Windows
Analysis Report
fuZxPIo6G7.exe
Overview
General Information
Sample name: | fuZxPIo6G7.exerenamed because original name is a hash value |
Original sample name: | 43ff34ad093a6bed2a59808a68065f356ad9e2b82f75ed03bc7f854c76465de5.exe |
Analysis ID: | 1611171 |
MD5: | c742c78e2b1c5e835cadf8d4387b5ac7 |
SHA1: | c8670e8fc305bc541747ec21ff94d1d3453083f9 |
SHA256: | 43ff34ad093a6bed2a59808a68065f356ad9e2b82f75ed03bc7f854c76465de5 |
Tags: | exeuser-crep1x |
Infos: | |
Detection
Score: | 72 |
Range: | 0 - 100 |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Joe Sandbox ML detected suspicious sample
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Detected non-DNS traffic on DNS port
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the installation date of Windows
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
fuZxPIo6G7.exe (PID: 5076 cmdline:
"C:\Users\ user\Deskt op\fuZxPIo 6G7.exe" MD5: C742C78E2B1C5E835CADF8D4387B5AC7) msedge.exe (PID: 6096 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --profi le-directo ry="Defaul t" MD5: 69222B8101B0601CC6663F8381E7E00F) msedge.exe (PID: 6692 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --m ojo-platfo rm-channel -handle=18 56 --field -trial-han dle=2024,i ,151189356 0460440700 9,81254592 5293092413 2,262144 / prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
msedge.exe (PID: 5864 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --profi le-directo ry=Default --flag-sw itches-beg in --flag- switches-e nd --disab le-nacl -- do-not-de- elevate MD5: 69222B8101B0601CC6663F8381E7E00F) msedge.exe (PID: 7336 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --m ojo-platfo rm-channel -handle=21 60 --field -trial-han dle=2028,i ,123357155 3959080908 8,11661685 2820446065 91,262144 /prefetch: 3 MD5: 69222B8101B0601CC6663F8381E7E00F) msedge.exe (PID: 8264 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=ass et_store.m ojom.Asset StoreServi ce --lang= en-GB --se rvice-sand box-type=a sset_store _service - -mojo-plat form-chann el-handle= 6648 --fie ld-trial-h andle=2028 ,i,1233571 5539590809 088,116616 8528204460 6591,26214 4 /prefetc h:8 MD5: 69222B8101B0601CC6663F8381E7E00F) msedge.exe (PID: 8272 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=ent ity_extrac tion_servi ce.mojom.E xtractor - -lang=en-G B --servic e-sandbox- type=entit y_extracti on --onnx- enabled-fo r-ee --moj o-platform -channel-h andle=6836 --field-t rial-handl e=2028,i,1 2335715539 590809088, 1166168528 2044606591 ,262144 /p refetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-02-10T16:23:19.110637+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49702 | 104.21.48.1 | 443 | TCP |
2025-02-10T16:23:20.553566+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49703 | 104.21.48.1 | 443 | TCP |
2025-02-10T16:23:21.415286+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49704 | 104.21.48.1 | 443 | TCP |
2025-02-10T16:23:53.988594+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 50282 | 104.21.32.1 | 443 | TCP |
2025-02-10T16:23:56.308534+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 50285 | 104.21.32.1 | 443 | TCP |
2025-02-10T16:23:57.194466+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 50286 | 104.21.32.1 | 443 | TCP |
2025-02-10T16:23:58.010801+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 50287 | 104.21.32.1 | 443 | TCP |
2025-02-10T16:23:58.988298+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 50288 | 104.21.32.1 | 443 | TCP |
2025-02-10T16:24:00.106763+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 50289 | 104.21.32.1 | 443 | TCP |
2025-02-10T16:24:01.215820+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 50290 | 104.21.32.1 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: |
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |