Edit tour

Windows Analysis Report
AIO.exe

Overview

General Information

Sample Name:	AIO.exe
Analysis ID:	708236
MD5:	9c1181704c48d62de14c5f682c4f5d5e
SHA1:	ada9921624f3225054745643b0d4504939efd1aa
SHA256:	44ea8ae385d7d95d4f0b9c6969c0d0ca55acfd996e97236c0ae04eb2b4b2d623
Tags:	droppedexemorpheus
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

PE file contains more sections than normal

Potential time zone aware malware

Installs a raw input device (often for capturing keystrokes)

Program does not show much activity (idle)

Detected TCP or UDP traffic on non-standard ports

PE file contains sections with non-standard names

Classification

Process Tree

System is w10x64

AIO.exe (PID: 4572 cmdline: "C:\Users\user\Desktop\AIO.exe" MD5: 9C1181704C48D62DE14C5F682C4F5D5E)

conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: AIO.exe

Virustotal: Detection: 7%

Perma Link

Source: AIO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: global traffic

TCP traffic: 192.168.2.5:49697 -> 185.25.204.244:9090

Source: unknown	TCP traffic detected without corresponding DNS query: 185.25.204.244
Source: unknown	TCP traffic detected without corresponding DNS query: 185.25.204.244
Source: unknown	TCP traffic detected without corresponding DNS query: 185.25.204.244

Source: AIO.exe

Binary or memory string: github.com/gonutz/w32/v2.getRawInputData

Source: AIO.exe

Static PE information: Number of sections : 14 > 10

Source: AIO.exe	Static PE information: Section: /19 ZLIB complexity 0.9970344753440367
Source: AIO.exe	Static PE information: Section: /32 ZLIB complexity 0.9973810369318182
Source: AIO.exe	Static PE information: Section: /65 ZLIB complexity 0.9984575565403423

Source: AIO.exe

Virustotal: Detection: 7%

Source: AIO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AIO.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AIO.exe

String found in binary or memory: C:/Program Files/Go/src/net/addrselect.go

Source: classification engine

Classification label: mal48.winEXE@2/0@0/1

Source: unknown	Process created: C:\Users\user\Desktop\AIO.exe "C:\Users\user\Desktop\AIO.exe"
Source: C:\Users\user\Desktop\AIO.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4536:120:WilError_01

Source: AIO.exe

Static file information: File size 4077056 > 1048576

Source: AIO.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AIO.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x12ea00
Source: AIO.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x131a00

Source: AIO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: AIO.exe	Static PE information: section name: /4
Source: AIO.exe	Static PE information: section name: /19
Source: AIO.exe	Static PE information: section name: /32
Source: AIO.exe	Static PE information: section name: /46
Source: AIO.exe	Static PE information: section name: /65
Source: AIO.exe	Static PE information: section name: /78
Source: AIO.exe	Static PE information: section name: /90
Source: AIO.exe	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\AIO.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\AIO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\AIO.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: AIO.exe, 00000000.00000002.309927572.000002228A628000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllooJ

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	1 Software Packing	11 Input Capture	1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
AIO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AIO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Windows Analysis Report
AIO.exe