Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

arinzezx.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.2761539654732506
Filename:	arinzezx.exe
Filesize:	1527808
MD5:	314c678d85f7927a42f34797627532e1
SHA1:	1a1695ee1411cc14754cc92e14a6243ee7af81d1
SHA256:	e5b9cc21b8de77e68e03e202609511b8b57d1ea278d6cd0fe0b7fb454f1d7432
SHA512:	40b9a9373cd8590cb70d8ba289d4fe0d83d5dbff81a6b6c17baf03142f4627fdeee36547a15b5b4d2b77c650ea74001ee10abe98ec6f6ba8333e9cdf57f2ca09
SSDEEP:	24576:H+tsF5jvq3uXN7+ZZ56+ncKxRGXUO+C+0/suliuM:ec5jvt856+ncaO+CV/sa
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{l.c..............0..$...*.......B... ...`....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Credentials in Registry
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Machine Learning detection for sample	AV Detection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)	Malware Analysis System Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara signature match	System Summary
Antivirus or Machine Learning detection for unpacked file	AV Detection
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Detected potential crypto function	System Summary	Archive Collected Data
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging
Creates a DirectInput object (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Sample file is different than original file name gathered from version info	System Summary
Creates a window with clipboard capturing capabilities	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Found malware configuration	AV Detection
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Uses an in-process (OLE) Automation server	System Summary
Queries process information (via WMI, Win32_Process)	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
SQL strings found in memory and binary data	System Summary
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
Reads the hosts file	System Summary	Remote System Discovery
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file has a big code size	System Summary
Checks if Microsoft Office is installed	System Summary
Submission file is bigger than most known malware samples	System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\arinzezx.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\arinzezx.exe.log
Category:	dropped
Dump:	arinzezx.exe.log.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\Desktop\arinzezx.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.3458551807012835
Encrypted:	false
Ssdeep:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE49E4184F0:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz8
Size:	1421
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\livestream[1].htm

HTML document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\livestream[1].htm
Category:	dropped
Dump:	livestream[1].htm.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\arinzezx.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	4.43530643106624
Encrypted:	false
Ssdeep:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
Size:	162
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\arinzezx.exe

"C:\Users\user\Desktop\arinzezx.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6600
Target ID:	1
Parent PID:	1424
Name:	arinzezx.exe
Path:	C:\Users\user\Desktop\arinzezx.exe
Commandline:	"C:\Users\user\Desktop\arinzezx.exe"
Size:	1527808
MD5:	314C678D85F7927A42F34797627532E1
Time:	23:47:52
Date:	31/08/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x670000
Modulesize:	1556480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\arinzezx.exe

Details

Is windows:	false
Is dropped:	false
PID:	6964
Target ID:	3
Parent PID:	6600
Name:	arinzezx.exe
Path:	C:\Users\user\Desktop\arinzezx.exe
Commandline:	C:\Users\user\Desktop\arinzezx.exe
Size:	1527808
MD5:	314C678D85F7927A42F34797627532E1
Time:	23:48:13
Date:	31/08/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x410000
Modulesize:	1556480
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\arinzezx.exe

Details

Is windows:	false
Is dropped:	false
PID:	6976
Target ID:	4
Parent PID:	6600
Name:	arinzezx.exe
Path:	C:\Users\user\Desktop\arinzezx.exe
Commandline:	C:\Users\user\Desktop\arinzezx.exe
Size:	1527808
MD5:	314C678D85F7927A42F34797627532E1
Time:	23:48:14
Date:	31/08/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xf60000
Modulesize:	1556480
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

URLs

Name

Malicious

https://www.000webhost.com/migrate?static=truesl

unknown

http://127.0.0.1:HTTP/1.1

unknown

http://en.wD

unknown

http://www.fontbureau.com/designersG

unknown

http://www.fontbureau.com/designersAny

unknown

http://www.fonts.comcD

unknown

http://can-sat.netai.net/livestream/r

unknown

http://www.fontbureau.com/designers/?

unknown

https://csp.withgoogle.com/csp/report-to/ConsentHttp/external

unknown

http://www.founder.com.cn/cn/bThe

unknown

http://ocsp.sectigo.com0

unknown

https://www.000webhost.com/migrate?static=true

104.19.184.120

http://www.fontbureau.com/designers?

unknown

https://DtM6GM1g5LTlJoVP.org

unknown

http://www.tiro.com

unknown

http://cp5ua.hyperhost.ua

unknown

http://www.fontbureau.com/designers

unknown

http://www.goodfont.co.kr

unknown

https://www.000webhost.com/migrate?static=truekM

unknown

http://maps.google.com/?saddr=31.2087496

unknown

http://YthClZ.com

unknown

http://can-sat.netai.net/y

unknown

https://consent.google.com/

unknown

http://www.sajatypeworks.com

unknown

http://www.typography.netD

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

http://can-sat.netai.net/livestream/Hx

unknown

http://fontfabrik.com

unknown

https://consent.google.com/ml?continue=https://www.google.com/maps?saddr%3D31.2087496,29.9091634&gl=GB&m=0&pc=m&uxe=eomtm&hl=de&src=1

216.58.215.238

https://www.000webhost.com/migrate?static=truec

unknown

https://www.google.com/maps?saddr=31.2087496,29.9091634&z=10

142.250.203.100

http://maps.google.com/?saddr=31.2087496,29.9091634&z=10

142.250.203.110

http://can-sat.netai.net/livestream/

153.92.0.100

http://DynDns.comDynDNSnamejidpasswordPsi/Psi

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.ascendercorp.com/typedesigners.html

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://www.urwpp.deDPlease

unknown

https://www.000webhost.com/X

unknown

http://www.zhongyicts.com.cn

unknown

http://www.sakkal.com

unknown

http://can-sat.netai.net/livestream/CgC

unknown

http://can-sat.netai.n

unknown

http://can-sat.netai.net/livestream/5

unknown

http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#

unknown

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

https://sectigo.com/CPS0

unknown

http://can-sat.netai.net/livestream/ions.AddInAdapter.v10.0

unknown

https://consent.google.com/ml?continue=https://www.google.com/maps?saddr%3D31.2087496

unknown

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

unknown

http://maps.google.com/

unknown

http://can-sat.netai.net/livestream/tldi

unknown

http://can-sat.netai.net/5

unknown

http://www.fontbureau.com/designerse~

unknown

http://www.carterandcone.coml

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.fontbureau.com/designers2~

unknown

http://www.ascendercorp.com/typedesigners.htmlu

unknown

http://www.founder.com.cn/cn

unknown

http://www.fontbureau.com/designers/frere-jones.html

unknown

http://www.tiro.comY

unknown

http://www.jiyu-kobo.co.jp/

unknown

http://maps.google.com/maps?saddr=31.2087496

unknown

https://www.000webhost.com/

unknown

http://can-sat.netai.net/livestream/46

unknown

http://can-sat.netai.net/livestream/e

unknown

http://www.fontbureau.com/designers8

unknown

https://www.google.com/_

unknown

http://can-sat.netai.net/livestream/ll

unknown

http://maps.google.com/maps?saddr=31.2087496,29.9091634&z=10

142.250.203.110

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
arinzezx.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportarinzezx.exe

Files

Processes

URLs

IOC Report
arinzezx.exe