Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

cH0s914NeF.exe

PE32+ executable (console) x86-64, for MS Windows

initial sample

Details

Filetype:	PE32+ executable (console) x86-64, for MS Windows
Entropy:	5.857488034921309
Filename:	cH0s914NeF.exe
Filesize:	2434849
MD5:	0cfc4721129ac02deb897ed2becafd9a
SHA1:	7cd5ee2d1b58f5a2d8ee00b2cc880df752ef0081
SHA256:	fc0e10c66b7e8f4c6d744e4c9ed4ce3407018c2b4ff71a327f5fb613d2ca3ca9
SHA512:	dfca0b365f463c8ab9eefcf0946dff89f6ae7e182b97cd4c2af11f97a757ccfe3f61697525174963ac9e0d000101933cda5ecd64fc1e1a12a8a50b44d50edb00
SSDEEP:	24576:62HcXHZ8AW2HV21dFiE0lHN1N12pDJN7555X555d555y555N8pYqzDy3+Ec0xMkF:FcXHZN1HVyFiE00pK8pNvFCb546
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...-o.f.j..3w....'...........................@.............................. .......]%...@... ............................

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to detect sleep reduction / modifications	Malware Analysis System Evasion	File and Directory Discovery
Found API chain indicative of debugger detection	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts Access Token Manipulation
Contains functionality to launch a process as a different user	System Summary
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Detected potential crypto function	System Summary	Process Discovery Archive Collected Data Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May check if the current machine is a sandbox (GetTickCount - Sleep)	Malware Analysis System Evasion	Security Software Discovery
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	File and Directory Discovery
PE / OLE file has an invalid certificate	System Summary	File and Directory Discovery
PE file contains an invalid checksum	Data Obfuscation
PE file contains more sections than normal	System Summary	System Information Discovery
PE file contains sections with non-standard names	Data Obfuscation
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to create pipes for IPC	Language, Device and Operating System Detection	Process Injection
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

\Device\ConDrv

Unicode text, UTF-8 text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\cH0s914NeF.exe
Type:	Unicode text, UTF-8 text, with CRLF line terminators
Entropy:	5.084746143794873
Encrypted:	false
Ssdeep:	384:eUyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyVXyw:eUyVXyVXyVXyVXyVXyVXyVXyVXyVXyVL
Size:	18191
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\cH0s914NeF.exe

"C:\Users\user\Desktop\cH0s914NeF.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4304
Target ID:	0
Parent PID:	1028
Name:	cH0s914NeF.exe
Path:	C:\Users\user\Desktop\cH0s914NeF.exe
Commandline:	"C:\Users\user\Desktop\cH0s914NeF.exe"
Size:	2434849
MD5:	0CFC4721129AC02DEB897ED2BECAFD9A
Time:	15:21:52
Date:	20/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	991232
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected CobaltStrike	Remote Access Functionality
Yara detected CobaltStrike	Remote Access Functionality
Yara detected CobaltStrike	Remote Access Functionality
Yara detected CobaltStrike	Remote Access Functionality
Yara detected Powershell download and execute	HIPS / PFW / Operating System Protection Evasion
PE / OLE file has an invalid certificate	System Summary
PE file contains an invalid checksum	Data Obfuscation
PE file contains more sections than normal	System Summary
PE file contains sections with non-standard names	Data Obfuscation
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4296
Target ID:	1
Parent PID:	4304
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	15:21:52
Date:	20/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://118.89.125.171:886/ga.js

118.89.125.171

http://118.89.125.171:886/ZZv3

118.89.125.171

http://118.89.125.171:886/ZZv3ce

unknown

http://118.89.125.171:886/ZZv3mMM

unknown

http://118.89.125.171:886/ga.jsO

unknown

http://118.89.125.171:886/ga.jsp

unknown

http://118.89.125.171:886/ga.js5.171:886/ga.js

unknown

http://118.89.125.171:886/ga.js6

unknown

http://118.89.125.171:886/ga.js8

unknown

http://118.89.125.171:886/ga.jsX

unknown

http://118.89.125.171:886/ga.jsc

unknown

http://127.0.0.1:%u/

unknown

http://118.89.125.171:886/ga.js5.171:886/ga.jsl

unknown

There are 4 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

118.89.125.171

unknown

China

Details

IP:	118.89.125.171
TargetID:	0
Current Path:	C:\Users\user\Desktop\cH0s914NeF.exe
Country:	China
Countrycode:	CHN
ASN number:	45090
ASN name:	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

3660000

direct allocation

page execute and read and write

3A60000

direct allocation

page execute and read and write

36A2000

direct allocation

page execute and read and write

4A2000

unkown

page read and write

4D2000

unkown

page write copy

320D000

stack

page read and write

135000

heap

page read and write

162000

heap

page read and write

3618000

stack

page read and write

6FA000

stack

page read and write

CD5000

heap

page read and write

4D1000

unkown

page write copy

139000

heap

page read and write

4D1000

unkown

page read and write

401000

unkown

page execute read

18B000

heap

page read and write

160000

heap

page read and write

D0000

heap

page read and write

4A2000

unkown

page write copy

90000

heap

page read and write

400000

unkown

page readonly

4A4000

unkown

page write copy

80000

heap

page read and write

4D6000

unkown

page readonly

4A6000

unkown

page readonly

3AAC000

direct allocation

page execute and read and write

CD0000

heap

page read and write

DC000

heap

page read and write

D6000

heap

page read and write

2FFF000

stack

page read and write

3AA5000

direct allocation

page execute and read and write

3AA8000

direct allocation

page execute and read and write

EA000

heap

page read and write

4D6000

unkown

page readonly

9CF000

stack

page read and write

2DBE000

stack

page read and write

15E000

heap

page read and write

4A6000

unkown

page readonly

3AB0000

direct allocation

page execute and read and write

128000

heap

page read and write

162000

heap

page read and write

400000

unkown

page readonly

15B000

heap

page read and write

14F000

heap

page read and write

BE2000

heap

page read and write

B0000

heap

page read and write

340D000

stack

page read and write

15B000

heap

page read and write

401000

unkown

page execute read

14F000

heap

page read and write

There are 40 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
cH0s914NeF.exe

Files

Processes

URLs

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportcH0s914NeF.exe

Files

Processes

URLs

IPs

Memdumps

IOC Report
cH0s914NeF.exe