Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4708
Target ID:	1
Parent PID:	4056
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	1995776
MD5:	9D2EED099096486E2AE388B2B220497C
Time:	23:35:10
Date:	29/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	4890624
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Nymaim	E-Banking Fraud, Stealing of Sensitive Information
Machine Learning detection for sample	AV Detection
PE file contains section with special chars	System Summary
PE file contains an invalid checksum	Data Obfuscation
PE file contains sections with non-standard names	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
PE file has a big raw section	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 644

Details

Is windows:	true
Is dropped:	false
PID:	7496
Target ID:	14
Parent PID:	4708
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 644
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	01:29:34
Date:	30/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x320000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://185.156.72.65/soft/download

185.156.72.65

Details

Name:	http://185.156.72.65/soft/download
IP:	185.156.72.65
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\Desktop\file.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

http://upx.sf.net

unknown

http://185.156.72.65/dll/key

185.156.72.65

Details

Name:	http://185.156.72.65/dll/key
IP:	185.156.72.65
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\Desktop\file.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

http://185.156.72.65/files/download

185.156.72.65

Details

Name:	http://185.156.72.65/files/download
IP:	185.156.72.65
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\Desktop\file.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174

unknown

Details

Name:	http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
TargetID:	-1
From Memory:	true
Source:	file.exe, 00000001.00000003.1710735382.0000000005497000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712604425.0000000005581000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712500901.00000000054DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711758033.00000000054F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710791389.0000000005305000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711870738.0000000005497000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710832286.00000000052A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1733155635.0000000005497000.00000004.00000020.00020000.00000000.sdmp, soft[1].1.dr, Y-Cleaner.exe.1.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://iplogger.org/1Pz8p7

unknown

Details

Name:	https://iplogger.org/1Pz8p7
TargetID:	-1
From Memory:	true
Source:	file.exe, 00000001.00000003.1710735382.0000000005497000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712604425.0000000005581000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712500901.00000000054DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711758033.00000000054F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710791389.0000000005305000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711870738.0000000005497000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710832286.00000000052A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1733155635.0000000005497000.00000004.00000020.00020000.00000000.sdmp, soft[1].1.dr, Y-Cleaner.exe.1.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://g-cleanit.hk

unknown

Details

Name:	https://g-cleanit.hk
TargetID:	-1
From Memory:	true
Source:	file.exe, 00000001.00000003.1710735382.0000000005497000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712604425.0000000005581000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1712500901.00000000054DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711758033.00000000054F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710791389.0000000005305000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1711870738.0000000005497000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1710832286.00000000052A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1733155635.0000000005497000.00000004.00000020.00020000.00000000.sdmp, soft[1].1.dr, Y-Cleaner.exe.1.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub

185.156.72.65

Details

Name:	http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
IP:	185.156.72.65
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\Desktop\file.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

http://185.156.72.65/dll/download

185.156.72.65

Details

Name:	http://185.156.72.65/dll/download
IP:	185.156.72.65
TargetID:	1
From Memory:	false
Current Path:	C:\Users\user\Desktop\file.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

185.156.72.65

unknown

Russian Federation

Details

IP:	185.156.72.65
TargetID:	1
Current Path:	C:\Users\user\Desktop\file.exe
Country:	Russian Federation
Countrycode:	RUS
ASN number:	44636
ASN name:	ITDELUXE-ASRU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking