Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

LHA9oUEAwZ.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.986323334446305
Filename:	LHA9oUEAwZ.exe
Filesize:	72192
MD5:	3149ac1cd2f798f14c82e4eaa81b1853
SHA1:	7939c17fc5433dcf060c2035bc035e5fefd33078
SHA256:	2391648221057ae4454b46e4010db00fa25551df4835c916ad1cf1354077234f
SHA512:	c584204b5287b1c25fa33e7551504b19e60b89e05bbfe660146da9a1a937e32107f3eb95db5e63377308aa481d478b5e1ccf5c543b95317672328adbc685ad9a
SSDEEP:	1536:1pOkU3DTMDMiAjp076sFiT/xXbC6gywEX3UUzGZDO2mvZRmD:1zUXMYd98QjxbC3I01O22SD
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..e............................./... ...@....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains method to dynamically call methods (often used by packers)	Data Obfuscation	Software Packing
.NET source code contains potential unpacker	Data Obfuscation
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)	Anti Debugging
Machine Learning detection for sample	AV Detection
Protects its processes via BreakOnTermination flag	Operating System Destruction
Sample uses string decryption to hide its real strings	AV Detection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion
Creates a start menu entry (Start Menu\Programs\Startup)	Boot Survival
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
One or more processes crash	System Summary
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Checks the free space of harddrives	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Roaming\testnt.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\testnt.exe
Category:	dropped
Dump:	testnt.exe.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Users\user\Desktop\LHA9oUEAwZ.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	5.986323334446305
Encrypted:	false
Ssdeep:	1536:1pOkU3DTMDMiAjp076sFiT/xXbC6gywEX3UUzGZDO2mvZRmD:1zUXMYd98QjxbC3I01O22SD
Size:	72192
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Yara detected XWorm	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for dropped file	AV Detection
Yara detected Generic Downloader	Networking
Drops PE files	Persistence and Installation Behavior
Creates files inside the user directory	System Summary	Masquerading

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LHA9oUEAwZ.exe_7062d95b25b19cadb9259966c0d1ce298fffcd9_694179a5_37dded76-bd19-4478-840b-4d209993f4c2\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LHA9oUEAwZ.exe_7062d95b25b19cadb9259966c0d1ce298fffcd9_694179a5_37dded76-bd19-4478-840b-4d209993f4c2\Report.wer
Category:	dropped
Dump:	Report.wer.12.dr
ID:	dr_6
Target ID:	12
Process:	C:\Windows\System32\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	1.347194495695942
Encrypted:	false
Ssdeep:	192:w4SgzuMONi3081iHdsgaWz8iyUp2lxG9ZzuiFlZ24lO8/4ipSK:ws3OcE81i5a48iMx6zuiFlY4lO8/I
Size:	65536
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8909.tmp.dmp

Mini DuMP crash report, 16 streams, Tue Mar 26 19:08:39 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER8909.tmp.dmp
Category:	dropped
Dump:	WER8909.tmp.dmp.12.dr
ID:	dr_3
Target ID:	12
Process:	C:\Windows\System32\WerFault.exe
Type:	Mini DuMP crash report, 16 streams, Tue Mar 26 19:08:39 2024, 0x1205a4 type
Entropy:	3.5820875126047125
Encrypted:	false
Ssdeep:	3072:AegQD057bBTZTVFYEy4qRsC7mAocSme3TPm1CCqO+C63+v/Fa:YQ45XBmntsC7mtmeD0qy63Q/g
Size:	486830
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8B7B.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER8B7B.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER8B7B.tmp.WERInternalMetadata.xml.12.dr
ID:	dr_4
Target ID:	12
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.707154126157297
Encrypted:	false
Ssdeep:	192:R6l7wVeJxRJ/M6YNqO9gmfk4jhm4t8KprW89bz6YvkfjRm:R6lXJJU6YAO9gmfk14tRzVvkfo
Size:	9306
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BAB.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BAB.tmp.xml
Category:	dropped
Dump:	WER8BAB.tmp.xml.12.dr
ID:	dr_5
Target ID:	12
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.487138306164124
Encrypted:	false
Ssdeep:	48:cvIwWl8zsZJg771I9DoWpW8VY1Ym8M4JvzSFsfyq8vREzOCalec9d:uIjfrI74B7VRJzfWqaleId
Size:	4925
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\Log.tmp

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Log.tmp
Category:	dropped
Dump:	Log.tmp.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Users\user\Desktop\LHA9oUEAwZ.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.598349098128234
Encrypted:	false
Ssdeep:	3:rRSFYJKXzovNsra:EFYJKDoWra
Size:	29
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\testnt.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 26 16:23:18 2024, mtime=Tue Mar 26 16:23:18 2024, atime=Tue Mar 26 16:23:18 2024, length=72192, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\testnt.lnk
Category:	dropped
Dump:	testnt.lnk.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Users\user\Desktop\LHA9oUEAwZ.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 26 16:23:18 2024, mtime=Tue Mar 26 16:23:18 2024, atime=Tue Mar 26 16:23:18 2024, length=72192, window=hide
Entropy:	5.0557568605011305
Encrypted:	false
Ssdeep:	12:8RAAall/sg4zyN+2Chqi1Y//ZpVeLGuKeX9jAhNHrS/qLBMJdMJzBmV:8RAAul/kzL2h9fV4GFm5AnI8BMJdMJtm
Size:	763
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates a start menu entry (Start Menu\Programs\Startup)	Boot Survival	Registry Run Keys / Startup Folder
Sigma detected: Startup Folder File Write	System Summary
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.12.dr
ID:	dr_7
Target ID:	12
Process:	C:\Windows\System32\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.416742377981971
Encrypted:	false
Ssdeep:	6144:bcifpi6ceLPL9skLmb0m7SWSPtaJG8nAgex285i2MMhA20X4WABlGuNa5+:Ai587SWIZBk2MM6AFBYo
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\LHA9oUEAwZ.exe

"C:\Users\user\Desktop\LHA9oUEAwZ.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6384
Target ID:	2
Parent PID:	4056
Name:	LHA9oUEAwZ.exe
Path:	C:\Users\user\Desktop\LHA9oUEAwZ.exe
Commandline:	"C:\Users\user\Desktop\LHA9oUEAwZ.exe"
Size:	72192
MD5:	3149AC1CD2F798F14C82E4EAA81B1853
Time:	18:23:13
Date:	26/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xdc0000
Modulesize:	98304
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected XWorm	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Yara detected Generic Downloader	Networking
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Startup Folder File Write	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6384 -s 844

Details

Is windows:	true
Is dropped:	false
PID:	3960
Target ID:	12
Parent PID:	6384
Name:	WerFault.exe
Path:	C:\Windows\System32\WerFault.exe
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6384 -s 844
Size:	570736
MD5:	FD27D9F6D02763BDE32511B5DF7FF7A0
Time:	20:08:38
Date:	26/03/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff636e20000
Modulesize:	581632
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

win-britain.gl.at.ply.gg

Details

Name:	win-britain.gl.at.ply.gg
TargetID:	0
From Memory:	false
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection

http://upx.sf.net

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	2
From Memory:	true
Current Path:	C:\Users\user\Desktop\LHA9oUEAwZ.exe
Source:	LHA9oUEAwZ.exe, 00000002.00000002.3242886490.0000000003111000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://ip-api.com/line/?fields=hosting

208.95.112.1

Details

Name:	http://ip-api.com/line/?fields=hosting
IP:	208.95.112.1
TargetID:	2
From Memory:	false
Current Path:	C:\Users\user\Desktop\LHA9oUEAwZ.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking

Domains

Name

Malicious

win-britain.gl.at.ply.gg

147.185.221.18

Details

Name:	win-britain.gl.at.ply.gg
IP:	147.185.221.18
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

ip-api.com

208.95.112.1

Details

Name:	ip-api.com
IP:	208.95.112.1
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Check if machine is in data center or colocation facility	Malware Analysis System Evasion	Security Software Discovery
HTTP GET or POST without a user agent	Networking
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

147.185.221.18

win-britain.gl.at.ply.gg

United States

Details

IP:	147.185.221.18
TargetID:	2
Current Path:	C:\Users\user\Desktop\LHA9oUEAwZ.exe
Country:	United States
Countrycode:	USA
ASN number:	12087
ASN name:	SALSGIVERUS
Private:	false
Domain:	win-britain.gl.at.ply.gg

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

208.95.112.1

ip-api.com

United States

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LHA9oUEAwZ_RASMANCS

FileDirectory