Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive

initial sample

C:\Program Files (x86)\PrintFolders\PrintFolders.exe

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

modified

C:\Program Files (x86)\PrintFolders\Russian.dll (copy)

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\PrintFolders\is-6QPAJ.tmp

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\PrintFolders\is-JPR4D.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\PrintFolders\unins000.exe (copy)

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_iscrypt.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_isetup\_setup64.tmp

PE32+ executable (console) x86-64, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\CqxAaSZxg.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\PrintFolders\Guide.chm (copy)

MS Windows HtmlHelp Data

dropped

C:\Program Files (x86)\PrintFolders\History.txt (copy)

ASCII text, with CRLF line terminators

dropped

C:\Program Files (x86)\PrintFolders\License.txt (copy)

RAGE Package Format (RPF),

dropped

C:\Program Files (x86)\PrintFolders\is-3PESN.tmp

data

dropped

C:\Program Files (x86)\PrintFolders\is-B2P4P.tmp

RAGE Package Format (RPF),

dropped

C:\Program Files (x86)\PrintFolders\is-D385T.tmp

ASCII text, with CRLF line terminators

dropped

C:\Program Files (x86)\PrintFolders\is-U4GGJ.tmp

MS Windows HtmlHelp Data

dropped

C:\Program Files (x86)\PrintFolders\unins000.dat

InnoSetup Log PrintFolders {73D78C7A-78F2-476F-86FF-9025EA410908}, version 0x2a, 3814 bytes, 992547\user, "C:\Program Files (x86)\PrintFolders"

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\fuckingdllENCR[1].dll

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\count[1].htm

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\library[1].htm

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\library[1].htm

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\ping[1].htm

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_isetup\_shfoldr.dll

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

dropped

There are 14 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files (x86)\PrintFolders\PrintFolders.exe

"C:\Program Files (x86)\PrintFolders\PrintFolders.exe"

Details

Is windows:	false
Is dropped:	true
PID:	4476
Target ID:	2
Parent PID:	3664
Name:	PrintFolders.exe
Class:	system-tools
Path:	C:\Program Files (x86)\PrintFolders\PrintFolders.exe
Commandline:	"C:\Program Files (x86)\PrintFolders\PrintFolders.exe"
Size:	1785853
MD5:	A11421185D7DA999305A2A671E0244DE
Time:	19:18:01
Date:	24/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	16465920
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Yara detected Nymaim	E-Banking Fraud, Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Uses taskkill to terminate processes	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Queries process information (via WMI, Win32_Process)	System Summary	System Information Discovery Windows Management Instrumentation
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\CqxAaSZxg.exe

Details

Is windows:	false
Is dropped:	true
PID:	5656
Target ID:	3
Parent PID:	4476
Name:	CqxAaSZxg.exe
Path:	C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\CqxAaSZxg.exe
Commandline:
Size:	73728
MD5:	3FB36CB0B7172E5298D2992D42984D06
Time:	19:18:05
Date:	24/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xe60000
Modulesize:	90112
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Spawns processes	System Summary	Process Injection

C:\Users\user\Desktop\file.exe

Details

Is windows:	false
Is dropped:	false
PID:	1364
Target ID:	0
Parent PID:	3324
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	C:\Users\user\Desktop\file.exe
Size:	1313965
MD5:	7E8888D098D8AF9B7F7D1A39FF7666A4
Time:	19:17:58
Date:	24/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	77824
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp

"C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp" /SL4 $30340 "C:\Users\user\Desktop\file.exe" 1077961 51712

Details

Is windows:	false
Is dropped:	true
PID:	3664
Target ID:	1
Parent PID:	1364
Name:	is-71GCF.tmp
Path:	C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp
Commandline:	"C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp" /SL4 $30340 "C:\Users\user\Desktop\file.exe" 1077961 51712
Size:	658944
MD5:	85B94E72C3F2D2B5464E2AAF3C9E242A
Time:	19:17:58
Date:	24/11/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	847872
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Enumerates the file system	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /im "PrintFolders.exe" /f & erase "C:\Program Files (x86)\PrintFolders\PrintFolders.exe" & exit

Details

Is windows:	true
Is dropped:	false
PID:	2240
Target ID:	4
Parent PID:	4476
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "PrintFolders.exe" /f & erase "C:\Program Files (x86)\PrintFolders\PrintFolders.exe" & exit
Size:	232960
MD5:	F3BDBE3BB6F734E357235F4D5898582D
Time:	19:18:39
Date:	24/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x11d0000
Modulesize:	364544
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4568
Target ID:	5
Parent PID:	2240
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	19:18:39
Date:	24/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7fcd70000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\taskkill.exe

taskkill /im "PrintFolders.exe" /f

Details

Is windows:	true
Is dropped:	false
PID:	5104
Target ID:	6
Parent PID:	2240
Name:	taskkill.exe
Path:	C:\Windows\SysWOW64\taskkill.exe
Commandline:	taskkill /im "PrintFolders.exe" /f
Size:	74752
MD5:	15E2E0ACD891510C6268CB8899F2A1A1
Time:	19:18:39
Date:	24/11/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xe0000
Modulesize:	86016
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses taskkill to terminate processes	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://171.22.30.106/library.phpV

unknown

http://171.22.30.106/library.php:

unknown

http://171.22.30.106/library.php~

unknown

http://171.22.30.106/library.phpB

unknown

http://171.22.30.106/library.phpjN

unknown

http://171.22.30.106/library.phpH

unknown

http://171.22.30.106/library.php&

unknown

http://171.22.30.106/library.phpj

unknown

http://171.22.30.106/library.php0

unknown

http://171.22.30.106/library.php

171.22.30.106

http://pfolders.atopoint.com.

unknown

http://www.innosetup.com/

unknown

http://pfolders.atopoint.com2

unknown

http://www.atopoint.com

unknown

http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte

45.139.105.171

http://107.182.129.235/storage/extension.php

107.182.129.235

http://www.remobjects.com/?ps

unknown

http://pfolders.atopoint.com

unknown

http://www.innosetup.com

unknown

http://107.182.129.235/storage/ping.php

107.182.129.235

http://www.atopoint.com.

unknown

http://www.innosetup.comDVarFileInfo$

unknown

http://www.remobjects.com/?psU

unknown

There are 13 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

45.139.105.1

unknown

Italy

Details

IP:	45.139.105.1
TargetID:	255
Country:	Italy
Countrycode:	ITA
ASN number:	33657
ASN name:	CMCSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found malware configuration	AV Detection

85.31.46.167

unknown

Germany

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

IPs

IOC Report
file.exe