Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

3Ja0hSOMSI.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.500078707004594
Filename:	3Ja0hSOMSI.exe
Filesize:	433152
MD5:	f95cbb58bc3cd23d1193f4a5a968f481
SHA1:	3bfbc7566b6d76ec2b0b577bc3447ed3f9bfe181
SHA256:	b26380b0e977fdb0d90f92963404163654aa39de3b43f8cab311b97eca3661f4
SHA512:	d8f4971c53f0b7513a52b57a916dac335d90a26c5c9dde601fad4713ea64e1b27c8fa0a5e73c2c074fb4a182698ac0b8903554983e6ded63c737ad5a89366547
SSDEEP:	12288:XpvhuwxAzkpbwoiqiNBN6uZeV8rUUrVx640:ZvhuwxIkR5iV+Urrj0
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Found stalling execution ending in API Sleep call	Malware Analysis System Evasion
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Detected potential crypto function	System Summary	Archive Collected Data
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
PE file contains sections with non-standard names	Data Obfuscation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API System Information Discovery
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality to download additional files from the internet	Networking
Contains functionality to instantiate COM classes	System Summary
Contains functionality to modify the execution of threads in other processes
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates mutexes	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

Chrome Cache Entry: 56

ASCII text, with very long lines (1746)

downloaded

Details

File:	Chrome Cache Entry: 56
Category:	downloaded
Dump:	chromecache_56.4.dr
ID:	dr_7
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (1746)
Entropy:	5.55061820245277
Encrypted:	false
Ssdeep:	3072:S0eiNiuzs8v4HHKWY8s1BgP4IDQ9GURWu8zylA/u8PemUPhDlaY/ADiZ65LpK629:S0eMhzvwHHKWY8s1BgP4IDQ9GURWu8UD
Size:	163891
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 57

ASCII text, with very long lines (785)

downloaded

Details

File:	Chrome Cache Entry: 57
Category:	downloaded
Dump:	chromecache_57.4.dr
ID:	dr_8
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (785)
Entropy:	5.147420404667014
Encrypted:	false
Ssdeep:	24:0UeLhckxgwxNBHslgT9lCuABuoB7HHHHHHHYqmffffffo:0UeLhckxHKlgZ01BuSEqmffffffo
Size:	790
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 58

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 58
Category:	downloaded
Dump:	chromecache_58.4.dr
ID:	dr_9
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	3.9353986674667634
Encrypted:	false
Ssdeep:	3:VQAOx/1n:VQAOd1n
Size:	29
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 59

ASCII text, with very long lines (65531)

downloaded

Details

File:	Chrome Cache Entry: 59
Category:	downloaded
Dump:	chromecache_59.4.dr
ID:	dr_10
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (65531)
Entropy:	5.440931472959379
Encrypted:	false
Ssdeep:	1536:yMRA4aVKJXjPInWWt/usD98kiHLnRA0zqevcZCMhaV+trbbbhYxvdU:eTKJou8TMyec0shCO
Size:	139820
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 60

ASCII text, with very long lines (3572), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 60
Category:	downloaded
Dump:	chromecache_60.4.dr
ID:	dr_11
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (3572), with no line terminators
Entropy:	5.150542995862274
Encrypted:	false
Ssdeep:	96:RJYrcoiktfqqMghOKTEzNx8BSIMw591g8IOl8u8i8DF+Ks:wkktfqqMghxlg8Ig8u78D2
Size:	3572
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 61

SVG Scalable Vector Graphics image

downloaded

Details

File:	Chrome Cache Entry: 61
Category:	downloaded
Dump:	chromecache_61.4.dr
ID:	dr_12
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	SVG Scalable Vector Graphics image
Entropy:	4.301517070642596
Encrypted:	false
Ssdeep:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
Size:	1660
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 62

ASCII text, with very long lines (2124)

downloaded

Details

File:	Chrome Cache Entry: 62
Category:	downloaded
Dump:	chromecache_62.4.dr
ID:	dr_13
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (2124)
Entropy:	5.506662476672723
Encrypted:	false
Ssdeep:	3072:QI9yvwslCsrCF9f/U2Dj3Fkk7rEehA5L1kx:l9ygsrieDkVaL1kx
Size:	121628
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\3Ja0hSOMSI.exe

"C:\Users\user\Desktop\3Ja0hSOMSI.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7524
Target ID:	0
Parent PID:	2580
Name:	3Ja0hSOMSI.exe
Path:	C:\Users\user\Desktop\3Ja0hSOMSI.exe
Commandline:	"C:\Users\user\Desktop\3Ja0hSOMSI.exe"
Size:	433152
MD5:	F95CBB58BC3CD23D1193F4A5A968F481
Time:	10:39:52
Date:	28/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x6c0000
Modulesize:	454656
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Amadeys stealer DLL	Stealing of Sensitive Information
Machine Learning detection for sample	AV Detection
PE file contains sections with non-standard names	Data Obfuscation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///

Details

Is windows:	true
Is dropped:	false
PID:	7636
Target ID:	1
Parent PID:	3732
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:39:58
Date:	28/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///

Details

Is windows:	true
Is dropped:	false
PID:	7660
Target ID:	2
Parent PID:	3732
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:39:58
Date:	28/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1892,i,11750094988514912894,15588692437141461432,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7964
Target ID:	4
Parent PID:	7636
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1892,i,11750094988514912894,15588692437141461432,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:39:58
Date:	28/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1972,i,3591871434069576445,16780255488276445191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	8088
Target ID:	5
Parent PID:	7660
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1972,i,3591871434069576445,16780255488276445191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:39:58
Date:	28/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://kindofwelcomeperspective.com/8BvxwQdec3/index.php

193.176.158.193

kindofwelcomeperspective.com/8BvxwQdec3/index.php

http://kindofwelcomeperspective.com/8BvxwQdec3/index.php56789

unknown

http://kindofwelcomeperspective.com/8BvxwQdec3/index.php)

unknown

http://www.broofa.com

unknown

http://kindofwelcomeperspective.com/8BvxwQdec3/index.php4

unknown

http://kindofwelcomeperspective.com/8BvxwQdec3/index.phpt

unknown

https://www.google.com/async/newtab_promos

172.253.122.104

https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1

unknown

http://kindofwelcomeperspective.com/8BvxwQdec3/index.phpD

unknown

https://plus.google.com

unknown

https://www.google.com/async/ddljson?async=ntp:2

172.253.122.104

https://play.google.com/log?format=json&hasfast=true

unknown

https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw

172.253.122.104

https://csp.withgoogle.com/csp/lcreport/

unknown

http://kindofwelcomeperspective.com/8BvxwQdec3/index.php32

unknown

http://kindofwelcomeperspective.com/8BvxwQdec3/index.phpT

unknown

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0

142.250.31.113

https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

172.253.122.104

http://kindofwelcomeperspective.com/8BvxwQdec3/index.phpgs$

unknown

https://apis.google.com

unknown

https://domains.google.com/suggest/flow

unknown

http://kindofwelcomeperspective.com/8BvxwQdec3/index.php$

unknown

http://kindofwelcomeperspective.com/8BvxwQdec3/index.phpd

unknown

https://clients6.google.com

unknown

There are 15 hidden URLs, click here to show them.

Domains

Name

Malicious

kindofwelcomeperspective.com

193.176.158.193

Details

Name:	kindofwelcomeperspective.com
IP:	193.176.158.193
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection
HTTP GET or POST without a user agent	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

plus.l.google.com

142.250.31.113

www.google.com

172.253.122.104

Details

Name:	www.google.com
IP:	172.253.122.104
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

apis.google.com

unknown

Details

Name:	apis.google.com
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

192.168.2.4

unknown

193.176.158.193

kindofwelcomeperspective.com

unknown

Details

IP:	193.176.158.193
TargetID:	0
Current Path:	C:\Users\user\Desktop\3Ja0hSOMSI.exe
ASN number:	207451
ASN name:	AGROSVITUA
Private:	false
Domain:	kindofwelcomeperspective.com

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking

172.253.122.104

www.google.com

United States

142.250.31.113

plus.l.google.com

United States

142.251.16.147

unknown

United States

239.255.255.250

unknown

Reserved

Memdumps

Base Address

Regiontype

Protect

Malicious

6C1000

unkown

page execute read

6C1000

unkown

page execute read

6C0000

unkown

page readonly

336D000

stack

page read and write

312D000

stack

page read and write

E43000

heap

page read and write

C35000

heap

page read and write

722000

unkown

page read and write

C30000

heap

page read and write

725000

unkown

page read and write

C0E000

stack

page read and write

DEA000

heap

page read and write

FDF000

stack

page read and write

30EF000

stack

page read and write

D3F000

stack

page read and write

DEE000

heap

page read and write

2DAF000

stack

page read and write

34AD000

stack

page read and write

722000

unkown

page write copy

72D000

unkown

page write copy

710000

unkown

page readonly

DE0000

heap

page read and write

AFD000

stack

page read and write

790000

heap

page read and write

7DE000

stack

page read and write

326D000

stack

page read and write

727000

unkown

page readonly

D7C000

stack

page read and write

724000

unkown

page write copy

710000

unkown

page readonly

10C0000

heap

page read and write

E36000

heap

page read and write

72D000

unkown

page write copy

101E000

stack

page read and write

322C000

stack

page read and write

33AD000

stack

page read and write

C10000

heap

page read and write

2FEE000

stack

page read and write

E4F000

heap

page read and write

780000

heap

page read and write

727000

unkown

page readonly

6AC000

stack

page read and write

6C0000

unkown

page readonly

E58000

heap

page read and write

296B000

stack

page read and write

There are 35 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
3Ja0hSOMSI.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report3Ja0hSOMSI.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
3Ja0hSOMSI.exe