Windows
Analysis Report
LHU6yozPyx.exe
Overview
General Information
Sample name: | LHU6yozPyx.exerenamed because original name is a hash value |
Original sample name: | d9a83e827341f312bf9632b9f91d0ab3339003b0b57daddc53551d9abf4334a6.exe |
Analysis ID: | 1640831 |
MD5: | 9eb058beda5324bcc659b73d0461abfa |
SHA1: | d335a8ffa3571e0a5c66411f272326e4b33cc27e |
SHA256: | d9a83e827341f312bf9632b9f91d0ab3339003b0b57daddc53551d9abf4334a6 |
Tags: | 46-4-119-125exeuser-JAMESWT_MHT |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
.NET source code contains very large strings
Allocates memory in foreign processes
Compiles code for process injection (via .Net compiler)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Silenttrinity Stager Msbuild Activity
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Compiles C# or VB.Net code
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Enables security privileges
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
LHU6yozPyx.exe (PID: 7056 cmdline:
"C:\Users\ user\Deskt op\LHU6yoz Pyx.exe" MD5: 9EB058BEDA5324BCC659B73D0461ABFA) csc.exe (PID: 2544 cmdline:
"C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\yduvmh ob\yduvmho b.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66) conhost.exe (PID: 1012 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) cvtres.exe (PID: 1972 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RES6BED.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\ydu vmhob\CSC4 1D311B2824 41BB9690EE 123484652E .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) MSBuild.exe (PID: 1400 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\MS Build.exe MD5: 2EDD0B288FE2459DA84E4274D1942343)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |
---|
Source: | Author: Kiran kumar s, oscd.community: |
Source: | Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): |
Source: | Author: frack113: |
Data Obfuscation |
---|
Source: | Author: Joe Security: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-03-17T19:15:15.913405+0100 | 2019714 | 2 | Potentially Bad Traffic | 192.168.2.10 | 49681 | 147.45.44.68 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-03-17T19:15:26.895961+0100 | 2860672 | 1 | Malware Command and Control Activity Detected | 46.4.119.125 | 7712 | 192.168.2.10 | 49682 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-03-17T19:15:12.035092+0100 | 2860671 | 1 | Malware Command and Control Activity Detected | 192.168.2.10 | 49682 | 46.4.119.125 | 7712 | TCP |
2025-03-17T19:15:26.702921+0100 | 2860671 | 1 | Malware Command and Control Activity Detected | 192.168.2.10 | 49682 | 46.4.119.125 | 7712 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: |
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Binary or memory string: | memstr_59927368-7 |
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Networking |
---|
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | TCP traffic: |
Source: | TCP traffic: |
Source: | HTTP traffic detected: |