Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

tGm4SuP0sz.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.838685509247705
Filename:	tGm4SuP0sz.exe
Filesize:	1609728
MD5:	cabeb02d14a76418addc20a3943681c8
SHA1:	7a059897e5f686c9421c772e88d60ab5239b22d2
SHA256:	42dcacc7a076e1496d9650cf3fed897e3267577cf23fa47cf8591e508984cbbc
SHA512:	779ec01582eb539ad2c3c7ec8ef0f14fa2a7a072cecd82cecbaae14c66e0e3a52fe510b1dc56d4e1ccff9e033349bde0e5145c90592247dd9b086c47a62b0865
SSDEEP:	24576:PR0v48o9Tlzo+dJZujavgJSLZbM1S9ZhbrqyJ8pL4Fqgmpp/H1fmPOpz:y52TC8ZoI9Z9rqyI44Hpptflpz
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.xf................................. ........@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion	Clipboard Data
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell
Machine Learning detection for sample	AV Detection
PE file contains section with special chars	System Summary	Clipboard Data
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	System Information Discovery
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	File and Directory Discovery
PE file contains sections with non-standard names	Data Obfuscation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to modify the execution of threads in other processes
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tGm4SuP0sz.exe.log

CSV text

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tGm4SuP0sz.exe.log
Category:	dropped
Dump:	tGm4SuP0sz.exe.log.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\tGm4SuP0sz.exe
Type:	CSV text
Entropy:	5.360398796477698
Encrypted:	false
Ssdeep:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
Size:	226
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Machine Learning detection for sample	AV Detection
PE file contains section with special chars	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Roaming\d3d9.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\d3d9.dll
Category:	dropped
Dump:	d3d9.dll.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\tGm4SuP0sz.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	7.042134864297343
Encrypted:	false
Ssdeep:	6144:U92QoqVJjjpW8zZIfTkVtrhprdkBvxa/kWrPS5oKOh/C+ro2DvR86O/TpSr:U7JjjbBtPkoFpVro2l8X0r
Size:	428544
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Machine Learning detection for dropped file	AV Detection
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\tGm4SuP0sz.exe

"C:\Users\user\Desktop\tGm4SuP0sz.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7340
Target ID:	0
Parent PID:	4084
Name:	tGm4SuP0sz.exe
Path:	C:\Users\user\Desktop\tGm4SuP0sz.exe
Commandline:	"C:\Users\user\Desktop\tGm4SuP0sz.exe"
Size:	1609728
MD5:	CABEB02D14A76418ADDC20A3943681C8
Time:	09:56:51
Date:	01/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xe90000
Modulesize:	1638400
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Machine Learning detection for sample	AV Detection
PE file contains section with special chars	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file contains a COM descriptor data directory	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7440
Target ID:	3
Parent PID:	7340
Name:	aspnet_regiis.exe
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Size:	43016
MD5:	5D1D74198D75640E889F0A577BBF31FC
Time:	09:56:52
Date:	01/07/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xca0000
Modulesize:	49152
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7356
Target ID:	2
Parent PID:	7340
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	09:56:52
Date:	01/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6ee680000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

justifycanddidatewd.shop

employeedscratshj.shop

marathonbeedksow.shop

pleasurenarrowsdla.shop

richardflorespoew.shop

falseaudiencekd.shop

feighminoritsjda.shop

strwawrunnygjwu.shop

raiseboltskdlwpow.shop

https://pleasurenarrowsdla.shop/

unknown

https://richardflorespoew.shop/apii

unknown

https://feighminoritsjda.shop/api1

unknown

https://falseaudiencekd.shop/api

unknown

https://richardflorespoew.shop/apiy

unknown

https://richardflorespoew.shop/api7

unknown

https://strwawrunnygjwu.shop//l

unknown

https://richardflorespoew.shop/api

unknown

https://justifycanddidatewd.shop/

unknown

https://pleasurenarrowsdla.shop/api?

unknown

https://raiseboltskdlwpow.shop/B

unknown

https://employeedscratshj.shop/api

unknown

https://richardflorespoew.shop/0

unknown

https://richardflorespoew.shop/

unknown

https://strwawrunnygjwu.shop/api

unknown

https://richardflorespoew.shop/g

unknown

https://justifycanddidatewd.shop/api

unknown

https://feighminoritsjda.shop/apiK

unknown

There are 17 hidden URLs, click here to show them.

Domains

Name

Malicious

justifycanddidatewd.shop

unknown

Details

Name:	justifycanddidatewd.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

richardflorespoew.shop

unknown

Details

Name:	richardflorespoew.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

strwawrunnygjwu.shop

unknown

Details

Name:	strwawrunnygjwu.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

falseaudiencekd.shop

unknown

Details

Name:	falseaudiencekd.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

raiseboltskdlwpow.shop

unknown

Details

Name:	raiseboltskdlwpow.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

employeedscratshj.shop

unknown

Details

Name:	employeedscratshj.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

marathonbeedksow.shop

unknown

Details

Name:	marathonbeedksow.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

feighminoritsjda.shop

unknown

Details

Name:	feighminoritsjda.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

pleasurenarrowsdla.shop

unknown

Details

Name:	pleasurenarrowsdla.shop
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

6D36F000

unkown

page read and write

48F0000

remote allocation

page read and write

4690000

heap

page read and write

AD0000

heap

page read and write

479D000

stack

page read and write

87C000

stack

page read and write

3210000

trusted library allocation

page read and write

AA0000

heap

page read and write

468E000

stack

page read and write

B2F000

heap

page read and write

4D7E000

stack

page read and write

1410000

heap

page read and write

1790000

trusted library allocation

page execute and read and write

16E0000

trusted library allocation

page read and write

146E000

stack

page read and write

10AC000

stack

page read and write

9E0000

heap

page read and write

16E3000

trusted library allocation

page execute and read and write

6D368000

unkown

page readonly

A80000

heap

page read and write

48DE000

stack

page read and write

44F000

remote allocation

page execute and read and write

B22000

heap

page read and write

4334000

trusted library allocation

page read and write

11A8000

stack

page read and write

15F8000

heap

page read and write

6D351000

unkown

page execute read

546E000

stack

page read and write

4C7E000

stack

page read and write

400000

remote allocation

page execute and read and write

57B0000

trusted library allocation

page read and write

6D350000

unkown

page readonly

15D0000

heap

page read and write

E92000

unkown

page readonly

1485000

heap

page read and write

A75000

heap

page read and write

1605000

heap

page read and write

2DAE000

stack

page read and write

16E4000

trusted library allocation

page read and write

1613000

heap

page read and write

15DE000

heap

page read and write

4339000

trusted library allocation

page read and write

159E000

stack

page read and write

18AF000

stack

page read and write

177E000

stack

page read and write

AF6000

heap

page read and write

47DD000

stack

page read and write

48F0000

remote allocation

page read and write

31F0000

heap

page read and write

1710000

trusted library allocation

page read and write

332F000

stack

page read and write

16ED000

trusted library allocation

page execute and read and write

1480000

heap

page read and write

1420000

heap

page read and write

2EAE000

stack

page read and write

16D0000

trusted library allocation

page read and write

57E0000

trusted library allocation

page execute and read and write

17A0000

heap

page read and write

15DA000

heap

page read and write

1717000

trusted library allocation

page execute and read and write

AD8000

heap

page read and write

48F0000

remote allocation

page read and write

A2E000

stack

page read and write

B0E000

heap

page read and write

101C000

unkown

page readonly

97D000

stack

page read and write

4331000

trusted library allocation

page read and write

15FC000

heap

page read and write

536D000

stack

page read and write

A70000

heap

page read and write

3213000

trusted library allocation

page read and write

19AF000

stack

page read and write

E90000

unkown

page readonly

A6E000

stack

page read and write

3220000

heap

page execute and read and write

15B0000

heap

page read and write

AFA000

heap

page read and write

1780000

heap

page read and write

6D3BA000

unkown

page readonly

171B000

trusted library allocation

page execute and read and write

3331000

trusted library allocation

page read and write

16F4000

trusted library allocation

page read and write

There are 72 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
tGm4SuP0sz.exe

Files

Processes

URLs

Domains

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReporttGm4SuP0sz.exe

Files

Processes

URLs

Domains

Memdumps

IOC Report
tGm4SuP0sz.exe