Edit tour
Windows
Analysis Report
IPrstVM17M.exe
Overview
General Information
| Sample name: | IPrstVM17M.exe (renamed file extension from none to exe, renamed because original name is a hash value) |
| Original sample name: | 3b3e9249075fce915a1671b47e2f4d164d835ab5d425f3aae2502c41409f6448 |
| Analysis ID: | 1430905 |
| MD5: | a23b11e50c1f6fcdb42d3b2582524e2f |
| SHA1: | 8b54ea0bc8e4545759e0ea82d28fd608fe0d97ee |
| SHA256: | 3b3e9249075fce915a1671b47e2f4d164d835ab5d425f3aae2502c41409f6448 |
| Infos: |  |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Queries Google from non browser process on port 80
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Suspicious Copy From or To System Directory
Uses 32bit PE files
Classification
- System is w10x64
IPrstVM17M.exe (PID: 5812 cmdline: "C:\Users\ user\Deskt op\IPrstVM 17M.exe" MD5: A23B11E50C1F6FCDB42D3B2582524E2F) 
conhost.exe (PID: 6164 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 4856 cmdline:
C:\Windows \system32\ cmd.exe /c copy /v / y "C:\User s\user\Des ktop\IPrst VM17M.exe" "C:\Users \user\AppD ata\Local\ Temp\bin.e xe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - cmd.exe (PID: 5024 cmdline:
C:\Windows \system32\ cmd.exe /c copy /v / y "C:\User s\user\Des ktop\IPrst VM17M.exe" D:\bin.ex e MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - cmd.exe (PID: 6368 cmdline:
C:\Windows \system32\ cmd.exe /c echo [aut orun] > D: \autorun.i nf MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - cmd.exe (PID: 6788 cmdline:
C:\Windows \system32\ cmd.exe /c echo open =bin.exe > > D:\autor un.inf MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - cmd.exe (PID: 4788 cmdline:
C:\Windows \system32\ cmd.exe /c copy /v / y "C:\User s\user\Des ktop\IPrst VM17M.exe" E:\bin.ex e MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - cmd.exe (PID: 7152 cmdline:
C:\Windows \system32\ cmd.exe /c echo [aut orun] > E: \autorun.i nf MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - cmd.exe (PID: 6596 cmdline:
C:\Windows \system32\ cmd.exe /c echo open =bin.exe > > E:\autor un.inf MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): | ||
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||