Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

mPNVrHIpyt.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.490132731956949
Filename:	mPNVrHIpyt.exe
Filesize:	71680
MD5:	cc7ae6e4c86f605aab66fbd04eef7997
SHA1:	8c7c23c91ccecf548c6f9df30b839b9b24d57095
SHA256:	95427e787bb623ba2d2ec51cb289ae579aea27a674d900f9aa239f6a034b05cc
SHA512:	767db43c1dbb486350eee49ccd58cdb4767cad3907795f24bf65f5aec52c9bee18854feeac2791c87523eea018a36b42260d0b83f9699fe332e3d5dec8a0e317
SSDEEP:	1536:0ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Ld5BJHMqqDL2/Ovvdr
Preview:	MZ......................@...............................................!..L.!This Nk...xm cannot be run in DOS mode....$.........................}.......B.......B...............1.........Y.....G.......~.......y.......\|.....Rich....................PE..L..

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to determine the online IP of the system	Networking	System Network Configuration Discovery System Network Connections Discovery
Found Tor onion address	Networking	Proxy
Machine Learning detection for sample	AV Detection
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API
Yara signature match	System Summary
Antivirus or Machine Learning detection for unpacked file	AV Detection	Software Packing
Detected potential crypto function	System Summary	Process Discovery
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Queries information about the installed CPU (vendor, model number etc)	Language, Device and Operating System Detection	Native API File and Directory Discovery
Drops PE files	Persistence and Installation Behavior
Contains functionality to read the PEB	Anti Debugging
Contains functionality to enumerate device drivers	Malware Analysis System Evasion	Process Discovery System Information Discovery
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	System Network Configuration Discovery Encrypted Channel
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Uses an in-process (OLE) Automation server	System Summary
Creates files inside the user directory	System Summary	Masquerading
Contains functionality to check free disk space	System Summary
Queries a list of all running drivers	Malware Analysis System Evasion
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder File and Directory Discovery
Contains functionality to enum processes or threads	System Summary	Process Discovery
Program exit points	Malware Analysis System Evasion
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
URLs found in memory or binary data	Networking
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Reads the hosts file	System Summary	Remote System Discovery Ingress Tool Transfer
Contains functionality to import cryptographic keys (often used in ransomware)	Spam, unwanted Advertisements and Ransom Demands	Archive Collected Data Data Encrypted for Impact
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe
Category:	dropped
Dump:	wzltxa.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\mPNVrHIpyt.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.49012841585642
Encrypted:	false
Ssdeep:	1536:fZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:2d5BJHMqqDL2/Ovvdr
Size:	71680
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Yara detected ReflectiveLoader	Data Obfuscation
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Machine Learning detection for dropped file	AV Detection
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Checks for available system drives (often done to infect USB drives)	Spreading	Replication Through Removable Media Peripheral Device Discovery
Drops PE files	Persistence and Installation Behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
Queries information about the installed CPU (vendor, model number etc)	Language, Device and Operating System Detection	System Information Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary
Program exit points	Malware Analysis System Evasion
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Reads the hosts file	System Summary	Remote System Discovery
Spawns processes	System Summary	Process Injection

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\mPNVrHIpyt.exe

"C:\Users\user\Desktop\mPNVrHIpyt.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe

"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

There are 7 hidden processes, click here to show them.

URLs

Name

Malicious

http://gdcbmuveqjsli57x.onion/cd05fa18e84d425b

unknown

http://ipv4bot.whatismyipaddress.com/r

unknown

http://ipv4bot.whatismyipaddress.com/0

unknown

http://ipv4bot.whatismyipaddress.com/6

unknown

http://ipv4bot.whatismyipaddress.com/5

unknown

http://ipv4bot.whatismyipaddress.com/u

unknown

http://ipv4bot.whatismyipaddress.com/T

unknown

http://ipv4bot.whatismyipaddress.com/3

unknown

http://ipv4bot.whatismyipaddress.com/S

unknown

http://ipv4bot.whatismyipaddress.com/)

unknown

http://ipv4bot.whatismyipaddress.com/pxV

unknown

http://ipv4bot.whatismyipaddress.com/.

unknown

http://ipv4bot.whatismyipaddress.com/K

unknown

http://ipv4bot.whatismyipaddress.com/a

unknown

http://ipv4bot.whatismyipaddress.com/E:

unknown

http://ipv4bot.whatismyipaddress.com/%

unknown

https://www.torproject.org/

unknown

http://ipv4bot.whatismyipaddress.com/Z

unknown

http://ipv4bot.whatismyipaddress.com/Y

unknown

http://ipv4bot.whatismyipaddress.com/

unknown

https://tox.chat/download.html

unknown

http://ipv4bot.whatismyipaddress.com/nxD

unknown

There are 12 hidden URLs, click here to show them.

Domains

Name

Malicious

ipv4bot.whatismyipaddress.com

unknown

Details

Name:	ipv4bot.whatismyipaddress.com
TargetID:	39
Current Path:	C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Contains functionality to determine the online IP of the system	Networking	System Network Connections Discovery
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

192.168.2.1

unknown

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

imsihyxywip

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	imsihyxywip
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

lwxsmttcgib

Details

TargetID:	11
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	lwxsmttcgib
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

rbpjrvqzmfp

Details

TargetID:	12
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	rbpjrvqzmfp
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

lldeowbcwli

Details

TargetID:	13
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	lldeowbcwli
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

mvsrloqetvq

Details

TargetID:	15
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	mvsrloqetvq
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

pkxyauwkvet

Details

TargetID:	18
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	pkxyauwkvet
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

axlnhkgixlf

Details

TargetID:	22
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	axlnhkgixlf
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

xjlfhrnjhfo

Details

TargetID:	28
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	xjlfhrnjhfo
Value data:	"C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe"

Signature Hits	Behavior Group	Mitre Attack
Creates multiple autostart registry keys	Boot Survival	Registry Run Keys / Startup Folder
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

ovikprhtlzq

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
mPNVrHIpyt.exe

Files

Processes

URLs

Domains

IPs

Registry

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportmPNVrHIpyt.exe

Files

Processes

URLs

Domains

IPs

Registry

IOC Report
mPNVrHIpyt.exe