Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
mPNVrHIpyt.exe

Overview

General Information

Sample Name:mPNVrHIpyt.exe
Analysis ID:694572
MD5:cc7ae6e4c86f605aab66fbd04eef7997
SHA1:8c7c23c91ccecf548c6f9df30b839b9b24d57095
SHA256:95427e787bb623ba2d2ec51cb289ae579aea27a674d900f9aa239f6a034b05cc
Tags:exeGandCrab
Infos:

Detection

Gandcrab, ReflectiveLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Gandcrab
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected ReflectiveLoader
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Creates multiple autostart registry keys
Contains functionality to determine the online IP of the system
Found Tor onion address
Machine Learning detection for sample
May check the online IP address of the machine
Machine Learning detection for dropped file
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Queries information about the installed CPU (vendor, model number etc)
PE file contains an invalid checksum
Drops PE files
Contains functionality to read the PEB
Contains functionality to enumerate device drivers
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Checks for available system drives (often done to infect USB drives)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • mPNVrHIpyt.exe (PID: 3592 cmdline: "C:\Users\user\Desktop\mPNVrHIpyt.exe" MD5: CC7AE6E4C86F605AAB66FBD04EEF7997)
  • wzltxa.exe (PID: 1276 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 1920 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 4616 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 6136 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 1356 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 2996 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 6016 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 5520 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 2228 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 6128 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 5752 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 2156 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 5248 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 4920 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 1200 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • wzltxa.exe (PID: 5280 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exe" MD5: EAC223A7EC1CF2E33BE569DB14A87A63)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
mPNVrHIpyt.exeReflectiveLoaderDetects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommendedFlorian Roth
  • 0xef92:$x1: ReflectiveLoader
mPNVrHIpyt.exeSUSP_RANSOMWARE_Indicator_Jul20Detects ransomware indicatorFlorian Roth
  • 0xe8fe:$: DECRYPT.txt
  • 0xe964:$: DECRYPT.txt
mPNVrHIpyt.exeJoeSecurity_ReflectiveLoaderYara detected ReflectiveLoaderJoe Security
    mPNVrHIpyt.exeINDICATOR_SUSPICIOUS_ReflectiveLoaderdetects Reflective DLL injection artifactsditekSHen
    • 0xef91:$s1: _ReflectiveLoader@
    • 0xef92:$s2: ReflectiveLoader@
    mPNVrHIpyt.exeGandcrabGandcrab Payloadkevoreilly
    • 0xe5c8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
    Click to see the 1 entries

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exeReflectiveLoaderDetects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommendedFlorian Roth
    • 0xef92:$x1: ReflectiveLoader
    C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exeSUSP_RANSOMWARE_Indicator_Jul20Detects ransomware indicatorFlorian Roth
    • 0xe8fe:$: DECRYPT.txt
    • 0xe964:$: DECRYPT.txt
    C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exeJoeSecurity_ReflectiveLoaderYara detected ReflectiveLoaderJoe Security
      C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exeINDICATOR_SUSPICIOUS_ReflectiveLoaderdetects Reflective DLL injection artifactsditekSHen
      • 0xef91:$s1: _ReflectiveLoader@
      • 0xef92:$s2: ReflectiveLoader@
      C:\Users\user\AppData\Roaming\Microsoft\wzltxa.exeGandcrabGandcrab Payloadkevoreilly
      • 0xe5c8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
      Click to see the 1 entries

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      0000001F.00000000.523518226.000000000FBBA000.00000002.00000001.01000000.00000004.sdmpJoeSecurity_ReflectiveLoaderYara detected ReflectiveLoaderJoe Security
        00000012.00000002.407272016.000000000FBC2000.00000004.00000001.01000000.00000004.sdmpJoeSecurity_GandcrabYara detected GandcrabJoe Security
          0000000B.00000000.302743243.000000000FBBA000.00000002.00000001.01000000.00000004.sdmpJoeSecurity_ReflectiveLoaderYara detected ReflectiveLoaderJoe Security
            00000019.00000002.471339306.000000000FBC2000.00000004.00000001.01000000.00000004.sdmpJoeSecurity_GandcrabYara detected GandcrabJoe Security
              00000022.00000000.561698093.000000000FBBA000.00000002.00000001.01000000.00000004.sdmpJoeSecurity_ReflectiveLoaderYara detected ReflectiveLoaderJoe Security