Play interactive tour

Edit tour

Analysis Report icom32.exe

Overview

General Information

Sample Name:	icom32.exe
Analysis ID:	399805
MD5:	d1f66d78808b8cbd18804812f1a457a5
SHA1:	c99ee5407d446e9c0647e7749f307762d25e0143
SHA256:	7793c2fd34248236e83206fdd01b547436e966bcb6cae21adcbf61550b62daea
Infos:
Most interesting Screenshot:

Detection

Metasploit

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Metasploit Payload

C2 URLs / IPs found in malware configuration

Contains functionality to check if Internet connection is working

Contains functionality to dynamically determine API calls

Creates a DirectInput object (often for capturing keystrokes)

Detected potential crypto function

Entry point lies outside standard sections

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Startup

System is w10x64

icom32.exe (PID: 7040 cmdline: 'C:\Users\user\Desktop\icom32.exe' MD5: D1F66D78808B8CBD18804812F1A457A5)

cleanup

Malware Configuration

Threatname: Metasploit

{"Headers": "Accept-Encoding: binary\r\nHost: outlook.office.com\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MATM)\r\n", "Type": "Metasploit Download", "URL": "http://adsec.pro/ssl/verify.crl"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.780692160.0000000000700000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.780692160.0000000000700000.00000040.00000001.sdmp

Malware Configuration Extractor: Metasploit {"Headers": "Accept-Encoding: binary\r\nHost: outlook.office.com\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MATM)\r\n", "Type": "Metasploit Download", "URL": "http://adsec.pro/ssl/verify.crl"}

Multi AV Scanner detection for submitted file

Show sources

Source: icom32.exe	Virustotal: Detection: 56%	Perma Link
Source: icom32.exe	Metadefender: Detection: 29%	Perma Link
Source: icom32.exe	ReversingLabs: Detection: 75%

Source: icom32.exe

Static PE information: 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2032785 ET TROJAN Cobalt Strike Stager Time Check M2 192.168.2.3:49710 -> 172.217.20.14:80
Source: Traffic	Snort IDS: 2032785 ET TROJAN Cobalt Strike Stager Time Check M2 192.168.2.3:49711 -> 172.217.20.14:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://adsec.pro/ssl/verify.crl

Contains functionality to check if Internet connection is working

Show sources

Source: C:\Users\user\Desktop\icom32.exe

Code function: 0_2_00401010 WSAStartup,WSAGetLastError,gethostbyname,WSACleanup,htons,socket,WSACleanup,connect,send,recv,closesocket,WSACleanup, google.com

0_2_00401010

Source: Joe Sandbox View

ASN Name: OnlineSASFR OnlineSASFR

Source: C:\Users\user\Desktop\icom32.exe

Code function: 0_2_00401010 WSAStartup,WSAGetLastError,gethostbyname,WSACleanup,htons,socket,WSACleanup,connect,send,recv,closesocket,WSACleanup,

0_2_00401010

Source: unknown

DNS traffic detected: queries for: adsec.pro

Source: icom32.exe, 00000000.00000002.780487108.0000000000463000.00000004.00000001.sdmp	String found in binary or memory: https://adsec.pro/
Source: icom32.exe, 00000000.00000002.780487108.0000000000463000.00000004.00000001.sdmp	String found in binary or memory: https://adsec.pro/ssl/verify.crl
Source: icom32.exe, 00000000.00000002.780487108.0000000000463000.00000004.00000001.sdmp	String found in binary or memory: https://adsec.pro/ssl/verify.crlX
Source: icom32.exe, 00000000.00000002.780513408.000000000046C000.00000004.00000001.sdmp	String found in binary or memory: https://adsec.pro/ssl/verify.crle

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443

Source: icom32.exe, 00000000.00000002.780379298.0000000000429000.00000004.00000001.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\icom32.exe	Code function: 0_2_007000D7		0_2_007000D7
Source: C:\Users\user\Desktop\icom32.exe	Code function: 0_2_007000BA		0_2_007000BA

Source: icom32.exe, 00000000.00000000.643920569.0000000000411000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameff_dd.exe8 vs icom32.exe
Source: icom32.exe, 00000000.00000002.782887537.00000000029A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs icom32.exe
Source: icom32.exe	Binary or memory string: OriginalFilenameff_dd.exe8 vs icom32.exe

Source: icom32.exe

Static PE information: 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal80.troj.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\icom32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\icom32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\icom32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\icom32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: icom32.exe	Virustotal: Detection: 56%
Source: icom32.exe	Metadefender: Detection: 29%
Source: icom32.exe	ReversingLabs: Detection: 75%

Source: C:\Users\user\Desktop\icom32.exe

Code function: 0_2_004092B0 LoadLibraryA,GetProcAddress,

0_2_004092B0

Source: initial sample

Static PE information: section where entry point is pointing to: AUTO

Source: icom32.exe	Static PE information: section name: AUTO
Source: icom32.exe	Static PE information: section name: DGROUP

Source: C:\Users\user\Desktop\icom32.exe TID: 7044

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\icom32.exe

Thread delayed: delay time: 30000

Jump to behavior

Source: icom32.exe, 00000000.00000002.780553808.000000000047C000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\icom32.exe

Code function: 0_2_004092B0 LoadLibraryA,GetProcAddress,

0_2_004092B0

Source: C:\Users\user\Desktop\icom32.exe

Code function: 0_2_004097B0 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,

0_2_004097B0

Source: C:\Users\user\Desktop\icom32.exe

Code function: 0_2_00406600 GetTimeZoneInformation,

0_2_00406600

Source: C:\Users\user\Desktop\icom32.exe

Code function: 0_2_00406CE0 GetEnvironmentStringsA,GetVersion,GetModuleFileNameA,GetCommandLineA,GetCommandLineW,GetModuleFileNameA,

0_2_00406CE0

Remote Access Functionality:

Yara detected Metasploit Payload

Show sources

Source: Yara match

File source: 00000000.00000002.780692160.0000000000700000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Path Interception	Virtualization/Sandbox Evasion11	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Virtualization/Sandbox Evasion11	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Network Connections Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report icom32.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Metasploit

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails