Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.664770270231839
Filename:	SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Filesize:	960000
MD5:	277a9cd8ef361888eb41a6b7d0d94e26
SHA1:	9b703e613307793cd9f0309eb458d5f12f8400dd
SHA256:	8cdfbe67b609226da852adf3db3098941cffda7cea7443b935e1eed5fdae0bf3
SHA512:	fb35b96d3153b13ec2cea3c243114b9e1c8a58ee391c94f44555a2d7c07137702a4230446f616373c0cf139695d3dcf8fcc9a55de778ad2112f6874011dad44d
SSDEEP:	12288:o/x3qU+ai4t0ZiB3s8K4fMP7zs5y8m6Zwjz2boW9zq1krmvkhog/6Fb7wqzwBSDE:mxR0i3s8qDww8m6ZcQq21ht6woDdEPf
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............0.................. ........@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Credentials in Registry
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Machine Learning detection for sample	AV Detection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
.NET source code contains very large array initializations	System Summary	Disable or Modify Tools
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)	Malware Analysis System Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Yara signature match	System Summary
Antivirus or Machine Learning detection for unpacked file	AV Detection
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Sample file is different than original file name gathered from version info	System Summary
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation Virtualization/Sandbox Evasion Security Software Discovery
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Sample is known by Antivirus	System Summary
Found malware configuration	AV Detection
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Uses an in-process (OLE) Automation server	System Summary
Queries process information (via WMI, Win32_Process)	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
SQL strings found in memory and binary data	System Summary
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
Reads the hosts file	System Summary	Remote System Discovery
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Checks if Microsoft Office is installed	System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe.log
Category:	dropped
Dump:	SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.355304211458859
Encrypted:	false
Ssdeep:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Microsoft Cabinet archive data, Windows 2000/XP setup, 62919 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression

dropped

Details

File:	C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Category:	dropped
Dump:	77EC63BDA74BD0D0E0426DC8F8008506.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 62919 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Entropy:	7.995280921994772
Encrypted:	true
Ssdeep:	1536:d+OfVxHl7Wyf11lYom3xQcRVOtPHwQV4rP6Ji7:d+OxHxJlZcuPt4b6q
Size:	62919
Whitelisted:	false
Reputation:	moderate

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

data

modified

Details

File:	C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Category:	modified
Dump:	77EC63BDA74BD0D0E0426DC8F80085060.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Type:	data
Entropy:	3.1085359935940406
Encrypted:	false
Ssdeep:	6:kKLTEN1HlNiN+SkQlPlEGYRMY9z+4KlDA3RUeKlTAlWRyf1:DTk/kPlE99SNxAhUexYo1
Size:	328
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe

Details

Is windows:	false
Is dropped:	false
PID:	4356
Target ID:	0
Parent PID:	3324
Name:	SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Size:	960000
MD5:	277A9CD8EF361888EB41A6B7D0D94E26
Time:	13:53:42
Date:	29/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x370000
Modulesize:	983040
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe

Details

Is windows:	false
Is dropped:	false
PID:	4596
Target ID:	1
Parent PID:	4356
Name:	SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe
Size:	960000
MD5:	277A9CD8EF361888EB41A6B7D0D94E26
Time:	13:53:56
Date:	29/11/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xc70000
Modulesize:	983040
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

http://127.0.0.1:HTTP/1.1

unknown

http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0

unknown

http://www.certplus.com/CRL/class3.crl0

unknown

http://www.e-me.lv/repository0

unknown

http://www.acabogacia.org/doc0

unknown

http://crl.chambersign.org/chambersroot.crl0

unknown

http://ocsp.suscerte.gob.ve0

unknown

http://www.postsignum.cz/crl/psrootqca2.crl02

unknown

http://crl.dhimyotis.com/certignarootca.crl0

unknown

http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0

unknown

http://www.chambersign.org1

unknown

http://www.pkioverheid.nl/policies/root-policy0

unknown

http://repository.swisssign.com/0

unknown

http://www.fontbureau.com/designers

unknown

http://www.suscerte.gob.ve/lcr0#

unknown

http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0

unknown

http://crl.ssc.lt/root-c/cacrl.crl0

unknown

http://postsignum.ttc.cz/crl/psrootqca2.crl0

unknown

http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl

unknown

http://ca.disig.sk/ca/crl/ca_disig.crl0

unknown

http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0

unknown

http://www.certplus.com/CRL/class3P.crl0

unknown

http://www.sajatypeworks.com

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.suscerte.gob.ve/dpc0

unknown

http://fhESbX.com

unknown

http://www.certplus.com/CRL/class2.crl0

unknown

http://www.disig.sk/ca/crl/ca_disig.crl0

unknown

http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05

unknown

http://www.defence.gov.au/pki0

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.sk.ee/cps/0

unknown

http://www.globaltrust.info0=

unknown

http://www.anf.es

unknown

http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09

unknown

http://www.urwpp.deDPlease

unknown

http://www.zhongyicts.com.cn

unknown

http://microsoft.coC?

unknown

http://pki.registradores.org/normativa/index.htm0

unknown

http://cps.root-x1.letsencrypt.org0

unknown

http://policy.camerfirma.com0

unknown

http://www.ssc.lt/cps03

unknown

http://ocsp.pki.gva.es0

unknown

http://www.anf.es/es/address-direccion.html

unknown

https://www.anf.es/address/)1(0&

unknown

http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?

unknown

http://www.tiro.coma-e

unknown

http://ca.mtin.es/mtin/ocsp0

unknown

http://cps.letsencrypt.org0

unknown

http://crl.ssc.lt/root-b/cacrl.crl0

unknown

http://web.ncdc.gov.sa/crl/nrcacomb1.crl0

unknown

http://www.certicamara.com/dpc/0Z

unknown

http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G

unknown

http://crl.pki.wellsfargo.com/wsprca.crl0

unknown

https://wwww.certigna.fr/autorites/0m

unknown

http://www.dnie.es/dpc0

unknown

http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0

unknown

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

unknown

http://mail2.bpk-spb.ru

unknown

http://ca.mtin.es/mtin/DPCyPoliticas0

unknown

https://www.anf.es/AC/ANFServerCA.crl0

unknown

http://www.globaltrust.info0

unknown

http://certificates.starfieldtech.com/repository/1604

unknown

http://acedicom.edicomgroup.com/doc0

unknown

http://www.certplus.com/CRL/class3TS.crl0

unknown

https://crl.anf.es/AC/ANFServerCA.crl0

unknown

http://www.carterandcone.coml

unknown

http://ac.economia.gob.mx/last.crl0G

unknown

http://www.fontbureau.com/designers/frere-jones.html

unknown

https://www.catcert.net/verarrel

unknown

http://www.disig.sk/ca0f

unknown

http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0

unknown

http://www.e-szigno.hu/RootCA.crl

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportSecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe

Files

Processes

URLs

IOC Report
SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe