Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Installer64x.exe1.exe

PE32 executable (console) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (console) Intel 80386, for MS Windows
Entropy:	7.687809353200299
Filename:	Installer64x.exe1.exe
Filesize:	1364480
MD5:	e070bcc6b4f0e004b91f73cbe27d73ee
SHA1:	cfc88488870730d1a9ab7076ef62aed1ef991ae1
SHA256:	24fb33ac2e21129c190da102e9d5d8ac9079ccb429711cc3dcbbdda44ca073ab
SHA512:	01eb5aca8edc0292e73c2c4e0d5fcddaf515dc0f168a02222ccd5bd6b1306b2129846112dab91a67e445e07517ecc6cbdb7d7d4d98ec73041f59f09b4e2d387f
SSDEEP:	24576:yAi/c6dNtEWZ4B+UsxoxbzmXsCr//aRhCr//aR:80qNtnKB+UsxoxbzYs4aRh4aR
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g..........................................@.......................................@.................................06..<..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)	Malware Analysis System Evasion
Query firmware table information (likely to detect VMs)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping
Tries to steal Crypto Currency Wallets	Stealing of Sensitive Information	Windows Management Instrumentation Security Software Discovery
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)	Lowering of HIPS / PFW / Operating System Security Settings	Windows Management Instrumentation
Checks if the current process is being debugged	Anti Debugging
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to record screenshots	Key, Mouse, Clipboard, Microphone and Screen Capturing	Screen Capture
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Archive Collected Data
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	File and Directory Discovery
One or more processes crash	System Summary
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Searches for user specific document files	Stealing of Sensitive Information
Uses 32bit PE files	Compliance, System Summary
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary
Contains functionality to modify the execution of threads in other processes		Security Software Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads software policies	System Summary
SQL strings found in memory and binary data	System Summary	File and Directory Discovery
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Installer64x.exe_c7c4cca8971b4e367c7f72b9e75ca82c490be3f_a55bbe4c_84a80423-770a-4036-9e8d-3e4b9124b2fe\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Installer64x.exe_c7c4cca8971b4e367c7f72b9e75ca82c490be3f_a55bbe4c_84a80423-770a-4036-9e8d-3e4b9124b2fe\Report.wer
Category:	dropped
Dump:	Report.wer.6.dr
ID:	dr_3
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.9220878450910105
Encrypted:	false
Ssdeep:	96:yLFSyq3EIsl8h+oI7RA6tQXIDcQvc6QcEVcw3cE/3+HbHg/1AnQECaVDPCoLnNfW:s0REIME0BU/QjICBqzuiF4Z24IO8XN
Size:	65536
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER68B5.tmp.dmp

Mini DuMP crash report, 14 streams, Thu Mar 13 12:33:38 2025, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER68B5.tmp.dmp
Category:	dropped
Dump:	WER68B5.tmp.dmp.6.dr
ID:	dr_0
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Thu Mar 13 12:33:38 2025, 0x1205a4 type
Entropy:	2.1907558698512926
Encrypted:	false
Ssdeep:	192:H529WIXDd9j1XUffSOYs3ZPifZPqm4uYEYV+Ei:Z2R9QtL3FifZCBEYC
Size:	31574
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6981.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER6981.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER6981.tmp.WERInternalMetadata.xml.6.dr
ID:	dr_1
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.6949868903370575
Encrypted:	false
Ssdeep:	192:R6l7wVeJXj56qy6YvESUzngmfpfprJ89bGHsf0im:R6lXJz56n6YMSUzngmfp0GMfQ
Size:	8438
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER69B1.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER69B1.tmp.xml
Category:	dropped
Dump:	WER69B1.tmp.xml.6.dr
ID:	dr_2
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.481892866403609
Encrypted:	false
Ssdeep:	48:cvIwWl8zsQtJg77aI9QbWpW8VYDV5Ym8M4Jga7KFJ+q8vn75z7FBFWd:uIjfWI7Wq7VnJOK91/Wd
Size:	4755
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.6.dr
ID:	dr_4
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.300463214873776
Encrypted:	false
Ssdeep:	6144:yWGqOEmWfd+WQF3y/9026ZTyaRsCDucXqzf56MYjF4mAV+/PcP+d:ZGIL6s8qzfskmA8/EPo
Size:	1835008
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve.LOG1
Category:	dropped
Dump:	Amcache.hve.LOG1.6.dr
ID:	dr_5
Target ID:	6
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.4906154317028095
Encrypted:	false
Ssdeep:	768:YL8vumsSuqVuEiUu9+fAZ1JwI4fRvkKmMw1e8+cT2t:YLeumHuWuL2GqI4fRFR
Size:	32768
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Installer64x.exe1.exe

"C:\Users\user\Desktop\Installer64x.exe1.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7020
Target ID:	0
Parent PID:	4076
Name:	Installer64x.exe1.exe
Path:	C:\Users\user\Desktop\Installer64x.exe1.exe
Commandline:	"C:\Users\user\Desktop\Installer64x.exe1.exe"
Size:	1364480
MD5:	E070BCC6B4F0E004B91F73CBE27D73EE
Time:	08:33:37
Date:	13/03/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xa20000
Modulesize:	1372160
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\Installer64x.exe1.exe

"C:\Users\user\Desktop\Installer64x.exe1.exe"

Details

Is windows:	false
Is dropped:	false
PID:	3588
Target ID:	2
Parent PID:	7020
Name:	Installer64x.exe1.exe
Path:	C:\Users\user\Desktop\Installer64x.exe1.exe
Commandline:	"C:\Users\user\Desktop\Installer64x.exe1.exe"
Size:	1364480
MD5:	E070BCC6B4F0E004B91F73CBE27D73EE
Time:	08:33:38
Date:	13/03/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xa20000
Modulesize:	1372160
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7040
Target ID:	1
Parent PID:	7020
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	08:33:37
Date:	13/03/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff650920000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 688

Details

Is windows:	true
Is dropped:	false
PID:	5740
Target ID:	6
Parent PID:	7020
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 688
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	08:33:38
Date:	13/03/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff650920000
Modulesize:	892928
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://citydisco.bet/.

unknown

https://citydisco.bet:443/gdJISi

unknown

https://duckduckgo.com/ac/?q=

unknown

https://citydisco.bet/2

unknown

https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta

unknown

bugildbett.top/bAuz

https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi

unknown

https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

https://citydisco.bet/gdJIS66/hI

unknown

https://citydisco.bet/E

unknown

citydisco.bet/gdJIS

https://www.google.com/images/branding/product/ico/googleg_alldp.ico

unknown

https://citydisco.bet/ka

unknown

https://citydisco.bet/

unknown

http://x1.c.lencr.org/0

unknown

http://x1.i.lencr.org/0

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

http://185.215.113.51/conhost.exe6

unknown

https://support.mozilla.org/products/firefoxgro.all

unknown

cjlaspcorne.icu/DbIps

https://citydisco.bet:443/gdJIS

unknown

http://185.215.113.51/conhost.exeY

unknown

mrodularmall.top/aNzS

http://185.215.113.51/a

unknown

http://185.215.113.51/conhost.exeR

unknown

http://185.215.113.51/

unknown

http://185.215.113.51/conhost.exe

unknown

https://citydisco.bet:443/gdJIS/

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://crl.rootca1.amazontrust.com/rootca1.crl0

unknown

https://ac.ecosia.org?q=

unknown

http://upx.sf.net

unknown

http://ocsp.rootca1.amazontrust.com0:

unknown

https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500

unknown

jowinjoinery.icu/bdWUa

legenassedk.top/bdpWO

https://citydisco.bet:443/gdJISsw2cld.default-release/key4.dbPK

unknown

http://185.215.113.51:80/conhost.exe

unknown

https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br

unknown

http://185.215.113.51/O

unknown

http://185.215.113.51/conhost.exeF

unknown

featureccus.shop/bdMAn

https://www.ecosia.org/newtab/v20

unknown

htardwarehu.icu/Sbdsa

https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg

unknown

https://duckduckgo.com/chrome_newtabv20

unknown

http://crt.rootca1.amazontrust.com/rootca1.cer0?

unknown

https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u

unknown

http://185.215.113.51/x

unknown

https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg

unknown

https://citydisco.bet/gdJIS

188.114.96.3

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

https://gemini.google.com/app?q=

unknown

https://citydisco.bet/gdJISD

unknown

There are 45 hidden URLs, click here to show them.

Domains

Name

Malicious

citydisco.bet

188.114.96.3

Details

Name:	citydisco.bet
IP:	188.114.96.3
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection
Suricata IDS alerts with low severity for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

188.114.96.3

citydisco.bet

European Union

Details

IP:	188.114.96.3
TargetID:	2
Current Path:	C:\Users\user\Desktop\Installer64x.exe1.exe
Country:	European Union
Countrycode:	EU
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	citydisco.bet

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

185.215.113.51

unknown

Portugal

Details

IP:	185.215.113.51
TargetID:	2
Current Path:	C:\Users\user\Desktop\Installer64x.exe1.exe
Country:	Portugal
Countrycode:	PRT
ASN number:	206894
ASN name:	WHOLESALECONNECTIONSNL
Private:	false

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking