Edit tour
Windows
Analysis Report
5iiXyNVCQ3
Overview
General Information
| Sample Name: | 5iiXyNVCQ3 (renamed file extension from none to dll) |
| Analysis ID: | 736960 |
| MD5: | 73c06c75bd9aa0a194b0dc73ab38cac5 |
| SHA1: | 7604d4be31e6c017e3bd9a1e5590a81a7aafb40f |
| SHA256: | fde687287ef8cd7e6a6ce655355eaca2fba25fd6c22cc1e4040281f73205ba90 |
| Infos: |  |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
System process connects to network (likely due to code injection or exploit)
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Writes to foreign memory regions
Machine Learning detection for sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Contains functionality to inject code into remote processes
Machine Learning detection for dropped file
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
One or more processes crash
Contains functionality to query locales information (e.g. system language)
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to read the clipboard data
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Entry point lies outside standard sections
Found inlined nop instructions (likely shell or obfuscated code)
Drops PE files
Contains functionality to read the PEB
Detected TCP or UDP traffic on non-standard ports
Potential key logger detected (key state polling based)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Classification
- System is w10x64
loaddll32.exe (PID: 3144 cmdline: loaddll32. exe "C:\Us ers\user\D esktop\5ii XyNVCQ3.dl l" MD5: 1F562FBF37040EC6C43C8D5EF619EA39) 
conhost.exe (PID: 676 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 400 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\5ii XyNVCQ3.dl l",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D) 
rundll32.exe (PID: 5996 cmdline: rundll32.e xe "C:\Use rs\user\De sktop\5iiX yNVCQ3.dll ",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - svchost.exe (PID: 5972 cmdline:
C:\WINDOWS \system32\ svchost.ex e -K Netwo rkService MD5: FA6C268A5B5BDA067A901764D203D433) - rundll32.exe (PID: 964 cmdline:
rundll32.e xe C:\User s\user\Des ktop\5iiXy NVCQ3.dll, unll MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - svchost.exe (PID: 5020 cmdline:
C:\WINDOWS \system32\ svchost.ex e -K Netwo rkService MD5: FA6C268A5B5BDA067A901764D203D433) 
WerFault.exe (PID: 1372 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -u -p 9 64 -s 844 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - svchost.exe (PID: 3832 cmdline:
C:\WINDOWS \system32\ svchost.ex e -K Netwo rkService MD5: FA6C268A5B5BDA067A901764D203D433) - WerFault.exe (PID: 5288 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 3 144 -s 616 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| MALWARE_Win_BlackMoon | Detects executables using BlackMoon RunTime | ditekSHen |
| |
| MALWARE_Win_BlackMoon | Detects executables using BlackMoon RunTime | ditekSHen |
| |
| MALWARE_Win_BlackMoon | Detects executables using BlackMoon RunTime | ditekSHen |
| |
| MALWARE_Win_BlackMoon | Detects executables using BlackMoon RunTime | ditekSHen |
| |
| MALWARE_Win_BlackMoon | Detects executables using BlackMoon RunTime | ditekSHen |
| |
| Click to see the 12 entries | ||||
⊘No Sigma rule has matched
| Timestamp: | 192.168.2.48.8.8.856572532023883 11/03/22-12:35:13.698250 |
| SID: | 2023883 |
| Source Port: | 56572 |
| Destination Port: | 53 |
| Protocol: | UDP |
| Classtype: | Potentially Bad Traffic |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Metadefender: | Perma Link | ||
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Avira: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Metadefender: | Perma Link | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: |