Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6780
Target ID:	0
Parent PID:	2580
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	918016
MD5:	0083D14C374EACC7490D77CF1C0EC24D
Time:	21:00:57
Date:	01/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xbe0000
Modulesize:	942080
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Credential Flusher	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --app="https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-features=CrashRecovery

Details

Is windows:	true
Is dropped:	false
PID:	6832
Target ID:	1
Parent PID:	6780
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --app="https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-features=CrashRecovery
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:00:58
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2080,i,13875054584425462490,14288134942725612422,262144 --disable-features=CrashRecovery /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3244
Target ID:	3
Parent PID:	6832
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2080,i,13875054584425462490,14288134942725612422,262144 --disable-features=CrashRecovery /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:00:58
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3200 --field-trial-handle=2080,i,13875054584425462490,14288134942725612422,262144 --disable-features=CrashRecovery /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7816
Target ID:	4
Parent PID:	6832
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3200 --field-trial-handle=2080,i,13875054584425462490,14288134942725612422,262144 --disable-features=CrashRecovery /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:01:09
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 --field-trial-handle=2080,i,13875054584425462490,14288134942725612422,262144 --disable-features=CrashRecovery /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7824
Target ID:	5
Parent PID:	6832
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 --field-trial-handle=2080,i,13875054584425462490,14288134942725612422,262144 --disable-features=CrashRecovery /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:01:09
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://play.google/intl/

unknown

https://families.google.com/intl/

unknown

https://youtube.com/t/terms?gl=

unknown

https://policies.google.com/technologies/location-data

unknown

https://www.google.com/intl/

unknown

https://apis.google.com/js/api.js

unknown

https://policies.google.com/privacy/google-partners

unknown

https://play.google.com/work/enroll?identifier=

unknown

https://policies.google.com/terms/service-specific

unknown

https://g.co/recover

unknown

https://policies.google.com/privacy/additional

unknown

https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072

unknown

https://play.google.com/log?format=json&hasfast=true&authuser=0

216.58.206.78

https://policies.google.com/technologies/cookies

unknown

https://www.google.com/favicon.ico

142.250.181.228

https://policies.google.com/terms

unknown

https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=

unknown

https://www.google.com

unknown

https://play.google.com/log?hasfast=true&authuser=0&format=json

216.58.206.78

https://play.google.com/log?format=json&hasfast=true

unknown

https://www.youtube.com/t/terms?chromeless=1&hl=

unknown

https://support.google.com/accounts?hl=

unknown

https://policies.google.com/terms/location

unknown

https://policies.google.com/privacy

unknown

https://support.google.com/accounts?p=new-si-ui

unknown

https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage

unknown

There are 16 hidden URLs, click here to show them.

Domains

Name

Malicious

youtube-ui.l.google.com

142.250.186.78

www3.l.google.com

142.250.186.142

play.google.com

216.58.206.78

Details

Name:	play.google.com
IP:	216.58.206.78
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

142.250.181.228

Details

Name:	www.google.com
IP:	142.250.181.228
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

youtube.com

216.58.206.78

Details

Name:	youtube.com
IP:	216.58.206.78
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

accounts.youtube.com

unknown

Details

Name:	accounts.youtube.com
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.youtube.com

unknown

Details

Name:	www.youtube.com
TargetID:	3
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

142.250.186.78

youtube-ui.l.google.com

United States

216.58.206.78

play.google.com

United States

192.168.2.4

unknown

239.255.255.250

unknown

Reserved

142.250.181.228

www.google.com

United States

142.250.186.142

www3.l.google.com

United States

Memdumps

Base Address

Regiontype

Protect

Malicious

15FF000

heap

page read and write

CB4000

unkown

page readonly

B24000

heap

page read and write

CAC000

unkown

page read and write

CF0000

trusted library allocation

page read and write

CAC000

unkown

page write copy

1560000

heap

page read and write

C7C000

unkown

page readonly

980000

heap

page read and write

1612000

heap

page read and write

B24000

heap

page read and write

BE1000

unkown

page execute read

1612000

heap

page read and write

1605000

heap

page read and write

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
file.exe