Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive

initial sample

C:\Program Files (x86)\PrintFolders\Russian.dll (copy)

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\PrintFolders\is-K96P8.tmp

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\PrintFolders\is-RBTTG.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\PrintFolders\ntFolders.exe

PE32 executable (GUI) Intel 80386, for MS Windows

modified

C:\Program Files (x86)\PrintFolders\unins000.exe (copy)

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\is-2JDIE.tmp\is-I19BM.tmp

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\is-SBKH0.tmp\_iscrypt.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\is-SBKH0.tmp\_isetup\_setup64.tmp

PE32+ executable (console) x86-64, for MS Windows

dropped

C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\karcA17.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\PrintFolders\Guide.chm (copy)

MS Windows HtmlHelp Data

dropped

C:\Program Files (x86)\PrintFolders\History.txt (copy)

ASCII text, with CRLF line terminators

dropped

C:\Program Files (x86)\PrintFolders\License.txt (copy)

RAGE Package Format (RPF),

dropped

C:\Program Files (x86)\PrintFolders\is-E7A00.tmp

data

dropped

C:\Program Files (x86)\PrintFolders\is-F5ERM.tmp

MS Windows HtmlHelp Data

dropped

C:\Program Files (x86)\PrintFolders\is-HN0H8.tmp

RAGE Package Format (RPF),

dropped

C:\Program Files (x86)\PrintFolders\is-VTV62.tmp

ASCII text, with CRLF line terminators

dropped

C:\Program Files (x86)\PrintFolders\unins000.dat

InnoSetup Log PrintFolders {3C248D7A-78F2-476F-86FF-34610A9B2E85}, version 0x2a, 3804 bytes, 320366\user, "C:\Program Files (x86)\PrintFolders"

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\count[1].htm

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fuckingdllENCR[1].dll

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\library[1].htm

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ping[1].htm

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\library[1].htm

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Temp\is-SBKH0.tmp\_isetup\_shfoldr.dll

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

dropped

There are 14 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files (x86)\PrintFolders\ntFolders.exe

"C:\Program Files (x86)\PrintFolders\ntFolders.exe"

Details

Is windows:	false
Is dropped:	true
PID:	4824
Target ID:	2
Parent PID:	5936
Name:	ntFolders.exe
Class:	system-tools
Path:	C:\Program Files (x86)\PrintFolders\ntFolders.exe
Commandline:	"C:\Program Files (x86)\PrintFolders\ntFolders.exe"
Size:	3602504
MD5:	D9A39F6C4EEDC8F1B89E30D35012D6B4
Time:	11:02:09
Date:	09/12/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	18284544
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Yara detected Nymaim	E-Banking Fraud, Stealing of Sensitive Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Uses taskkill to terminate processes	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Queries process information (via WMI, Win32_Process)	System Summary	System Information Discovery Windows Management Instrumentation
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\karcA17.exe

Details

Is windows:	false
Is dropped:	true
PID:	412
Target ID:	3
Parent PID:	4824
Name:	karcA17.exe
Path:	C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\karcA17.exe
Commandline:
Size:	73728
MD5:	3FB36CB0B7172E5298D2992D42984D06
Time:	11:02:13
Date:	09/12/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x11d0000
Modulesize:	90112
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Spawns processes	System Summary	Process Injection

C:\Users\user\Desktop\file.exe

Details

Is windows:	false
Is dropped:	false
PID:	3748
Target ID:	0
Parent PID:	3528
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	C:\Users\user\Desktop\file.exe
Size:	2460138
MD5:	71F3A21CCD6E54F8178D3FB65F4849B9
Time:	11:02:06
Date:	09/12/2022
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	122880
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\is-2JDIE.tmp\is-I19BM.tmp

"C:\Users\user\AppData\Local\Temp\is-2JDIE.tmp\is-I19BM.tmp" /SL4 $30366 "C:\Users\user\Desktop\file.exe" 2214542 96256

Details

Is windows:	false
Is dropped:	true
PID:	5936
Target ID:	1
Parent PID:	3748
Name:	is-I19BM.tmp
Path:	C:\Users\user\AppData\Local\Temp\is-2JDIE.tmp\is-I19BM.tmp
Commandline:	"C:\Users\user\AppData\Local\Temp\is-2JDIE.tmp\is-I19BM.tmp" /SL4 $30366 "C:\Users\user\Desktop\file.exe" 2214542 96256
Size:	704000
MD5:	2C3832FDF847813369EC960CD39C8265
Time:	11:02:07
Date:	09/12/2022
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	892928
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Enumerates the file system	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /im "ntFolders.exe" /f & erase "C:\Program Files (x86)\PrintFolders\ntFolders.exe" & exit

Details

Is windows:	true
Is dropped:	false
PID:	5776
Target ID:	4
Parent PID:	4824
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "ntFolders.exe" /f & erase "C:\Program Files (x86)\PrintFolders\ntFolders.exe" & exit
Size:	232960
MD5:	F3BDBE3BB6F734E357235F4D5898582D
Time:	11:02:47
Date:	09/12/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xd90000
Modulesize:	364544
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4212
Target ID:	5
Parent PID:	5776
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	11:02:47
Date:	09/12/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7c72c0000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\taskkill.exe

taskkill /im "ntFolders.exe" /f

Details

Is windows:	true
Is dropped:	false
PID:	5920
Target ID:	6
Parent PID:	5776
Name:	taskkill.exe
Path:	C:\Windows\SysWOW64\taskkill.exe
Commandline:	taskkill /im "ntFolders.exe" /f
Size:	74752
MD5:	15E2E0ACD891510C6268CB8899F2A1A1
Time:	11:02:47
Date:	09/12/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13d0000
Modulesize:	86016
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses taskkill to terminate processes	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://171.22.30.106/library.phpH

unknown

http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte

45.139.105.171

http://107.182.129.235/storage/ping.php

107.182.129.235

http://171.22.30.106/library.php

171.22.30.106

http://107.182.129.235/storage/extension.php

107.182.129.235

http://www.innosetup.com/

unknown

http://www.remobjects.com/?ps

unknown

http://www.innosetup.com

unknown

http://www.innosetup.comDVarFileInfo$

unknown

http://www.remobjects.com/?psU

unknown

IPs

Domain

Country

Malicious

45.139.105.171

unknown

Italy

Details

IP:	45.139.105.171
TargetID:	2
Current Path:	C:\Program Files (x86)\PrintFolders\ntFolders.exe
Country:	Italy
Countrycode:	ITA
ASN number:	33657
ASN name:	CMCSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

45.139.105.1

unknown

Italy

Details

IP:	45.139.105.1
TargetID:	255
Country:	Italy
Countrycode:	ITA
ASN number:	33657
ASN name:	CMCSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
IP address seen in connection with other malware	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found malware configuration	AV Detection
URLs found in memory or binary data	Networking

85.31.46.167

unknown

Germany

Details

IP:	85.31.46.167
TargetID:	255
Country:	Germany
Countrycode:	DEU
ASN number:	43659
ASN name:	CLOUDCOMPUTINGDE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Found malware configuration	AV Detection

107.182.129.235

unknown

Reserved

Details

IP:	107.182.129.235
TargetID:	2
Current Path:	C:\Program Files (x86)\PrintFolders\ntFolders.exe
Country:	Reserved
Countrycode:	ZZZ
ASN number:	11070
ASN name:	META-ASUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found malware configuration	AV Detection
URLs found in memory or binary data	Networking

171.22.30.106

unknown

Germany

Details

IP:	171.22.30.106
TargetID:	2
Current Path:	C:\Program Files (x86)\PrintFolders\ntFolders.exe
Country:	Germany
Countrycode:	DEU
ASN number:	33657
ASN name:	CMCSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found malware configuration	AV Detection
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Audpoint Software\PrintFolders

Language