption / allocating functions	System Summary
Contains functionality to call native functions	System Summary
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Sample file is different than original file name gathered from version info	System Summary
Contains functionality to read the PEB	Anti Debugging
Checks if the current process is being debugged	Anti Debugging	Security Software Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Queries a list of all running processes	Malware Analysis System Evasion
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Uses an in-process (OLE) Automation server	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Creates mutexes	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information Archive Collected Data
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1.exe.log
Category:	dropped
Dump:	1.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\1.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.3387892510515025
Encrypted:	false
Ssdeep:	24:MLU84jE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4sAmE4Ks:MgvjHK5HKH1qHiYHKh3oPtHo6hAHKzeL
Size:	1314
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\1.exe

Details

Is windows:	false
Is dropped:	false
PID:	1892
Target ID:	0
Parent PID:	1028
Name:	1.exe
Path:	C:\Users\user\Desktop\1.exe
Commandline:	C:\Users\user\Desktop\1.exe
Size:	750592
MD5:	60FF6DCFE9ED4741B4FFB91CD3BD6895
Time:	03:30:03
Date:	21/11/2023
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x990000
Modulesize:	770048
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\1.exe

Details

Is windows:	false
Is dropped:	false
PID:	2136
Target ID:	2
Parent PID:	1892
Name:	1.exe
Path:	C:\Users\user\Desktop\1.exe
Commandline:	C:\Users\user\Desktop\1.exe
Size:	750592
MD5:	60FF6DCFE9ED4741B4FFB91CD3BD6895
Time:	03:30:04
Date:	21/11/2023
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb50000
Modulesize:	770048
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

Details

Is windows:	true
Is dropped:	false
PID:	1028
Target ID:	3
Parent PID:	2136
Name:	explorer.exe
Class:	explorer
Path:	C:\Windows\explorer.exe
Commandline:	C:\Windows\Explorer.EXE
Size:	5141208
MD5:	662F4F92FDE3557E86D110526BB578D5
Time:	03:30:04
Date:	21/11/2023
Reason:	existingprocessinject
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff674740000
Modulesize:	5120000
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection

C:\Windows\SysWOW64\colorcpl.exe

Details

Is windows:	true
Is dropped:	false
PID:	3716
Target ID:	4
Parent PID:	1028
Name:	colorcpl.exe
Path:	C:\Windows\SysWOW64\colorcpl.exe
Commandline:	C:\Windows\SysWOW64\colorcpl.exe
Size:	86528
MD5:	DB71E132EBF1FEB6E93E8A2A0F0C903D
Time:	03:30:06
Date:	21/11/2023
Reason:	newprocess
Reputation:	moderate
Is admin:	false
Is elevated:	false
Modulebase:	0xe00000
Modulesize:	102400
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample uses process hollowing technique	HIPS / PFW / Operating System Protection Evasion	Shared Modules Process Injection
Sample file is different than original file name gathered from version info	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\user\Desktop\1.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2212
Target ID:	5
Parent PID:	3716
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	/c del "C:\Users\user\Desktop\1.exe"
Size:	236544
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Time:	03:30:09
Date:	21/11/2023
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x790000
Modulesize:	368640
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	3948
Target ID:	6
Parent PID:	2212
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	03:30:09
Date:	21/11/2023
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://www.lbarco.com/jskg/?yV3lvHf=sl42yIbVTE2EkcOIsEKOUlHCBbE7QxdA6NZ7PagwYH4YR2l/R8Pf4e2TsXHmMhsmvqG9&8pbLu=d8z4X8O0M

34.149.87.45

http://www.lactationdrink.com/jskg/?yV3lvHf=VpJkz2P0T+/fMnrM7Dd1ATiiN68XLLnGpPbE/bn1fGrx+Ecv7ydvnShawUNCssxxEBuD&8pbLu=d8z4X8O0M

167.172.69.40

http://www.erotictoybox.com/jskg/?yV3lvHf=YCW0/yd7C01aElrhcPhS/kt9m722krufJvCDJvN/MprEBXvxMY86CRBbv2aG0eSAUYQv&8pbLu=d8z4X8O0M

23.227.38.74

http://www.saraadamchak.com/jskg/?yV3lvHf=D3ZsiJPHujYqAAcPubxypI16Ov1mNCduO0wq0OOwpknW2PP1SKlK/fdwCNTvhBS54Rsq&8pbLu=d8z4X8O0M

23.227.38.74

www.switchtoambitwithmirtha.com/jskg/

https://word.office.comon

unknown

http://www.bootyfashions.comReferer:

unknown

http://www.lactationdrink.com

unknown

http://www.lbarco.com/jskg/www.bootyfashions.com

unknown

http://www.ppc-listing.infoReferer:

unknown

http://www.dog2meeting.com

unknown

http://www.coryfireshop.com

unknown

http://www.lacroixundkress.com/jskg/www.saraadamchak.com

unknown

http://www.successwithyolandafgreen.com/jskg/www.lbarco.com

unknown

https://powerpoint.office.comcember

unknown

http://www.successwithyolandafgreen.comReferer:

unknown

http://www.lacroixundkress.comReferer:

unknown

http://www.lactationdrink.comReferer:

unknown

http://www.successwithyolandafgreen.com/jskg/

unknown

https://excel.office.com

unknown

http://schemas.micro

unknown

http://www.ppc-listing.info/jskg/www.pnorg.net

unknown

http://www.pnorg.net/jskg/

unknown

http://www.saraadamchak.com

unknown

http://www.successwithyolandafgreen.com

unknown

http://www.switchtoambitwithmirtha.com/jskg/

unknown

http://www.saraadamchak.com/jskg/

unknown

http://www.saraadamchak.com/jskg/www.kvrkl.com

unknown

http://www.erotictoybox.comReferer:

unknown

http://www.kvrkl.com/jskg/www.switchtoambitwithmirtha.com

unknown

http://www.saraadamchak.comReferer:

unknown

http://www.pnorg.netReferer:

unknown

http://www.coryfireshop.com/jskg/

unknown

http://www.ppc-listing.info/jskg/

unknown

http://www.revistabrasileiramarketing.info/jskg/

unknown

http://www.coryfireshop.com/jskg/www.lacroixundkress.com

unknown

https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe

unknown

http://www.ppc-listing.info

unknown

http://www.wisdomtoothguru.com/jskg/www.successwithyolandafgreen.com

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://www.wisdomtoothguru.comReferer:

unknown

http://www.kvrkl.com/jskg/

unknown

https://wns.windows.com/)s

unknown

http://www.kvrkl.com

unknown

http://www.topazkibblez.com

unknown

http://www.coryfireshop.comReferer:

unknown

http://www.dog2meeting.com/jskg/www.erotictoybox.com

unknown

http://www.revistabrasileiramarketing.info/jskg/www.lactationdrink.com

unknown

http://www.wisdomtoothguru.com/jskg/

unknown

http://www.litespeedtech.com/error-page

unknown

http://www.lbarco.comReferer:

unknown

http://www.lbarco.com

unknown

http://www.revistabrasileiramarketing.infoReferer:

unknown

http://www.topazkibblez.comReferer:

unknown

http://www.bootyfashions.com

unknown

http://www.topazkibblez.com/jskg/www.coryfireshop.com

unknown

http://www.pnorg.net

unknown

http://www.pnorg.net/jskg/www.dog2meeting.com

unknown

http://www.lactationdrink.com/jskg/www.wisdomtoothguru.com

unknown

http://www.switchtoambitwithmirtha.com/jskg/www.ppc-listing.info

unknown

https://outlook.com

unknown

http://www.erotictoybox.com/jskg/

unknown

https://www.cloudflare.com/5xx-error-landing

unknown

http://www.topazkibblez.com/jskg/

unknown

http://www.erotictoybox.com

unknown

http://www.dog2meeting.comReferer:

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
1.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report1.exe

Files

Processes

URLs

IOC Report
1.exe