Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6692
Target ID:	0
Parent PID:	2580
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	918528
MD5:	84857D029B892796223A0388E578C717
Time:	20:43:00
Date:	01/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb60000
Modulesize:	942080
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Credential Flusher	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --app="https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-features=CrashRecovery

Details

Is windows:	true
Is dropped:	false
PID:	6744
Target ID:	1
Parent PID:	6692
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --app="https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-features=CrashRecovery
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	20:43:00
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1956,i,6848627385945716294,11725630218479906615,262144 --disable-features=CrashRecovery /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	332
Target ID:	3
Parent PID:	6744
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1956,i,6848627385945716294,11725630218479906615,262144 --disable-features=CrashRecovery /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	20:43:01
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5512 --field-trial-handle=1956,i,6848627385945716294,11725630218479906615,262144 --disable-features=CrashRecovery /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7808
Target ID:	4
Parent PID:	6744
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5512 --field-trial-handle=1956,i,6848627385945716294,11725630218479906615,262144 --disable-features=CrashRecovery /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	20:43:12
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1956,i,6848627385945716294,11725630218479906615,262144 --disable-features=CrashRecovery /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7816
Target ID:	5
Parent PID:	6744
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1956,i,6848627385945716294,11725630218479906615,262144 --disable-features=CrashRecovery /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	20:43:12
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://play.google/intl/

unknown

https://families.google.com/intl/

unknown

https://youtube.com/t/terms?gl=

unknown

https://policies.google.com/technologies/location-data

unknown

https://www.google.com/intl/

unknown

https://apis.google.com/js/api.js

unknown

https://policies.google.com/privacy/google-partners

unknown

https://play.google.com/work/enroll?identifier=

unknown

https://policies.google.com/terms/service-specific

unknown

https://g.co/recover

unknown

https://policies.google.com/privacy/additional

unknown

https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072

unknown

https://play.google.com/log?format=json&hasfast=true&authuser=0

142.250.185.142

https://policies.google.com/technologies/cookies

unknown

https://www.google.com/favicon.ico

142.250.186.68

https://policies.google.com/terms

unknown

https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=

unknown

https://www.google.com

unknown

https://play.google.com/log?hasfast=true&authuser=0&format=json

142.250.185.142

https://play.google.com/log?format=json&hasfast=true

unknown

https://www.youtube.com/t/terms?chromeless=1&hl=

unknown

https://support.google.com/accounts?hl=

unknown

https://policies.google.com/terms/location

unknown

https://policies.google.com/privacy

unknown

https://support.google.com/accounts?p=new-si-ui

unknown

https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage

unknown

There are 16 hidden URLs, click here to show them.

Domains

Name

Malicious

youtube-ui.l.google.com

142.250.184.206

www3.l.google.com

172.217.16.206

play.google.com

142.250.185.142

Details

Name:	play.google.com
IP:	142.250.185.142
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

142.250.186.68

Details

Name:	www.google.com
IP:	142.250.186.68
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

youtube.com

142.250.186.46

Details

Name:	youtube.com
IP:	142.250.186.46
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

accounts.youtube.com

unknown

Details

Name:	accounts.youtube.com
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.youtube.com

unknown

Details

Name:	www.youtube.com
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

142.250.186.46

youtube.com

United States

142.250.186.68

www.google.com

United States

172.217.16.206

www3.l.google.com

United States

142.250.185.110

unknown

United States

192.168.2.4

unknown

192.168.2.6

unknown

239.255.255.250

unknown

Reserved

142.250.185.142

play.google.com

United States

142.250.184.206

youtube-ui.l.google.com

United States

Memdumps

Base Address

Regiontype

Protect

Malicious

13F0000

heap

page read and write

B61000

unkown

page execute read

1422000

heap

page read and write

7C0000

heap

page read and write

C22000

unkown

page readonly

142A000

heap

page read and write

1224000

heap

page read and write

104E000

stack

page read and write

1224000

heap

page read and write

B4E000

stack

page read and write

10D0000

heap

page read and write

103F000

stack

page read and write

3700000

trusted library allocation

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
file.exe