Windows Analysis Report sb.exe

ID:	492126
Product:	CloudBasic
Start time:	11:48:03
Start date:	28.09.2021
Sample:	sb.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	e310cb3185d95e3dda42f0230b569d84
SHA1:	c20c8aa953f7df7e9b117258a0d31530e23ffc55
SHA256:	82867648313483db4a6115e0cc2b34c06719ffdb6667e50e625e2dc130adfbca
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Found malware configuration

Source: 0.2.sb.exe.27e053f.1.raw.unpack

Malware Configuration Extractor: AveMaria {"C2 url": "cachepallioniwarznpa.icu", "port": 5200}

Multi AV Scanner detection for submitted file

Source: sb.exe	Virustotal: Detection: 38%			Perma Link
Source: sb.exe	ReversingLabs: Detection: 42%

Yara detected AveMaria stealer

Source: Yara match	File source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.374727716.00000000027E0000.00000040.00000001.sdmp, type: MEMORY

Antivirus or Machine Learning detection for unpacked file

Source: 0.2.sb.exe.31e0000.3.unpack	Avira: Label: TR/Downloader.Gen
Source: 0.2.sb.exe.27e053f.1.unpack	Avira: Label: TR/Patched.Ren.Gen3

Compliance:

Uses 32bit PE files

Source: sb.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\sb.exe

Directory created: C:\Program Files\Microsoft DN1

Jump to behavior

PE / OLE file has a valid certificate

Source: sb.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: sb.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: sb.exe, 00000000.00000002.374832358.00000000031FB000.00000004.00000001.sdmp
Source:	Binary string: >+D C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: sb.exe, 00000000.00000002.374832358.00000000031FB000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\W7H64\Desktop\VCSamples-master\VC2010Samples\ATL\General\DispSink\DispClient\Free real estate.pdb source: sb.exe

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: cachepallioniwarznpa.icu

URLs found in memory or binary data

Source: sb.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: sb.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: sb.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: sb.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: sb.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: sb.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: sb.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: sb.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: sb.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: sb.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: sb.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: sb.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: sb.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: sb.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: sb.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: sb.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: sb.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: sb.exe, 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:
Source: sb.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: sb.exe	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a raw input device (often for capturing keystrokes)

Source: sb.exe, 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp

Binary or memory string: GetRawInputData

Potential key logger detected (key state polling based)

Source: C:\Users\user\Desktop\sb.exe

Code function: 0_2_00CB8A55 GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_00CB8A55

E-Banking Fraud:

Yara detected AveMaria stealer

Source: Yara match	File source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.374727716.00000000027E0000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown

Uses 32bit PE files

Source: sb.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda

Detected potential crypto function

Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CC0074		0_2_00CC0074
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CD401C		0_2_00CD401C
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CFAD78		0_2_00CFAD78
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CF16A0		0_2_00CF16A0
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CF26B6		0_2_00CF26B6
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CF9230		0_2_00CF9230
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CF9354		0_2_00CF9354

Sample is known by Antivirus

Source: sb.exe	Virustotal: Detection: 38%
Source: sb.exe	ReversingLabs: Detection: 42%

Sample reads its own file content

Source: C:\Users\user\Desktop\sb.exe

File read: C:\Users\user\Desktop\sb.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Source: sb.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\sb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\sb.exe 'C:\Users\user\Desktop\sb.exe'
Source: C:\Users\user\Desktop\sb.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\sb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_01

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\sb.exe

Code function: 0_2_00CB2C5D __EH_prolog3_catch_GS,LoadLibraryExA,LoadLibraryExA,FindResourceA,LoadResource,SizeofResource,FreeLibrary,

0_2_00CB2C5D

Creates files inside the program directory

Source: C:\Users\user\Desktop\sb.exe

File created: C:\Program Files\Microsoft DN1

Jump to behavior

Classification label

Source: classification engine

Classification label: mal60.troj.winEXE@2/0@0/0

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\sb.exe

Code function: 0_2_00CB249C CoCreateInstance,

0_2_00CB249C

Submission file is bigger than most known malware samples

Source: sb.exe

Static file information: File size 1627136 > 1048576

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\sb.exe

Directory created: C:\Program Files\Microsoft DN1

Jump to behavior

PE / OLE file has a valid certificate

Source: sb.exe

Static PE information: certificate valid

PE file has a big raw section

Source: sb.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x12a200

PE file imports many functions

Source: sb.exe

Static PE information: More than 200 imports for KERNEL32.dll

PE file contains a mix of data directories often seen in goodware

Source: sb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: sb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: sb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: sb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: sb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: sb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: sb.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: sb.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: sb.exe, 00000000.00000002.374832358.00000000031FB000.00000004.00000001.sdmp
Source:	Binary string: >+D C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: sb.exe, 00000000.00000002.374832358.00000000031FB000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\W7H64\Desktop\VCSamples-master\VC2010Samples\ATL\General\DispSink\DispClient\Free real estate.pdb source: sb.exe

PE file contains a valid data directory to section mapping

Source: sb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: sb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: sb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: sb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: sb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CFBEC3 push ecx; ret		0_2_00CFBED6
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CBEE06 push ecx; ret		0_2_00CBEE19

Hooking and other Techniques for Hiding and Protection:

Contains functionality to hide user accounts

Source: sb.exe, 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp

String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Source: sb.exe, 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp

String found in binary or memory: 0.rudp\ICACLS.exe\xcopy.exe "" /GRANT:r *S-1-1-0:(OI)(CI)F /T\AppData\Local\Google\AppData\Local\Google\xcopy.exe /Y /E /C \AppData\Roaming\Mozilla\AppData\Roaming\Mozilla\\AppData\Roaming\Microsoft\AppData\Roaming\Microsoft\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameTypemultirdp[experimental] patch Terminal Server service to allow multiples userstermsrv.dllexplorer.exeTASKmgr.exeProcessHacker.exeregedit.exentdll.dllLdrGetProcedureAddressRtlNtStatusToDosErrorRtlSetLastWin32ErrorNtAllocateVirtualMemoryNtProtectVirtualMemoryNtWriteVirtualMemoryLdrLoadDllRtlCreateUserThread|"

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\sb.exe TID: 2224

Thread sleep count: 70 > 30

Jump to behavior

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\sb.exe

Code function: 0_2_00CDBC81 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00CDBC81

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CDD54C mov eax, dword ptr fs:[00000030h]		0_2_00CDD54C
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CBCAC7 mov esi, dword ptr fs:[00000030h]		0_2_00CBCAC7
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CE73DD mov eax, dword ptr fs:[00000030h]		0_2_00CE73DD

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\sb.exe

Code function: 0_2_00CBC9B1 GetProcessHeap,HeapAlloc,InterlockedPopEntrySList,VirtualAlloc,RaiseException,InterlockedPopEntrySList,VirtualFree,InterlockedPushEntrySList,

0_2_00CBC9B1

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CDBC81 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00CDBC81
Source: C:\Users\user\Desktop\sb.exe	Code function: 0_2_00CBDF6A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00CBDF6A

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\sb.exe

Code function: 0_2_00CBEFC2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00CBEFC2

Stealing of Sensitive Information:

Yara detected AveMaria stealer

Source: Yara match	File source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.374727716.00000000027E0000.00000040.00000001.sdmp, type: MEMORY

Yara detected Credential Stealer

Source: Yara match	File source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.374727716.00000000027E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sb.exe PID: 6404, type: MEMORYSTR

Remote Access Functionality:

Yara detected AveMaria stealer

Source: Yara match	File source: 0.2.sb.exe.27e053f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.27e053f.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sb.exe.31e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.374825576.00000000031F6000.00000002.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.374727716.00000000027E0000.00000040.00000001.sdmp, type: MEMORY