Edit tour
Windows
Analysis Report
[V2]launcher.exe
Overview
General Information
Detection
PureLog Stealer, RedLine, Xmrig
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Sigma detected: Set autostart key via New-ItemProperty Cmdlet
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected Xmrig cryptocurrency miner
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Contains functionality to capture screen (.Net source)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Drops PE files with benign system names
Drops password protected ZIP file
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: System File Execution Location Anomaly
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates driver files
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops certificate files (DER)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check if the current machine is a sandbox (GetTickCount - Sleep)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
- [V2]launcher.exe (PID: 7484 cmdline:
"C:\Users\ user\Deskt op\[V2]lau ncher.exe" MD5: 22CEE31B95CB8B6A767419A460AAAEB0) - conhost.exe (PID: 7500 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 7584 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - conhost.exe (PID: 8076 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\conhos t.exe" MD5: 8340B7602E82921AA8D72AE4F8EA11CC) - cmd.exe (PID: 8168 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \Temp\main \main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8176 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - mode.com (PID: 5604 cmdline:
mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875) - 7z.exe (PID: 4920 cmdline:
7z.exe e f ile.zip -p 1463128911 2511617137 1883110193 -oextract ed MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 1144 cmdline:
7z.exe e e xtracted/f ile_2.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 5636 cmdline:
7z.exe e e xtracted/f ile_1.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - attrib.exe (PID: 6000 cmdline:
attrib +H "Installer .exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD) - Installer.exe (PID: 7376 cmdline:
"Installer .exe" MD5: 6141FCD89A442521FABADA983B07696A) - RegSvcs.exe (PID: 7008 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Svcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94) - cmd.exe (PID: 1556 cmdline:
"cmd.exe" /C powersh ell -Encod edCommand "PAAjADEAU wBuAFQATQA jAD4AIABBA GQAZAAtAE0 AcABQAHIAZ QBmAGUAcgB lAG4AYwBlA CAAPAAjAFo ATgBFAHQAc ABSAFUAIwA +ACAALQBFA HgAYwBsAHU AcwBpAG8Ab gBQAGEAdAB oACAAQAAoA CQAZQBuAHY AOgBVAHMAZ QByAFAAcgB vAGYAaQBsA GUALAAkAGU AbgB2ADoAU wB5AHMAdAB lAG0ARAByA GkAdgBlACk AIAA8ACMAb wBWAHcAVAB IAEcAYQBSA DkAIwA+ACA ALQBGAG8Ac gBjAGUAIAA 8ACMAVwBtA EQAWgAjAD4 A" & power cfg /x -hi bernate-ti meout-ac 0 & powercf g /x -hibe rnate-time out-dc 0 & powercfg /x -standb y-timeout- ac 0 & pow ercfg /x - standby-ti meout-dc 0 & powercf g /hiberna te off MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 3492 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 2072 cmdline:
powershell -EncodedC ommand "PA AjADEAUwBu AFQATQAjAD 4AIABBAGQA ZAAtAE0AcA BQAHIAZQBm AGUAcgBlAG 4AYwBlACAA PAAjAFoATg BFAHQAcABS AFUAIwA+AC AALQBFAHgA YwBsAHUAcw BpAG8AbgBQ AGEAdABoAC AAQAAoACQA ZQBuAHYAOg BVAHMAZQBy AFAAcgBvAG YAaQBsAGUA LAAkAGUAbg B2ADoAUwB5 AHMAdABlAG 0ARAByAGkA dgBlACkAIA A8ACMAbwBW AHcAVABIAE cAYQBSADkA IwA+ACAALQ BGAG8AcgBj AGUAIAA8AC MAVwBtAEQA WgAjAD4A" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - WmiPrvSE.exe (PID: 3252 cmdline:
C:\Windows \system32\ wbem\wmipr vse.exe -s ecured -Em bedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51) - cmd.exe (PID: 3360 cmdline:
"cmd.exe" /c SCHTASK S /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\P rogramData \Dllhost\d llhost.exe " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 3004 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 3240 cmdline:
SCHTASKS / CREATE /SC MINUTE /M O 5 /TN "d llhost" /T R "C:\Prog ramData\Dl lhost\dllh ost.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - cmd.exe (PID: 3124 cmdline:
"cmd.exe" /c SCHTASK S /CREATE /SC HOURLY /TN "NvSt ray\NvStra yService_b k9052" /TR "C:\Progr amData\Dll host\dllho st.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 3128 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 4316 cmdline:
SCHTASKS / CREATE /SC HOURLY /T N "NvStray \NvStraySe rvice_bk90 52" /TR "C :\ProgramD ata\Dllhos t\dllhost. exe" MD5: 48C2FE20575769DE916F48EF0676A965) - svchost.exe (PID: 5684 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\svchos t.exe" MD5: 45D20D471E6F3F8F088D489D62058F23) - RegSvcs.exe (PID: 3104 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegS vcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94) - RegSvcs.exe (PID: 7544 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegS vcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94) - powershell.exe (PID: 7572 cmdline:
"powershel l.exe" Rem ove -ItemP roperty -P ath 'HKCU: \SOFTWARE\ Microsoft\ Windows\Cu rrentVersi on\Run' -N ame 'kwwei fjdskdv';N ew-ItemPro perty -Pat h 'HKCU:\S OFTWARE\Mi crosoft\Wi ndows\Curr entVersion \Run' -Nam e 'kwweifj dskdv' -Va lue '"C:\U sers\user\ AppData\Lo cal\kwweif jdskdv\kww eifjdskdv. exe"' -Pro pertyType 'String' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 7476 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- kwweifjdskdv.exe (PID: 2168 cmdline:
"C:\Users\ user\AppDa ta\Local\k wweifjdskd v\kwweifjd skdv.exe" MD5: 45D20D471E6F3F8F088D489D62058F23) - RegSvcs.exe (PID: 4248 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegS vcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)
- kwweifjdskdv.exe (PID: 3132 cmdline:
"C:\Users\ user\AppDa ta\Local\k wweifjdskd v\kwweifjd skdv.exe" MD5: 45D20D471E6F3F8F088D489D62058F23) - RegSvcs.exe (PID: 7028 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegS vcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94) - RegSvcs.exe (PID: 6196 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegS vcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
RedLine Stealer | RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
xmrig | According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. | No Attribution |
{"C2 url": "45.15.156.167:80", "Bot Id": "@Felnan32007", "Message": "Click Close to exit the program. Error code: 1142", "Authorization Header": "0ae475e4f6f75a77f9fb6d9031577e2c"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
MacOS_Cryptominer_Xmrig_241780a1 | unknown | unknown |
| |
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse | Detects file containing reversed ASEP Autorun registry keys | ditekSHen |
| |
JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
Click to see the 15 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
JoeSecurity_RedLine | Yara detected RedLine Stealer | Joe Security | ||
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
Click to see the 3 entries |
System Summary |
---|
Source: | Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): |
Source: | Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: |
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
Source: | Author: frack113: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Source: | Author: vburov: |
Persistence and Installation Behavior |
---|
Source: | Author: Joe Security: |
Source: | Author: Joe Security: |
Timestamp: | 05/01/24-20:09:02.242669 |
SID: | 2043234 |
Source Port: | 80 |
Destination Port: | 49706 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/01/24-20:09:01.963097 |
SID: | 2046045 |
Source Port: | 49706 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/01/24-20:09:13.588930 |
SID: | 2043231 |
Source Port: | 49706 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | URL Reputation: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | ReversingLabs: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: |
Source: | Code function: | 12_2_6AE3DBB0 | |
Source: | Code function: | 12_2_6AE3D9D0 | |
Source: | Code function: | 12_2_6AE3DEE0 | |
Source: | Code function: | 12_2_6AE3DE00 | |
Source: | Code function: | 12_2_6AE3DD20 | |
Source: | Code function: | 12_2_6AE3D7F0 | |
Source: | Code function: | 12_2_6AE3D7D3 | |
Source: | Code function: | 12_2_6AE635E0 |
Bitcoin Miner |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | Static PE information: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 7_2_004031DC | |
Source: | Code function: | 7_2_0040367D | |
Source: | Code function: | 11_2_00D97978 | |
Source: | Code function: | 16_2_000DA151 |
Source: | Code function: | 11_2_00D9881C |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Code function: | 3_2_06DBCA40 | |
Source: | Code function: | 3_2_06DBB230 | |
Source: | Code function: | 3_2_06DBB9FA | |
Source: | Code function: | 3_2_06DB3E50 | |
Source: | Code function: | 3_2_06DBEFF9 | |
Source: | Code function: | 12_2_05F2D1A0 | |
Source: | Code function: | 12_2_05F2D7C0 | |
Source: | Code function: | 12_2_05F2D8D0 | |
Source: | Code function: | 12_2_05F2D2B0 | |
Source: | Code function: | 21_2_00EA4668 | |
Source: | Code function: | 33_2_0190CF88 | |
Source: | Code function: | 33_2_0190D5A8 | |
Source: | Code function: | 33_2_0190D098 | |
Source: | Code function: | 33_2_0190D6B8 | |
Source: | Code function: | 37_2_0123CF88 | |
Source: | Code function: | 37_2_0123D5A8 | |
Source: | Code function: | 37_2_0123D098 | |
Source: | Code function: | 37_2_0123D6B8 |
Networking |
---|
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | URLs: |
Source: | DNS query: |
Source: | Code function: | 16_2_000D1280 |
Source: | HTTP traffic detected: |