Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

yw6At7QnNh.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.5870490062472085
Filename:	yw6At7QnNh.exe
Filesize:	225792
MD5:	8ba293749c97cbf48f30f02c66d3406d
SHA1:	6a7492a26d0a16320daa2cb187232fc0053f4f5f
SHA256:	e2075b32b9716dc41ef667a74c1ae2c2841a5b9fd3046db0bdcd96c581778253
SHA512:	041e3f65fcb877eb19f5d63cb79d2eb6327ee4b06191a3a4202a736fb6215cd2b2b5c436c081b0165acf2b1b0341c8c551bbf166f8f46ce48fedd7d23ff74049
SSDEEP:	6144:ERAL6uxQIBpPnki+81Rnn1BgUUhgmfwgA3Bfdw+:z4MT+81RnnHLUhgrL3tdw+
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Hs..Hs..Hs..Hs..Ks...o..Gs...l...s..*l..Os..Hs...s...l..[s...u..Is..RichHs..................PE..L...G.{N...................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected ZeusVM e-Banking Trojan	E-Banking Fraud
Detected unpacking (changes PE section rights)	Data Obfuscation
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Access Token Manipulation
Multi AV Scanner detection for submitted file	AV Detection	Create Account
Contain functionality to detect virtual machines	Malware Analysis System Evasion	Access Token Manipulation Virtualization/Sandbox Evasion
Contains VNC / remote desktop functionality (version string found)	Remote Access Functionality	Remote Desktop Protocol Remote Access Software
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion	Clipboard Data
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation Process Injection
Machine Learning detection for sample	AV Detection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Antivirus or Machine Learning detection for unpacked file	AV Detection	Access Token Manipulation
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains functionality to call native functions	System Summary
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate network shares	Spreading	Network Share Discovery
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Native API
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation Process Discovery Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection	Application Shimming
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
May initialize a security null descriptor	Lowering of HIPS / PFW / Operating System Security Settings
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Create Account Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to access the windows certificate store	System Summary	Install Root Certificate
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to create a new desktop	Protection of GUI	Create Account
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify the execution of threads in other processes		Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Create Account Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
URLs found in memory or binary data	Networking

C:\Users\user\AppData\Local\Temp\ athefff3h6266cd5fa708f.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\ athefff3h6266cd5fa708f.tmp
Category:	dropped
Dump:	athefff3h6266cd5fa708f.tmp.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\yw6At7QnNh.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	2.4857544881426725
Encrypted:	false
Ssdeep:	12:etGSGsXpFmGEqIUfIjjObu0Nql2nLEu98DwhKQstDISMhTF0L/x8O6r:etGSB54qIUwnO/AHDw0jukx
Size:	3072
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Drops PE files	Persistence and Installation Behavior
Creates temporary files	System Summary

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a
Category:	dropped
Dump:	414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Users\user\Desktop\yw6At7QnNh.exe
Type:	data
Entropy:	1.0424600748477153
Encrypted:	false
Ssdeep:	3:/lbON:u
Size:	46
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\yw6At7QnNh.exe

'C:\Users\user\Desktop\yw6At7QnNh.exe'

Details

Is windows:	true
Is dropped:	false
PID:	3420
Target ID:	1
Parent PID:	5572
Name:	yw6At7QnNh.exe
Path:	C:\Users\user\Desktop\yw6At7QnNh.exe
Commandline:	'C:\Users\user\Desktop\yw6At7QnNh.exe'
Size:	225792
MD5:	8BA293749C97CBF48F30F02C66D3406D
Time:	21:04:57
Date:	02/08/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	241664
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Contains VNC / remote desktop functionality (version string found)	Remote Access Functionality	Remote Access Software Remote Desktop Protocol
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Users\user\Desktop\yw6At7QnNh.exe

'C:\Users\user\Desktop\yw6At7QnNh.exe'

Details

Is windows:	true
Is dropped:	false
PID:	5952
Target ID:	2
Parent PID:	3420
Name:	yw6At7QnNh.exe
Path:	C:\Users\user\Desktop\yw6At7QnNh.exe
Commandline:	'C:\Users\user\Desktop\yw6At7QnNh.exe'
Size:	225792
MD5:	8BA293749C97CBF48F30F02C66D3406D
Time:	21:04:57
Date:	02/08/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	163840
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Contains VNC / remote desktop functionality (version string found)	Remote Access Functionality	Remote Access Software Remote Desktop Protocol
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Users\user\Desktop\yw6At7QnNh.exe

'C:\Users\user\Desktop\yw6At7QnNh.exe'

Details

Is windows:	true
Is dropped:	false
PID:	1536
Target ID:	3
Parent PID:	5952
Name:	yw6At7QnNh.exe
Path:	C:\Users\user\Desktop\yw6At7QnNh.exe
Commandline:	'C:\Users\user\Desktop\yw6At7QnNh.exe'
Size:	225792
MD5:	8BA293749C97CBF48F30F02C66D3406D
Time:	21:04:58
Date:	02/08/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	159744
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Contains VNC / remote desktop functionality (version string found)	Remote Access Functionality	Remote Access Software Remote Desktop Protocol
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

URLs

Name

Malicious

http://www.google.com/webhp

unknown

Details

Name:	http://www.google.com/webhp
TargetID:	1
From Memory:	true
Current Path:	C:\Users\user\Desktop\yw6At7QnNh.exe
Source:	yw6At7QnNh.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://www.google.com/webhpbcMY.txt

unknown

Details

Name:	http://www.google.com/webhpbcMY.txt
TargetID:	2
From Memory:	true
Current Path:	C:\Users\user\Desktop\yw6At7QnNh.exe
Source:	yw6At7QnNh.exe, 00000002.00000002.205524903.0000000002070000.00000004.00000001.sdmp, yw6At7QnNh.exe, 00000003.00000001.203739017.0000000000400000.00000040.00020000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

550000

unkown

page readonly

1D11E700000

unkown

page read and write

400000

unkown image

page readonly

47E000

unkown

page read and write

1D11E653000

unkown

page read and write

400000

unkown image

page readonly

7FF58E51A000

unkown

page readonly

1F0000

heap default

page read and write

21D4000

heap private

page read and write

4BE000

unkown

page read and write

2070000

unkown

page read and write

9E3827E000

unkown

page read and write

40E000

unkown image

page write copy

1D11E69D000

unkown

page read and write

1D11ED30000

unkown

page read and write

413000

unkown image

page readonly

10002000

unkown image

page readonly

7FF58E5F9000

unkown

page readonly

7FF58E4F2000

unkown

page readonly

7FF58E31A000

unkown

page readonly

570000

heap default

page read and write

1D11E570000

heap private

page read and write

1D11E64D000

unkown

page read and write

9E37E7E000

unkown

page read and write

425000

unkown

page execute and read and write

400000

unkown image

page execute and read and write

1D11E62A000

unkown

page read and write

1D11EE02000

unkown

page read and write

1D11E5D0000

heap default

page read and write

1F0000

unkown

page read and write

9D000

unkown

page read and write

7FF58E549000

unkown

page readonly

2460000

heap private

page read and write

400000

unkown image

page readonly

2190000

unkown

page read and write

2300000

heap private

page read and write

7FF58E100000

unkown

page readonly

7FF58E431000

unkown

page readonly

40E000

unkown image

page read and write

9EF000

unkown

page read and write

7AF000

unkown

page read and write

5BA000

heap default

page read and write

1D11E63C000

unkown

page read and write

1D11E670000

unkown

page read and write

2490000

unkown

page readonly

401000

unkown image

page execute read

1D11E622000

unkown

page read and write

780000

unkown

page readonly

10000000

unkown image

page readonly

316000

unkown

page read and write

7FF58E3CA000

unkown

page readonly

1D11F340000

unkown

page readonly

7FF58E0F0000

unkown

page readonly

7FF58E585000

unkown

page readonly

9D000

unkown

page read and write

40E000

unkown image

page write copy

1D11E713000

unkown

page read and write

206F000

unkown

page read and write

9E3817F000

unkown

page read and write

1D11E613000

unkown

page read and write

7FF58E37F000

unkown

page readonly

3DC000

unkown

page read and write

7FF58E40D000

unkown

page readonly

1D11E5E0000

unkown

page readonly

19C000

unkown

page read and write

7FF58E576000

unkown

page readonly

7AE000

unkown

page read and write

7FF58E594000

unkown

page readonly

1F5E000

unkown

page read and write

5B0000

heap default

page read and write

21E0000

unkown

page read and write

9E37F7B000

unkown

page read and write

413000

unkown image

page readonly

430000

unkown

page readonly

9F0000

unkown

page readonly

57E000

unkown

page read and write

401000

unkown image

page execute read

21D0000

heap private

page read and write

7FF58E3E8000

unkown

page readonly

680000

heap default

page read and write

7FF58E5F9000

unkown

page readonly

7FF58E403000

unkown

page readonly

7FF58E3BE000

unkown

page readonly

530000

heap default

page read and write

401000

unkown image

page execute read

19C000

unkown

page read and write

7FF58E597000

unkown

page readonly

10001000

unkown image

page execute read

7FF58E52E000

unkown

page readonly

1D11F000000

unkown

page readonly

40C000

unkown image

page readonly

413000

unkown image

page readonly

294000

unkown

page read and write

290000

unkown

page read and write

9EF000

unkown

page read and write

401000

unkown image

page execute read

7FF58E437000

unkown

page readonly

1F0000

unkown

page read and write

400000

unkown image

page readonly

1D11E702000

unkown

page read and write

40C000

unkown image

page readonly

540000

unkown

page read and write

7FF58E0EA000

unkown

page readonly

578000

heap default

page read and write

76F000

unkown

page read and write

7FF58E508000

unkown

page readonly

40C000

unkown image

page readonly

8AF000

unkown

page read and write

8EE000

unkown

page read and write

7FF58E5F1000

unkown

page readonly

7FF58E590000

unkown

page readonly

1F60000

heap private

page read and write

8AF000

unkown

page read and write

7FF58E46C000

unkown

page readonly

400000

unkown

page execute and read and write

7FF58E4F0000

unkown

page readonly

40E000

unkown image

page write copy

7FF58E57C000

unkown

page readonly

19C000

unkown

page read and write

7FF58E502000

unkown

page readonly

1D11E8D0000

unkown

page readonly

7FF58E5EE000

unkown

page readonly

400000

unkown image

page execute and read and write

9E38077000

unkown

page read and write

9E3798B000

unkown

page read and write

9F0000

unkown

page readonly

687000

heap default

page read and write

1D11E800000

unkown

page readonly

400000

unkown image

page readonly

1F5000

heap default

page read and write

400000

unkown

page execute and read and write

7FF58E506000

unkown

page readonly

53E000

unkown

page read and write

2480000

heap private

page read and write

7FF58E53F000

unkown

page readonly

1D11E600000

unkown

page read and write

500000

unkown

page readonly

1D11E708000

unkown

page read and write

40C000

unkown image

page readonly

1D11E67F000

unkown

page read and write

8EE000

unkown

page read and write

312000

unkown

page read and write

430000

unkown

page readonly

9D000

unkown

page read and write

2310000

unkown

page read and write

1D11E5F0000

unkown

page readonly

7FF58E566000

unkown

page readonly

7FF58E55D000

unkown

page readonly

9E37C7E000

unkown

page read and write

4D0000

heap default

page read and write

10000000

unkown image

page readonly

67F000

unkown

page read and write

27D0000

unkown

page readonly

2170000

unkown

page readonly

4C0000

unkown

page readonly

413000

unkown image

page read and write

7FF58E56C000

unkown

page readonly

4E0000

unkown

page readonly

2310000

heap private

page read and write

425000

unkown image

page execute and read and write

7FF58E535000

unkown

page readonly

9E37CFE000

unkown

page read and write

There are 152 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Memdumps