Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

52h0KETBXt.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.595409513386053
Filename:	52h0KETBXt.exe
Filesize:	488960
MD5:	c0fed64dae580efb8fb8308accf76cac
SHA1:	d7de3d945c5e62ee8f7b77a508b8b0682cae713d
SHA256:	5bd07db2eed6c7e67e3f3947b5336c6ba986cfbd03bd406c13eda1999a64fc70
SHA512:	1ffb0f66a59f98cd4d289b2c7baf0a96e025aa2dced1351d3359ee3b0491975bbe433669253fcc211a507eead2bd530fdf46aba421c55f1d52bd069858fc98d3
SSDEEP:	12288:KLOPQWlRGF/Z3I5tefhiKwVD2EpioIYaE252hhW:KLOIW+FWfMir2E4oLg5gI
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a..............0..(...L......2F... ...`....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Sample uses process hollowing technique	HIPS / PFW / Operating System Protection Evasion	Shared Modules
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Machine Learning detection for sample	AV Detection
.NET source code contains potential unpacker	Data Obfuscation
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
.NET source code contains method to dynamically call methods (often used by packers)	Data Obfuscation
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion
Tries to detect virtualization through RDTSC time measurements	Malware Analysis System Evasion
Modifies the context of a thread in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Yara signature match	System Summary
Antivirus or Machine Learning detection for unpacked file	AV Detection
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Contains functionality to call native functions	System Summary
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging
Creates a DirectInput object (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Sample file is different than original file name gathered from version info	System Summary
Checks if the current process is being debugged	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Queries a list of all running processes	Malware Analysis System Evasion
Sample is known by Antivirus	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\52h0KETBXt.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\52h0KETBXt.exe.log
Category:	dropped
Dump:	52h0KETBXt.exe.log.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\52h0KETBXt.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.345651901398759
Encrypted:	false
Ssdeep:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x847mE4P:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzQ
Size:	1310
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\52h0KETBXt.exe

"C:\Users\user\Desktop\52h0KETBXt.exe"

Details

Is windows:	false
Is dropped:	false
PID:	1360
Target ID:	1
Parent PID:	5188
Name:	52h0KETBXt.exe
Path:	C:\Users\user\Desktop\52h0KETBXt.exe
Commandline:	"C:\Users\user\Desktop\52h0KETBXt.exe"
Size:	488960
MD5:	C0FED64DAE580EFB8FB8308ACCF76CAC
Time:	17:41:54
Date:	13/01/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x4d0000
Modulesize:	516096
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Self deletion via cmd delete	Hooking and other Techniques for Hiding and Protection	File Deletion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\52h0KETBXt.exe

Details

Is windows:	false
Is dropped:	false
PID:	984
Target ID:	2
Parent PID:	1360
Name:	52h0KETBXt.exe
Path:	C:\Users\user\Desktop\52h0KETBXt.exe
Commandline:	C:\Users\user\Desktop\52h0KETBXt.exe
Size:	488960
MD5:	C0FED64DAE580EFB8FB8308ACCF76CAC
Time:	17:42:04
Date:	13/01/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x430000
Modulesize:	516096
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Self deletion via cmd delete	Hooking and other Techniques for Hiding and Protection	File Deletion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

Details

Is windows:	true
Is dropped:	false
PID:	3424
Target ID:	3
Parent PID:	984
Name:	explorer.exe
Class:	explorer
Path:	C:\Windows\explorer.exe
Commandline:	C:\Windows\Explorer.EXE
Size:	3933184
MD5:	AD5296B280E8F522A8A897C96BAB0E1D
Time:	17:42:07
Date:	13/01/2022
Reason:	existingprocessinject
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6fee60000
Modulesize:	3919872
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Launches a second explorer.exe instance	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\systray.exe

Details

Is windows:	true
Is dropped:	false
PID:	5644
Target ID:	7
Parent PID:	3424
Name:	systray.exe
Path:	C:\Windows\SysWOW64\systray.exe
Commandline:	C:\Windows\SysWOW64\systray.exe
Size:	9728
MD5:	1373D481BE4C8A6E5F5030D2FB0A0C68
Time:	17:42:32
Date:	13/01/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x2f0000
Modulesize:	24576
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample uses process hollowing technique	HIPS / PFW / Operating System Protection Evasion	Shared Modules Process Injection
Sample file is different than original file name gathered from version info	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Windows\explorer.exe

"C:\Windows\explorer.exe" /LOADSAVEDWINDOWS

Details

Is windows:	true
Is dropped:	false
PID:	5104
Target ID:	17
Parent PID:	4128
Name:	explorer.exe
Class:	explorer
Path:	C:\Windows\explorer.exe
Commandline:	"C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
Size:	3933184
MD5:	AD5296B280E8F522A8A897C96BAB0E1D
Time:	17:43:06
Date:	13/01/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6fee60000
Modulesize:	3919872
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Launches a second explorer.exe instance	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\autofmt.exe

Details

Is windows:	true
Is dropped:	false
PID:	5652
Target ID:	5
Parent PID:	3424
Name:	autofmt.exe
Path:	C:\Windows\SysWOW64\autofmt.exe
Commandline:	C:\Windows\SysWOW64\autofmt.exe
Size:	831488
MD5:	7FC345F685C2A58283872D851316ACC4
Time:	17:42:30
Date:	13/01/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13c0000
Modulesize:	847872
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\autoconv.exe

Details

Is windows:	true
Is dropped:	false
PID:	5656
Target ID:	6
Parent PID:	3424
Name:	autoconv.exe
Path:	C:\Windows\SysWOW64\autoconv.exe
Commandline:	C:\Windows\SysWOW64\autoconv.exe
Size:	851968
MD5:	4506BE56787EDCD771A351C10B5AE3B7
Time:	17:42:31
Date:	13/01/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x10a0000
Modulesize:	868352
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\user\Desktop\52h0KETBXt.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5468
Target ID:	8
Parent PID:	5644
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	/c del "C:\Users\user\Desktop\52h0KETBXt.exe"
Size:	232960
MD5:	F3BDBE3BB6F734E357235F4D5898582D
Time:	17:42:35
Date:	13/01/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x11d0000
Modulesize:	364544
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	5672
Target ID:	9
Parent PID:	5468
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	17:42:36
Date:	13/01/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff724c50000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

www.hstolchsjybyl.com/a83r/

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

http://www.fontbureau.com/designersG

unknown

http://www.founder.com.cn/cnK

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.founder.com.cn/cn/bThe

unknown

http://www.fontbureau.com/designers?

unknown

http://www.fontbureau.com/designers/cabarga.htmlP&

unknown

http://www.carterandcone.como.?

unknown

http://www.tiro.com

unknown

http://www.fontbureau.com/designers

unknown

http://www.goodfont.co.kr

unknown

http://www.carterandcone.com

unknown

http://www.fontbureau.coma

unknown

http://en.w

unknown

http://www.fontbureau.coml1

unknown

http://www.fontbureau.comiona

unknown

http://www.carterandcone.coml

unknown

http://www.sajatypeworks.com

unknown

http://www.typography.netD

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

http://fontfabrik.com

unknown

http://www.founder.com.cn/cn

unknown

http://www.fontbureau.com/designers/frere-user.html

unknown

http://www.galapagosdesign.com/1

unknown

http://www.fontbureau.comm

unknown

http://www.jiyu-kobo.co.jp/

unknown

http://www.galapagosdesign.com/;

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.zhongyicts.com.cno.

unknown

http://www.fontbureau.com/designers8

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://www.urwpp.deDPlease

unknown

http://www.zhongyicts.com.cn

unknown

http://www.sakkal.com

unknown

http://www.fontbureau.com/designers/

unknown

http://www.founder.com.cn/cni

unknown

There are 31 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

192.168.2.1

unknown

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}

DriveNumber

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{ef47ea26-ec76-4a6e-8680-9e53b539546d}

Generation

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{4b110390-e32a-400c-bf41-7fe93773464a}

Generation

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b8455d9b-4916-480e-8b44-905b33ca001e}

Generation

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}

Generation

HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop

IconLayouts

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001041E

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001040A

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010406

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010408

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103FE

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103EE

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103F0

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103D4

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103D6

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103D2

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103CE

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103C6

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103AE

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103B0

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000103B2

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001039A

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001039C

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010396

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001038A

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000010356

VirtualDesktop

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search

InstalledWin32AppsRevision

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$$windows.data.signals.registrations\Current

Data

HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop

IconLayouts

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

IPs

Registry