Windows Analysis Report SecuriteInfo.com.Trojan.InjectNET.14.3934.31899

ID:	502723
Product:	CloudBasic
Start time:	10:55:01
Start date:	14.10.2021
Sample:	SecuriteInfo.com.Trojan.InjectNET.14.3934.31899
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	13003cbfb6d2adfeea85952f8172c4f7
SHA1:	e5ef2dd654b50ed7be455cbe7aaabaa7acaedc80
SHA256:	9c8590c7165b453dd0792be3cf51e200961a1ed9cf1154768ee86f7018db8fd9
Filetype:	Win64 Executable (generic) (12005/4) 74.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log	ASCII text, with CRLF line terminators	FD0B81AE7B9DB28F2254E423DE209C18	1E0DA698A79580E2B2305BF949E281EDA356063A	9427A9D8FD96E5489F1412D5A5152922A0DBBBD6D1CE3BB1645F941DF67B2138

AV Detection:

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Virustotal: Detection: 37%			Perma Link
Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Metadefender: Detection: 25%			Perma Link
Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	ReversingLabs: Detection: 33%

System Summary:

Detected potential crypto function

Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001BA559E70D6		1_2_000001BA559E70D6
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001BA559E6D06		1_2_000001BA559E6D06
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001BA559E60D2		1_2_000001BA559E60D2
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001BA559E750E		1_2_000001BA559E750E
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_000001BA559E796A		1_2_000001BA559E796A
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_00007FFD04005862		1_2_00007FFD04005862
Source: C:\Windows\System32\conhost.exe	Code function: 1_2_00007FFD04004AB6		1_2_00007FFD04004AB6

Contains functionality to call native functions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_00401D58 NtAllocateVirtualMemory,		0_2_00401D58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_00401D18 NtWriteVirtualMemory,		0_2_00401D18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_004019D8 NtCreateThreadEx,		0_2_004019D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_00401D98 NtProtectVirtualMemory,		0_2_00401D98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_00401C98 NtClose,		0_2_00401C98

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Static PE information: Section: .rdata ZLIB complexity 0.999692137922

Sample is known by Antivirus

Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Virustotal: Detection: 37%
Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Metadefender: Detection: 25%
Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	ReversingLabs: Detection: 33%

PE file has an executable .text section and no other executable section

Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Windows\System32\conhost.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Process created: C:\Windows\System32\conhost.exe 'C:\Windows\System32\conhost.exe' 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Process created: C:\Windows\System32\conhost.exe 'C:\Windows\System32\conhost.exe' 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe'			Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Windows\System32\conhost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'

Creates files inside the user directory

Source: C:\Windows\System32\conhost.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Jump to behavior

Classification label

Source: classification engine

Classification label: mal60.evad.winEXE@3/1@0/0

Uses Microsoft Silverlight

Source: C:\Windows\System32\conhost.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Submission file is bigger than most known malware samples

Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Static file information: File size 2009088 > 1048576

PE file has a big raw section

Source: SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1e8800

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_005ECB00 push rax; retf		0_2_005ECB01
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_005EC8C0 push rax; retn 0009h		0_2_005EC8C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_005ECBFF push rax; iretd		0_2_005ECC01
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe	Code function: 0_2_005ECAB7 push rax; retf 0009h		0_2_005ECAC1

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains long sleeps (>= 3 min)

Source: C:\Windows\System32\conhost.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Windows\System32\conhost.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Memory written: C:\Windows\System32\conhost.exe base: 1BA55800000

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Thread created: C:\Windows\System32\conhost.exe EIP: 55800000

Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Memory allocated: C:\Windows\System32\conhost.exe base: 1BA55800000 protect: page execute and read and write

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe

Process created: C:\Windows\System32\conhost.exe 'C:\Windows\System32\conhost.exe' 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.14.3934.exe'

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: conhost.exe, 00000001.00000000.350445968.000001BA56310000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: conhost.exe, 00000001.00000000.350445968.000001BA56310000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: conhost.exe, 00000001.00000000.350445968.000001BA56310000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: conhost.exe, 00000001.00000000.350445968.000001BA56310000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\conhost.exe

Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation

Jump to behavior