Analysis Report eUTopTYPuc

ID:	349662
Product:	CloudBasic
Start time:	15:10:11
Start date:	07.02.2021
Sample:	eUTopTYPuc
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	09580ec10df3398ce68c176121fbba66
SHA1:	d86cc8b0439b75ffecf6df985161c81f028a6fe2
SHA256:	06a0b2c3fc763506f6340dc4f582f7980378f7ededfb807541afeeca0499d8cd
Filetype:	Win32 Executable (generic) a (10002005/4) 99.94%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: eUTopTYPuc.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: eUTopTYPuc.exe	Virustotal: Detection: 91%			Perma Link
Source: eUTopTYPuc.exe	Metadefender: Detection: 78%			Perma Link
Source: eUTopTYPuc.exe	ReversingLabs: Detection: 96%

Machine Learning detection for sample

Source: eUTopTYPuc.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 0.0.eUTopTYPuc.exe.400000.0.unpack	Avira: Label: TR/Spy.Zbot.aoqb.5
Source: 0.2.eUTopTYPuc.exe.400000.0.unpack	Avira: Label: TR/Spy.Zbot.aoqb.5

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_00417429 CryptUnprotectData,LocalFree,		0_2_00417429
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0040812A CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,		0_2_0040812A

Compliance:

Uses 32bit PE files

Source: eUTopTYPuc.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Spreading:

Contains functionality to enumerate network shares

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_0041628F GetFileAttributesExW,ReadProcessMemory,LoadLibraryW,GetProcAddress,SHGetFolderPathW,StrCmpNIW,FreeLibrary,NetUserEnum,NetUserGetInfo,NetApiBufferFree,NetApiBufferFree,SHGetFolderPathW,

0_2_0041628F

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0040C4F3 FindFirstFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,		0_2_0040C4F3
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0040C5AE FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,		0_2_0040C5AE

Networking:

Contains functionality to download additional files from the internet

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00408C27 WaitForSingleObject,InternetReadFile,

0_2_00408C27

Urls found in memory or binary data

Source: eUTopTYPuc.exe	String found in binary or memory: http://www.google.com/webhp
Source: eUTopTYPuc.exe	String found in binary or memory: http://www.google.com/webhpbcSeShutdownPrivilegeRFB

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to read the clipboard data

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00404D18 GetFileAttributesExW,HttpSendRequestW,HttpSendRequestA,HttpSendRequestExW,HttpSendRequestExA,InternetCloseHandle,InternetReadFile,InternetReadFileExA,InternetQueryDataAvailable,HttpQueryInfoA,closesocket,send,WSASend,OpenInputDesktop,SwitchDesktop,DefWindowProcW,DefWindowProcA,DefDlgProcW,DefDlgProcA,DefFrameProcW,DefFrameProcA,DefMDIChildProcW,DefMDIChildProcA,CallWindowProcW,CallWindowProcA,RegisterClassW,RegisterClassA,RegisterClassExW,RegisterClassExA,BeginPaint,EndPaint,GetDCEx,GetDC,GetWindowDC,ReleaseDC,GetUpdateRect,GetUpdateRgn,GetMessagePos,GetCursorPos,SetCursorPos,SetCapture,ReleaseCapture,GetCapture,GetMessageW,GetMessageA,PeekMessageW,PeekMessageA,TranslateMessage,GetClipboardData,PFXImportCertStore,

0_2_00404D18

Contains functionality to retrieve information about pressed keystrokes

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00405CE7 EnterCriticalSection,GetTickCount,LeaveCriticalSection,GetKeyboardState,ToUnicode,TranslateMessage,

0_2_00405CE7

E-Banking Fraud:

Detected ZeusVM e-Banking Trojan

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_0041D132 lstrcmpiA,lstrcmpiA,lstrcmpiA,CloseHandle,

0_2_0041D132

Protection of GUI:

Contains functionality to create a new desktop

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_0040EF1F OpenWindowStationW,CreateWindowStationW,GetProcessWindowStation,OpenDesktopW,CreateDesktopW,GetCurrentThreadId,GetThreadDesktop,SetThreadDesktop,CloseDesktop,CloseWindowStation,

0_2_0040EF1F

System Summary:

Contains functionality to launch a process as a different user

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_004087A7 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessAsUserW,CloseHandle,CloseHandle,CloseHandle,FreeLibrary,

0_2_004087A7

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0040F429 InitiateSystemShutdownExW,ExitWindowsEx,		0_2_0040F429
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_004136AC CreateMutexW,GetLastError,CloseHandle,CloseHandle,ExitWindowsEx,OpenEventW,SetEvent,CloseHandle,CloseHandle,GetFileAttributesExW,ReadProcessMemory,GetFileAttributesExW,ReadProcessMemory,Sleep,IsWellKnownSid,GetFileAttributesExW,ReadProcessMemory,GetFileAttributesExW,VirtualFree,CreateEventW,WaitForSingleObject,WaitForMultipleObjects,CloseHandle,CloseHandle,CloseHandle,CloseHandle,		0_2_004136AC

Detected potential crypto function

Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_00402823		0_2_00402823
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_00408036		0_2_00408036
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_004117CB		0_2_004117CB
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_00409BD8		0_2_00409BD8

Uses 32bit PE files

Source: eUTopTYPuc.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Classification label

Source: classification engine

Classification label: mal72.bank.troj.winEXE@1/0@0/0

Contains functionality to access the windows certificate store

Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0041A581 CertOpenSystemStoreW,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCertificatesInStore,PFXExportCertStoreEx,PFXExportCertStoreEx,PFXExportCertStoreEx,CharLowerW,GetSystemTime,CertCloseStore,		0_2_0041A581
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0041A6F6 CertOpenSystemStoreW,CertEnumCertificatesInStore,CertDuplicateCertificateContext,CertDeleteCertificateFromStore,CertEnumCertificatesInStore,CertCloseStore,		0_2_0041A6F6

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00408551 GetCurrentThread,OpenThreadToken,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

0_2_00408551

Contains functionality to enum processes or threads

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_004084FA CreateToolhelp32Snapshot,Thread32First,Thread32Next,CloseHandle,

0_2_004084FA

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00417185 CoCreateInstance,

0_2_00417185

PE file has an executable .text section and no other executable section

Source: eUTopTYPuc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: eUTopTYPuc.exe	Virustotal: Detection: 91%
Source: eUTopTYPuc.exe	Metadefender: Detection: 78%
Source: eUTopTYPuc.exe	ReversingLabs: Detection: 96%

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_004178F9 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_004178F9

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_00403143 push cs; ret		0_2_00403158
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_00403179 push cs; iretd		0_2_00403188
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_00402AAD push es; iretd		0_2_00402ABC

Hooking and other Techniques for Hiding and Protection:

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00411FB9 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadImageW,GetIconInfo,GetCursorPos,DrawIcon,lstrcmpiW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,

0_2_00411FB9

Malware Analysis System Evasion:

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0040C4F3 FindFirstFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,		0_2_0040C4F3
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0040C5AE FindFirstFileW,Sleep,WaitForSingleObject,PathMatchSpecW,Sleep,Sleep,FindNextFileW,FindClose,		0_2_0040C5AE

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_004178F9 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_004178F9

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00412738 mov edx, dword ptr fs:[00000030h]

0_2_00412738

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00412A7D GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,HeapCreate,GetProcessHeap,InitializeCriticalSection,WSAStartup,CreateEventW,GetLengthSid,GetCurrentProcessId,

0_2_00412A7D

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to add an ACL to a security descriptor

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_0040A474 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,LocalFree,

0_2_0040A474

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_0041AC79 RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetLocalTime,

0_2_0041AC79

Contains functionality to query the account / user name

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_0041A525 GetUserNameExW,

0_2_0041A525

Contains functionality to query time zone information

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00406FAF GetTimeZoneInformation,

0_2_00406FAF

Contains functionality to query windows version

Source: C:\Users\user\Desktop\eUTopTYPuc.exe

Code function: 0_2_00413002 GetComputerNameW,GetVersionExW,RegOpenKeyExW,

0_2_00413002

Lowering of HIPS / PFW / Operating System Security Settings:

May initialize a security null descriptor

Source: eUTopTYPuc.exe

Binary or memory string: S:(ML;;NRNWNX;;;LW)

Remote Access Functionality:

Contains VNC / remote desktop functionality (version string found)

Source: eUTopTYPuc.exe	String found in binary or memory: RFB 003.003
Source: eUTopTYPuc.exe	String found in binary or memory: RFB 003.003
Source: eUTopTYPuc.exe, 00000000.00000000.203019463.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: scriptnbsp;Basic tmp%s%08x.%s%s%08x*SysListView32MDIClientCiceroUIWndFrameConsoleWindowClass#32768SysShadowFIXME.tmphttp://www.google.com/webhpbcSeShutdownPrivilegeRFB 003.003
Source: eUTopTYPuc.exe	String found in binary or memory: RFB 003.003
Source: eUTopTYPuc.exe	String found in binary or memory: scriptnbsp;Basic tmp%s%08x.%s%s%08x*SysListView32MDIClientCiceroUIWndFrameConsoleWindowClass#32768SysShadowFIXME.tmphttp://www.google.com/webhpbcSeShutdownPrivilegeRFB 003.003

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_0040A2A5 socket,bind,closesocket,		0_2_0040A2A5
Source: C:\Users\user\Desktop\eUTopTYPuc.exe	Code function: 0_2_00409FC7 socket,bind,listen,closesocket,		0_2_00409FC7