Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.Trojan.LoadMoney.1085.10205.7276.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.425136010677569
Filename:	SecuriteInfo.com.Trojan.LoadMoney.1085.10205.7276.exe
Filesize:	386048
MD5:	98cc7dd8eeeaf079b8e8f650d847525f
SHA1:	2f8bdb79155ce50f7b02209cd28f996fc9e62915
SHA256:	5b9cb6ebd3779665272eb9303004faf88f121cbe8f7e63c00a547e6d9ae13998
SHA512:	24de92368cf508ac40db171f891075c67a90d71fa9febefc8cce4218c4d248870dcca240347e7bfc39b66a52477c3b0b9b9cd0fe478fafd226ce092147b2a92f
SSDEEP:	6144:4i4TBXZh3Am19Lk/8LS35qQkOLwfFGIMcPayeMlTDIeuhDF28VBUJpEzubg66:4isBXZh3Amr4/8YN9Lw4izIeuhDF28Vh
Preview:	MZ......................@...`r...................r......................!..L.!This program cannot be run in DOS mode....$.........L..u"..u"..u"......u"......u".....lu"...O..u"...Y..u"..u#..t"......u"......u"......u".Rich.u"...?.....PE..L...X..V...........

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Contain functionality to detect virtual machines	Malware Analysis System Evasion	Access Token Manipulation
Machine Learning detection for sample	AV Detection
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion Security Software Discovery
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to detect sandboxes (mouse cursor move detection)	Malware Analysis System Evasion
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Detected potential crypto function	System Summary	Access Token Manipulation Process Discovery Archive Collected Data Encrypted Channel
Found evasive API chain (may stop execution after checking a module file name)	Malware Analysis System Evasion	Access Token Manipulation
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
One or more processes crash	System Summary
PE file contains an invalid checksum	Data Obfuscation	File and Directory Discovery
Uses 32bit PE files	Compliance, System Summary
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Might use command line arguments	System Summary
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample might require command line arguments	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ec24384a58645712a8216dd34a3884cb9132512_265dce86_e1f415c1-83d4-44dc-a094-cc48ee5b9763\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ec24384a58645712a8216dd34a3884cb9132512_265dce86_e1f415c1-83d4-44dc-a094-cc48ee5b9763\Report.wer
Category:	dropped
Dump:	Report.wer.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.8728362306142596
Encrypted:	false
Ssdeep:	96:rvUFsM5fKs8huzFXefhQXIDcQvc6QcEVcw3cE/f+HbHgnoW6HeE7snL9tjo2fn2l:r8dRKqt0BU/4jnZrsMqzuiFIZ24IO8u
Size:	65536
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAC8.tmp.dmp

Mini DuMP crash report, 14 streams, Wed May 22 23:31:38 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAC8.tmp.dmp
Category:	dropped
Dump:	WERDAC8.tmp.dmp.4.dr
ID:	dr_0
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Wed May 22 23:31:38 2024, 0x1205a4 type
Entropy:	2.007609435064957
Encrypted:	false
Ssdeep:	192:EdJrAMbZyB+mKOUOW77zmIwm/ggziWg8MvBFVq1XOqaOZn20:OJrrNMjXSzqMZM5FAOqa+
Size:	36800
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB46.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB46.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WERDB46.tmp.WERInternalMetadata.xml.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.7035225480837717
Encrypted:	false
Ssdeep:	192:R6l7wVeJCv6sr6YWfSU9Dfgmfk0SLprw89bDYsfjhm:R6lXJi6sr6YuSU9Dfgmfk0SLDLf4
Size:	8464
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB95.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB95.tmp.xml
Category:	dropped
Dump:	WERDB95.tmp.xml.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.561588191050228
Encrypted:	false
Ssdeep:	48:cvIwWl8zsoNJg77aI9mrVWpW8VY+Ym8M4JROA9FTL3P+q82P+5YDY2d:uIjfMI7oI7VSJzkSs2d
Size:	4790
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.295922598257211
Encrypted:	false
Ssdeep:	6144:441fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+HGmBMZJh1VjF:11/YCW2AoQ0NiBGwMHrVZ
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.Trojan.LoadMoney.1085.10205.7276.exe

"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.LoadMoney.1085.10205.7276.exe"

Details

Is windows:	false
Is dropped:	false
PID:	3076
Target ID:	0
Parent PID:	3968
Name:	SecuriteInfo.com.Trojan.LoadMoney.1085.10205.7276.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.LoadMoney.1085.10205.7276.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.LoadMoney.1085.10205.7276.exe"
Size:	386048
MD5:	98CC7DD8EEEAF079B8E8F650D847525F
Time:	19:31:37
Date:	22/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	540672
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE file contains an invalid checksum	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 488

Details

Is windows:	true
Is dropped:	false
PID:	4456
Target ID:	4
Parent PID:	3076
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 488
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	19:31:37
Date:	22/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x520000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://upx.sf.net

unknown