Windows Analysis Report gmAszjZqKD.exe

ID:	435329
Product:	CloudBasic
Start time:	12:28:08
Start date:	16.06.2021
Sample:	gmAszjZqKD.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	a8fcf9f01f6ac912a38cb17e59eb1ed0
SHA1:	40072436d5bd265261bcf0bfd5cfbb046e70a97a
SHA256:	9d56ad7e390d35d3fcf2bc03ac7b38e5efeee12e8bbc2917a375e6cf8c65d69f
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: gmAszjZqKD.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: gmAszjZqKD.exe	Virustotal: Detection: 72%			Perma Link
Source: gmAszjZqKD.exe	ReversingLabs: Detection: 89%

Yara detected AveMaria stealer

Source: Yara match

File source: gmAszjZqKD.exe, type: SAMPLE

Machine Learning detection for sample

Source: gmAszjZqKD.exe

Joe Sandbox ML: detected

Exploits:

Yara detected UACMe UAC Bypass tool

Source: Yara match

File source: gmAszjZqKD.exe, type: SAMPLE

Compliance:

Uses 32bit PE files

Source: gmAszjZqKD.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: gmAszjZqKD.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

URLs found in memory or binary data

Source: gmAszjZqKD.exe

String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a raw input device (often for capturing keystrokes)

Source: gmAszjZqKD.exe

Binary or memory string: GetRawInputData

E-Banking Fraud:

Yara detected AveMaria stealer

Source: Yara match

File source: gmAszjZqKD.exe, type: SAMPLE

System Summary:

Malicious sample detected (through community Yara rule)

Source: gmAszjZqKD.exe, type: SAMPLE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: gmAszjZqKD.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: gmAszjZqKD.exe, type: SAMPLE	Matched rule: AveMaria_WarZone Author: unknown

PE file contains executable resources (Code or Archives)

Source: gmAszjZqKD.exe

Static PE information: Resource name: WM_DSP type: PE32 executable (GUI) Intel 80386, for MS Windows

PE file overlay found

Source: gmAszjZqKD.exe

Static PE information: Data appended to the last section found

Uses 32bit PE files

Source: gmAszjZqKD.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: gmAszjZqKD.exe, type: SAMPLE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: gmAszjZqKD.exe, type: SAMPLE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: gmAszjZqKD.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: gmAszjZqKD.exe, type: SAMPLE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda

Classification label

Source: classification engine

Classification label: mal88.troj.expl.winEXE@0/0@0/0

PE file has an executable .text section and no other executable section

Source: gmAszjZqKD.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Sample is known by Antivirus

Source: gmAszjZqKD.exe	Virustotal: Detection: 72%
Source: gmAszjZqKD.exe	ReversingLabs: Detection: 89%

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: gmAszjZqKD.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: gmAszjZqKD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Hooking and other Techniques for Hiding and Protection:

Contains functionality to hide user accounts

Source: gmAszjZqKD.exe

String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Source: gmAszjZqKD.exe

String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType

Stealing of Sensitive Information:

Yara detected AveMaria stealer

Source: Yara match

File source: gmAszjZqKD.exe, type: SAMPLE

Yara detected Credential Stealer

Source: Yara match

File source: gmAszjZqKD.exe, type: SAMPLE

Remote Access Functionality:

Yara detected AveMaria stealer

Source: Yara match

File source: gmAszjZqKD.exe, type: SAMPLE