Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

HJoRg2I07j.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.493556339745227
Filename:	HJoRg2I07j.exe
Filesize:	446976
MD5:	f1d836a36148e8d03bf2df952e970fbd
SHA1:	8170e8a3633a479b9abd91b31fd835cc2f34d690
SHA256:	2fa632c146a49f8c954b231ebcc0df2ccdbecd23797d084c423c0010f3380332
SHA512:	e073b93f5f082c9e57db409b54207be262791d4297e34111116ecfba381bd0828e1fd5fe4988af56ad75429e2ceb087d9a0da9f07d9ec82c2e1b0231fd74d778
SSDEEP:	12288:bRmHUjaD/yzl4gH8Mhb+L0mspumesPW1X8i5:naD/yzWgcxLirSsi5
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%.................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion
Machine Learning detection for sample	AV Detection
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior
Found large amount of non-executed APIs	Malware Analysis System Evasion
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Checks the free space of harddrives	Malware Analysis System Evasion
Contains functionality to download additional files from the internet	Networking
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to modify the execution of threads in other processes
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion	System Information Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Reads ini files	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Uses an in-process (OLE) Automation server	System Summary
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Category:	dropped
Dump:	Utsysc.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\HJoRg2I07j.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.493556339745227
Encrypted:	false
Ssdeep:	12288:bRmHUjaD/yzl4gH8Mhb+L0mspumesPW1X8i5:naD/yzWgcxLirSsi5
Size:	446976
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Creates an undocumented autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Machine Learning detection for dropped file	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Abnormal high CPU Usage	System Summary
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Found large amount of non-executed APIs	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\246122658369

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\246122658369
Category:	dropped
Dump:	246122658369.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Entropy:	7.884974172413794
Encrypted:	false
Ssdeep:	1536:C0gend/8VbUf8lJH/X0UEi0QVcVT4fvXZcSM9YCGfkX8G6nPlbdnR+6C23ceKfRv:gex87lJH/kU1bVtpMXGfG8BnP5gZ
Size:	98136
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe:Zone.Identifier

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe:Zone.Identifier
Category:	modified
Dump:	Utsysc.exe_Zone.Identifier.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\HJoRg2I07j.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Ssdeep:	3:ggPYV:rPYV
Size:	26
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Creates an undocumented autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Machine Learning detection for dropped file	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Abnormal high CPU Usage	System Summary
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Found large amount of non-executed APIs	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Tries to load missing DLLs	System Summary	DLL Side-Loading
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll

HTML document, ASCII text

dropped

Details

File:	C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll
Category:	dropped
Dump:	clip64.dll.1.dr
ID:	dr_4
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Type:	HTML document, ASCII text
Entropy:	5.189283772624827
Encrypted:	false
Ssdeep:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knVVXQxBFEcXaoD:J0+oxBeRmR9etdzRxGezH0qfQ2ma+
Size:	275
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll

HTML document, ASCII text

dropped

Details

File:	C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll
Category:	dropped
Dump:	cred64.dll.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Type:	HTML document, ASCII text
Entropy:	5.189283772624827
Encrypted:	false
Ssdeep:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knVVXQxBFEcXaoD:J0+oxBeRmR9etdzRxGezH0qfQ2ma+
Size:	275
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\HJoRg2I07j.exe

"C:\Users\user\Desktop\HJoRg2I07j.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5360
Target ID:	0
Parent PID:	1028
Name:	HJoRg2I07j.exe
Path:	C:\Users\user\Desktop\HJoRg2I07j.exe
Commandline:	"C:\Users\user\Desktop\HJoRg2I07j.exe"
Size:	446976
MD5:	F1D836A36148E8D03BF2DF952E970FBD
Time:	01:11:51
Date:	09/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x3f0000
Modulesize:	462848
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

"C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"

Details

Is windows:	false
Is dropped:	true
PID:	1084
Target ID:	1
Parent PID:	5360
Name:	Utsysc.exe
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Size:	446976
MD5:	F1D836A36148E8D03BF2DF952E970FBD
Time:	01:11:51
Date:	09/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xdb0000
Modulesize:	462848
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Sample uses string decryption to hide its real strings	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F

Details

Is windows:	true
Is dropped:	false
PID:	2876
Target ID:	2
Parent PID:	1084
Name:	schtasks.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\schtasks.exe
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Size:	187904
MD5:	48C2FE20575769DE916F48EF0676A965
Time:	01:11:51
Date:	09/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x670000
Modulesize:	204800
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Details

Is windows:	false
Is dropped:	true
PID:	616
Target ID:	5
Parent PID:	1068
Name:	Utsysc.exe
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Commandline:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Size:	446976
MD5:	F1D836A36148E8D03BF2DF952E970FBD
Time:	01:11:52
Date:	09/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xdb0000
Modulesize:	462848
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Sample uses string decryption to hide its real strings	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Details

Is windows:	false
Is dropped:	true
PID:	1372
Target ID:	6
Parent PID:	1068
Name:	Utsysc.exe
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Commandline:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Size:	446976
MD5:	F1D836A36148E8D03BF2DF952E970FBD
Time:	01:12:01
Date:	09/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xdb0000
Modulesize:	462848
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Sample uses string decryption to hide its real strings	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Details

Is windows:	false
Is dropped:	true
PID:	6580
Target ID:	9
Parent PID:	1068
Name:	Utsysc.exe
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Commandline:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Size:	446976
MD5:	F1D836A36148E8D03BF2DF952E970FBD
Time:	01:13:00
Date:	09/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xdb0000
Modulesize:	462848
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Sample uses string decryption to hide its real strings	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Details

Is windows:	false
Is dropped:	true
PID:	6612
Target ID:	10
Parent PID:	1068
Name:	Utsysc.exe
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Commandline:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Size:	446976
MD5:	F1D836A36148E8D03BF2DF952E970FBD
Time:	01:14:00
Date:	09/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xdb0000
Modulesize:	462848
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Sample uses string decryption to hide its real strings	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Details

Is windows:	false
Is dropped:	true
PID:	1876
Target ID:	11
Parent PID:	1068
Name:	Utsysc.exe
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Commandline:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Size:	446976
MD5:	F1D836A36148E8D03BF2DF952E970FBD
Time:	01:15:00
Date:	09/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xdb0000
Modulesize:	462848
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Sample uses string decryption to hide its real strings	AV Detection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Add Scheduled Task Parent	System Summary
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	6048
Target ID:	4
Parent PID:	2876
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	01:11:51
Date:	09/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://atillapro.com/vsdjcn3khS/index.php?scr=1

185.196.8.137

Details

Name:	http://atillapro.com/vsdjcn3khS/index.php?scr=1
IP:	185.196.8.137
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Snort IDS alert for network traffic	Networking

http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll

185.196.8.137

Details

Name:	http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll
IP:	185.196.8.137
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Snort IDS alert for network traffic	Networking

atillapro.com/vsdjcn3khS/index.php

Details

Name:	atillapro.com/vsdjcn3khS/index.php
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\HJoRg2I07j.exe
Source:	config extractor
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

http://atillapro.com/vsdjcn3khS/index.php

185.196.8.137

Details

Name:	http://atillapro.com/vsdjcn3khS/index.php
IP:	185.196.8.137
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Snort IDS alert for network traffic	Networking

http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll

185.196.8.137

Details

Name:	http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll
IP:	185.196.8.137
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Snort IDS alert for network traffic	Networking

Domains

Name

Malicious

atillapro.com

185.196.8.137

Details

Name:	atillapro.com
IP:	185.196.8.137
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

IPs

Domain

Country

Malicious

185.196.8.137

atillapro.com

Switzerland

Details

IP:	185.196.8.137
TargetID:	1
Current Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Country:	Switzerland
Countrycode:	CHE
ASN number:	34888
ASN name:	SIMPLECARRER2IT
Private:	false
Domain:	atillapro.com

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Startup

Memdumps

Base Address

Regiontype

Protect

Malicious

DB1000

unkown

page execute read

3F1000

unkown

page execute read

DB1000

unkown

page execute read

DB1000

unkown

page execute read

DB1000

unkown

page execute read

DB1000

unkown

page execute read

DB1000

unkown

page execute read

DB1000

unkown

page execute read

3F1000

unkown

page execute read

DB1000

unkown

page execute read

DB1000

unkown

page execute read

DB1000

unkown

page execute read

DB1000

unkown

page execute read

1060000

heap

page read and write

687C000

stack

page read and write

4DE1000

heap

page read and write

15C0000

heap

page read and write

13B0000

heap

page read and write

149E000

stack

page read and write

CED000

heap

page read and write

4EE2000

heap

page read and write

40EE000

stack

page read and write

1360000

heap

page read and write

AFA000

stack

page read and write

2920000

heap

page read and write

4EEA000

heap

page read and write

677C000

stack

page read and write

41EF000

stack

page read and write

E16000

unkown

page write copy

D3B000

heap

page read and write

4DE1000

heap

page read and write

CBA000

heap

page read and write

E04000

unkown

page readonly

42EA000

heap

page read and write

1076000

heap

page read and write

1590000

heap

page read and write

B70000

heap

page read and write

41CA000

heap

page read and write

41D0000

heap

page read and write

E16000

unkown

page write copy

F6E000

stack

page read and write

68BC000

stack

page read and write

4EEA000

heap

page read and write

3E20000

heap

page read and write

F2F000

stack

page read and write

45B000

unkown

page readonly

E16000

unkown

page read and write

1067000

heap

page read and write

2590000

heap

page read and write

125F000

stack

page read and write

BDC000

stack

page read and write

3F6F000

stack

page read and write

D68000

heap

page read and write

147F000

heap

page read and write

1380000

heap

page read and write

41CA000

heap

page read and write

4DE1000

heap

page read and write

4EE7000

heap

page read and write

E19000

unkown

page read and write

C8E000

stack

page read and write

4DE1000

heap

page read and write

3F0000

unkown

page readonly

7F0000

heap

page read and write

4EE6000

heap

page read and write

D68000

heap

page read and write

E04000

unkown

page readonly

41F4000

heap

page read and write

41C0000

heap

page read and write

D6C000

heap

page read and write

E16000

unkown

page write copy

CB0000

heap

page read and write

DB0000

unkown

page readonly

512E000

heap

page read and write

E1B000

unkown

page readonly

4700000

heap

page read and write

E1B000

unkown

page readonly

4DE1000

heap

page read and write

4EE8000

heap

page read and write

DB0000

unkown

page readonly

41C0000

heap

page read and write

4EEC000

heap

page read and write

41EA000

heap

page read and write

D84000

heap

page read and write

E70000

heap

page read and write

E19000

unkown

page read and write

4EEB000

heap

page read and write

D3B000

heap

page read and write

E16000

unkown

page read and write

5130000

heap

page read and write

4DE1000

heap

page read and write

DAE000

stack

page read and write

423A000

heap

page read and write

9FE000

stack

page read and write

444000

unkown

page readonly

DB0000

unkown

page readonly

C70000

heap

page read and write

13BA000

heap

page read and write

4DE1000

heap

page read and write

E77000

heap

page read and write

4EE1000

heap

page read and write

4EEF000

heap

page read and write

D70000

heap

page read and write

DB0000

unkown

page readonly

42EA000

heap

page read and write

2840000

heap

page read and write

159A000

heap

page read and write

C8D000

stack

page read and write

456000

unkown

page write copy

4EE8000

heap

page read and write

16FF000

stack

page read and write

CF0000

heap

page read and write

4EE6000

heap

page read and write

4EE1000

heap

page read and write

E04000

unkown

page readonly

DB0000

unkown

page readonly

47DE000

heap

page read and write

E04000

unkown

page readonly

5120000

heap

page read and write

E04000

unkown

page readonly

E16000

unkown

page read and write

E18000

unkown

page write copy

4DE1000

heap

page read and write

41DA000

heap

page read and write

CED000

heap

page read and write

78B000

stack

page read and write

E04000

unkown

page readonly

4DE1000

heap

page read and write

42E0000

heap

page read and write

4DE1000

heap

page read and write

E1B000

unkown

page readonly

D60000

heap

page read and write

ADC000

stack

page read and write

D17000

heap

page read and write

2926000

heap

page read and write

4230000

heap

page read and write

15CA000

heap

page read and write

44C0000

heap

page read and write

7F0000

heap

page read and write

3B6A000

heap

page read and write

19FF000

stack

page read and write

2810000

heap

page read and write

4EE6000

heap

page read and write

DB0000

unkown

page readonly

94C000

stack

page read and write

D68000

heap

page read and write

4307000

heap

page read and write

E04000

unkown

page readonly

4DE1000

heap

page read and write

A17000

heap

page read and write

4300000

heap

page read and write

E18000

unkown

page write copy

42EA000

heap

page read and write

D0D000

heap

page read and write

E1B000

unkown

page readonly

4DE1000

heap

page read and write

5121000

heap

page read and write

D37000

heap

page read and write

3E25000

heap

page read and write

C45000

heap

page read and write

D70000

heap

page read and write

B60000

heap

page read and write

E16000

unkown

page write copy

B80000

heap

page read and write

D3B000

heap

page read and write

E18000

unkown

page write copy

2789000

stack

page read and write

29D0000

heap

page read and write

D5F000

heap

page read and write

44CA000

heap

page read and write

D6C000

heap

page read and write

810000

heap

page read and write

DB0000

unkown

page readonly

3C2A000

heap

page read and write

D00000

heap

page read and write

E04000

unkown

page readonly

3C20000

heap

page read and write

69C0000

heap

page read and write

4DE1000

heap

page read and write

CEE000

heap

page read and write

65FE000

stack

page read and write

DB0000

unkown

page readonly

459000

unkown

page read and write

E1B000

unkown

page readonly

42E0000

heap

page read and write

4310000

heap

page read and write

4DE1000

heap

page read and write

3E3A000

heap

page read and write

C90000

heap

page read and write

4EE6000

heap

page read and write

458000

unkown

page write copy

4DE1000

heap

page read and write

3060000

heap

page read and write

E18000

unkown

page write copy

C77000

heap

page read and write

DB0000

unkown

page readonly

D14000

heap

page read and write

40AF000

stack

page read and write

E19000

unkown

page read and write

4DE1000

heap

page read and write

3F0000

unkown

page readonly

2844000

heap

page read and write

1507000

heap

page read and write

4EEF000

heap

page read and write

106F000

stack

page read and write

41E0000

heap

page read and write

E16000

unkown

page write copy

D1F000

heap

page read and write

4DE1000

heap

page read and write

42E0000

heap

page read and write

3C3A000

heap

page read and write

FAE000

stack

page read and write

4790000

trusted library allocation

page read and write

3BD0000

heap

page read and write

FFC000

stack

page read and write

433A000

heap

page read and write

4EE1000

heap

page read and write

EAE000

stack

page read and write

4EE8000

heap

page read and write

45B000

unkown

page readonly

431A000

heap

page read and write

D60000

heap

page read and write

D70000

heap

page read and write

E1B000

unkown

page readonly

D3B000

heap

page read and write

E1B000

unkown

page readonly

E6E000

stack

page read and write

4DE1000

heap

page read and write

E04000

unkown

page readonly

4F90000

heap

page read and write

41F0000

heap

page read and write

9B0000

heap

page read and write

3B60000

heap

page read and write

14EE000

stack

page read and write

4EEC000

heap

page read and write

292A000

heap

page read and write

E1B000

unkown

page readonly

4160000

heap

page read and write

5130000

heap

page read and write

4DE1000

heap

page read and write

4EE8000

heap

page read and write

4218000

heap

page read and write

4200000

heap

page read and write

E1B000

unkown

page readonly

4EE8000

heap

page read and write

4DE1000

heap

page read and write

4EE6000

heap

page read and write

4DE1000

heap

page read and write

4330000

heap

page read and write

4DE1000

heap

page read and write

E16000

unkown

page read and write

456000

unkown

page read and write

3FAE000

stack

page read and write

4DE1000

heap

page read and write

42E0000

heap

page read and write

41F0000

heap

page read and write

15CA000

heap

page read and write

3E30000

heap

page read and write

D81000

heap

page read and write

7E0000

heap

page read and write

13FF000

stack

page read and write

C40000

heap

page read and write

64FD000

stack

page read and write

77C000

stack

page read and write

12FE000

stack

page read and write

C40000

heap

page read and write

12FC000

stack

page read and write

69BC000

stack

page read and write

E16000

unkown

page read and write

4DE1000

heap

page read and write

A10000

heap

page read and write

3E26000

heap

page read and write

3C30000

heap

page read and write

42EA000

heap

page read and write

136A000

heap

page read and write

4DE1000

heap

page read and write

7FC000

stack

page read and write

E04000

unkown

page readonly

67C000

stack

page read and write

42E0000

heap

page read and write

CA0000

heap

page read and write

E19000

unkown

page read and write

E04000

unkown

page readonly

D68000

heap

page read and write

3BDA000

heap

page read and write

E18000

unkown

page write copy

D68000

heap

page read and write

4EE2000

heap

page read and write

1360000

heap

page read and write

3E6E000

stack

page read and write

BD0000

heap

page read and write

4EE2000

heap

page read and write

DB0000

unkown

page readonly

1370000

heap

page read and write

42EA000

heap

page read and write

138A000

heap

page read and write

D60000

heap

page read and write

1380000

heap

page read and write

E16000

unkown

page write copy

CBE000

heap

page read and write

15C0000

heap

page read and write

AFC000

stack

page read and write

444000

unkown

page readonly

E1B000

unkown

page readonly

1500000

heap

page read and write

4DE1000

heap

page read and write

D70000

heap

page read and write

E1B000

unkown

page readonly

D0D000

heap

page read and write

4EE1000

heap

page read and write

EB0000

heap

page read and write

D37000

heap

page read and write

D58000

heap

page read and write

2D6B000

stack

page read and write

CFC000

stack

page read and write

2D90000

heap

page read and write

D37000

heap

page read and write

EF0000

heap

page read and write

DB0000

unkown

page readonly

C1E000

stack

page read and write

E19000

unkown

page read and write

D65000

heap

page read and write

There are 311 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
HJoRg2I07j.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportHJoRg2I07j.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
HJoRg2I07j.exe