Windows Analysis Report
MaxPatrol SIEM Agent.exe

Overview

General Information

Sample name: MaxPatrol SIEM Agent.exe
Analysis ID: 1448268
MD5: 2c016c91181d4182a16845725bf0b315
SHA1: 2be016b6b0dd9d57f2985a6ad0df85f5538d9623
SHA256: 4d30fd05c3bdac792e0a011892e2cad02818436484e81b6de6a02928149bc92d
Tags: exe
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Detected potential crypto function
PE file contains sections with non-standard names
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: MaxPatrol SIEM Agent.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: MaxPatrol SIEM Agent.exe Virustotal: Detection: 55% Perma Link
Source: MaxPatrol SIEM Agent.exe ReversingLabs: Detection: 55%
Source: MaxPatrol SIEM Agent.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: mp0.ignorelist.com replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: mp0.ignorelist.com
Detected potential crypto function
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Code function: 0_2_00007FF6A8471000 0_2_00007FF6A8471000
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Code function: 0_2_00007FF6A84720F0 0_2_00007FF6A84720F0
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Code function: 0_2_00007FF6A8471D60 0_2_00007FF6A8471D60
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Code function: 0_2_00007FF6A8471EE0 0_2_00007FF6A8471EE0
Source: classification engine Classification label: mal56.winEXE@1/0@3/0
Source: MaxPatrol SIEM Agent.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: MaxPatrol SIEM Agent.exe Virustotal: Detection: 55%
Source: MaxPatrol SIEM Agent.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe Section loaded: rasadhlp.dll Jump to behavior
Source: MaxPatrol SIEM Agent.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: MaxPatrol SIEM Agent.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
PE file contains sections with non-standard names
Source: MaxPatrol SIEM Agent.exe Static PE information: section name: .xdata
Source: MaxPatrol SIEM Agent.exe, 00000000.00000002.2970544707.0000024B5530C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\MaxPatrol SIEM Agent.exe API call chain: ExitProcess graph end node
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1448268 Sample: MaxPatrol SIEM Agent.exe Startdate: 28/05/2024 Architecture: WINDOWS Score: 56 8 mp0.ignorelist.com 2->8 10 Antivirus / Scanner detection for submitted sample 2->10 12 Multi AV Scanner detection for submitted file 2->12 6 MaxPatrol SIEM Agent.exe 2->6         started        signatures3 process4
⊘No contacted IP infos

Contacted Domains

Name IP Active
mp0.ignorelist.com unknown unknown