Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

rfxJzZjiWv.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.05714066527445
Filename:	rfxJzZjiWv.exe
Filesize:	106496
MD5:	8ed7e6b478cf0c00934bb42e3bdf5e20
SHA1:	ceb70c6dc5a85a64cc7a47e0ec12936f2d5e57db
SHA256:	4395224e257fe5659011fb90649c89d295e80123d7622d6cdb5b09371573e1aa
SHA512:	db4f78f56df60bcc906588546d0bb55b7ff9ec483484a6d70f891bb33fc84339cf1ee77973f785f1f71d6b1eb8090449078bdc8ededb70a41c094cfa0b5affee
SSDEEP:	1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqdIzmd:nSHIG6mQwGmfOQd8YhY0/EgUG
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.....................K.K.............=2......................................=2......=2......Rich............PE..L.....lW...

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Antivirus / Scanner detection for submitted sample	AV Detection
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Access Token Manipulation Credentials in Registry
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information	OS Credential Dumping Data from Local System Ingress Tool Transfer
Tries to steal Mail credentials (via file registry)	Stealing of Sensitive Information
Machine Learning detection for sample	AV Detection
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information
Uses 32bit PE files	Compliance, System Summary	Masquerading
Yara signature match	System Summary
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion File and Directory Discovery
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
PE file contains sections with non-standard names	Data Obfuscation
Detected potential crypto function	System Summary	Access Token Manipulation Archive Collected Data Encrypted Channel
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Enables debug privileges	Anti Debugging
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Checks if the current process is being debugged	Anti Debugging
Sample is known by Antivirus	System Summary	Access Token Manipulation
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Creates mutexes	System Summary	Access Token Manipulation
URLs found in memory or binary data	Networking
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Reads the hosts file	System Summary	Remote System Discovery Ingress Tool Transfer
Checks if Microsoft Office is installed	System Summary	Access Token Manipulation

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck

very short file (no magic)

dropped

Details

File:	C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck
Category:	dropped
Dump:	B52B3F.lck.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Type:	very short file (no magic)
Entropy:	0.0
Encrypted:	false
Ssdeep:	3:U:U
Size:	1
Whitelisted:	true
Reputation:	high

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a

data

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a
Category:	dropped
Dump:	bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Type:	data
Entropy:	1.0424600748477153
Encrypted:	false
Ssdeep:	3:/lbq:4
Size:	46
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\rfxJzZjiWv.exe

"C:\Users\user\Desktop\rfxJzZjiWv.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6644
Target ID:	0
Parent PID:	6124
Name:	rfxJzZjiWv.exe
Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Commandline:	"C:\Users\user\Desktop\rfxJzZjiWv.exe"
Size:	106496
MD5:	8ED7E6B478CF0C00934BB42E3BDF5E20
Time:	23:40:22
Date:	04/12/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	663552
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Lokibot	Stealing of Sensitive Information
Machine Learning detection for sample	AV Detection
Yara detected aPLib compressed binary	Data Obfuscation
PE file contains sections with non-standard names	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking

URLs

Name

Malicious

http://kbfvzoboss.bid/alien/fre.php

Details

Name:	http://kbfvzoboss.bid/alien/fre.php
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Source:	config extactor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

http://alphastand.win/alien/fre.php

Details

Name:	http://alphastand.win/alien/fre.php
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Source:	config extactor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

http://naourl.com/data/five/fre.php

212.32.237.90

Details

Name:	http://naourl.com/data/five/fre.php
IP:	212.32.237.90
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking

http://alphastand.trade/alien/fre.php

Details

Name:	http://alphastand.trade/alien/fre.php
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Source:	config extactor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

http://alphastand.top/alien/fre.php

Details

Name:	http://alphastand.top/alien/fre.php
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Source:	config extactor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

http://www.ibsensoftware.com/

unknown

Details

Name:	http://www.ibsensoftware.com/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Source:	rfxJzZjiWv.exe

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://survey-smiles.com

unknown

Details

Name:	http://survey-smiles.com
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Source:	rfxJzZjiWv.exe, 00000000.00000002.662546536.0000000000751000.00000004.00000020.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

naourl.com

212.32.237.90

Details

Name:	naourl.com
IP:	212.32.237.90
TargetID:	0
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

212.32.237.90

naourl.com

Netherlands

Details

IP:	212.32.237.90
TargetID:	0
Current Path:	C:\Users\user\Desktop\rfxJzZjiWv.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	60781
ASN name:	LEASEWEB-NL-AMS-01NetherlandsNL
Private:	false
Domain:	naourl.com

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking

192.168.2.1

unknown

Memdumps

Base Address

Regiontype

Protect

Malicious

415000

unkown image

page readonly

415000

unkown image

page readonly

24D6EE29000

unkown

page read and write

400000

unkown image

page readonly

7FF5A766F000

unkown image

page readonly

7FFC0000

unkown image

page readonly

24D6EE64000

unkown

page read and write

90F000

stack

page read and write

7FF5A7574000

unkown image

page readonly

7FF5A7664000

unkown image

page readonly

7FF5A7702000

unkown image

page readonly

7FF5A763F000

unkown image

page readonly

296D000

stack

page read and write

7FF5A7387000

unkown image

page readonly

7FF5A767E000

unkown image

page readonly

24D6F200000

unkown image

page readonly

7FF5A75FC000

unkown image

page readonly

2217000

unkown

page read and write

24D6EC60000

unkown image

page readonly

9E0B97B000

stack

page read and write

24D6EF02000

unkown

page read and write

24D6EE13000

unkown

page read and write

7FFC0000

unkown image

page readonly

7FFB2000

unkown image

page readonly

7FF5A7654000

unkown image

page readonly

24D6EE49000

unkown

page read and write

7FF5A763C000

unkown image

page readonly

24D6F602000

unkown

page read and write

9E0B9FE000

stack

page read and write

40000

unkown image

page readonly

761000

heap default

page read and write

282E000

stack

page read and write

7FFC2000

unkown image

page readonly

7FF5A74D1000

unkown image

page readonly

19B000

unkown

page read and write

DE0000

unkown image

page readonly

24D6ED90000

unkown

page read and write

24D6EE3C000

unkown

page read and write

A4F000

stack

page read and write

24D6EE80000

unkown

page read and write

7FF5A6E5C000

unkown image

page readonly

7FF5A7689000

unkown image

page readonly

401000

unkown image

page execute read

7DF5BC782000

unkown image

page readonly

7FFD0000

unkown image

page readonly

7FF5A7610000

unkown image

page readonly

7FF5A7701000

unkown image

page readonly

5CE000

stack

page read and write

7FF5A760A000

unkown image

page readonly

7FF5A7563000

unkown image

page readonly

7FF5A760E000

unkown image

page readonly

40000

unkown image

page readonly

24D6EF00000

unkown

page read and write

24D6EE00000

unkown

page read and write

27EF000

stack

page read and write

9E0BBFE000

stack

page read and write

9E0BCFC000

stack

page read and write

24D6EE5C000

unkown

page read and write

7FF5A75FA000

unkown image

page readonly

2210000

unkown

page read and write

7DF5BC792000

unkown image

page readonly

7FF5A7678000

unkown image

page readonly

401000

unkown image

page execute read

1F0000

unkown

page read and write

751000

heap default

page read and write

9E0B77E000

stack

page read and write

7FF5A7647000

unkown image

page readonly

24D6EC90000

heap default

page read and write

24D6EE8A000

unkown

page read and write

580000

heap default

page read and write

7FF5A74B3000

unkown image

page readonly

7DF5BC7A0000

unkown image

page readonly

7FF5A74F1000

unkown image

page readonly

7DF5BC780000

unkown image

page readonly

24D6EC30000

heap private

page read and write

7FFB0000

unkown image

page readonly

24D6EF13000

unkown

page read and write

7FF5A76F4000

unkown image

page readonly

C50000

unkown image

page readonly

7FFB2000

unkown image

page readonly

7FF5A765A000

unkown image

page readonly

2A6E000

stack

page read and write

2A7E000

unkown

page read and write

70E000

stack

page read and write

24D6EE54000

unkown

page read and write

7FF5A750B000

unkown image

page readonly

9E0B6FE000

stack

page read and write

7FF5A755D000

unkown image

page readonly

400000

unkown image

page readonly

7FFB0000

unkown image

page readonly

7FFD0000

unkown image

page readonly

9E0BAF7000

stack

page read and write

7FF5A71D6000

unkown image

page readonly

24D6ED70000

unkown image

page readonly

9E0B67B000

unkown

page read and write

224E000

stack

page read and write

7DF5BC790000

unkown image

page readonly

94E000

stack

page read and write

7FF5A71E5000

unkown image

page readonly

7DF5BC792000

unkown image

page readonly

7FF5A7461000

unkown image

page readonly

9D000

unkown

page read and write

24D6EC70000

unkown image

page readonly

24D6EF08000

unkown

page read and write

7FF5A768D000

unkown image

page readonly

7FF5A7627000

unkown image

page readonly

7FF5A750E000

unkown image

page readonly

7DF5BC780000

unkown image

page readonly

1A0000

unkown image

page readonly

24D6EE8D000

unkown

page read and write

24D6EE5F000

unkown

page read and write

71A000

heap default

page read and write

7DF5BC782000

unkown image

page readonly

24D6F380000

unkown image

page readonly

7FEB0000

unkown image

page readonly

292F000

stack

page read and write

7FF5A757C000

unkown image

page readonly

7FF5A761B000

unkown image

page readonly

24D6EC40000

unkown image

page readonly

3F6000

unkown

page read and write

2390000

unkown

page read and write

24D6EE59000

unkown

page read and write

A50000

unkown image

page readonly

400000

unkown image

page readonly

23A0000

heap private

page read and write

4A0000

unkown image

page write copy

30000

unkown image

page read and write

C60000

unkown image

page readonly

710000

heap default

page read and write

4A0000

unkown image

page read and write

7DF5BC7A0000

unkown image

page readonly

24D6EC40000

unkown image

page readonly

6CF000

stack

page read and write

7DF4BA650000

unkown image

page readonly

24D6F000000

unkown image

page readonly

234F000

stack

page read and write

7FF5A76FA000

unkown image

page readonly

7FF5A728A000

unkown image

page readonly

7FF5A7615000

unkown image

page readonly

3F2000

unkown

page read and write

238E000

stack

page read and write

9E0BDFF000

stack

page read and write

7DF5BC790000

unkown image

page readonly

7FF5A71D0000

unkown image

page readonly

24D6EC20000

unkown image

page read and write

7FFC2000

unkown image

page readonly

7FF5A7686000

unkown image

page readonly

There are 137 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

Domains

IPs

Memdumps