Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

6RVmzn1DzL.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.568469104991779
Filename:	6RVmzn1DzL.exe
Filesize:	587168
MD5:	4d73427dc0b9f3dc4b846ace0ddc2deb
SHA1:	43b8ffa09826c21676d759c0f3dc2088c4df4efe
SHA256:	0d7b87b394b0620f352a3dd9391b202ff85c2659a007b74caf11799fc51e1e09
SHA512:	b66b5b2beeec4174ff9f644b105c10e757e18211a55b7c5b5d9ed9745c0cdc191f7c427d00518cab63427d92d9122922de92db3d448a6ef347f5c5e778d5067f
SSDEEP:	12288:GGbKDjKEJZALcCAgqW++rNWq3nmK6JqpJjAsE:G1K8Z4cCPqW+kAqrjjjAx
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?.F`Q.F`Q.F`Q.....R`Q......`Q.K2..O`Q.K2..E`Q.K2..S`Q.O...G`Q......`Q.O...U`Q.F`P..`Q.....@`Q.K2..G`Q.....G`Q.RichF`Q........

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell
Query firmware table information (likely to detect VMs)	Malware Analysis System Evasion
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information	OS Credential Dumping
Tries to steal Crypto Currency Wallets	Stealing of Sensitive Information	Windows Management Instrumentation Security Software Discovery
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)	Lowering of HIPS / PFW / Operating System Security Settings	Windows Management Instrumentation
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Detected potential crypto function	System Summary	Process Discovery Archive Collected Data
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	File and Directory Discovery
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
One or more processes crash	System Summary
PE / OLE file has an invalid certificate	System Summary	File and Directory Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Searches for user specific document files	Stealing of Sensitive Information
Uses 32bit PE files	Compliance, System Summary
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to read ini properties file for application configuration	Persistence and Installation Behavior
Contains functionality to register its own exception handler	Anti Debugging
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Queries a list of all running processes	Malware Analysis System Evasion
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads software policies	System Summary
SQL strings found in memory and binary data	System Summary	File and Directory Discovery
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_6RVmzn1DzL.exe_7bfb277fee81bf1a20749b653394791c3aa9112c_462bbcf1_b313c709-504a-4fb8-84c2-c4704d4cf20e\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_6RVmzn1DzL.exe_7bfb277fee81bf1a20749b653394791c3aa9112c_462bbcf1_b313c709-504a-4fb8-84c2-c4704d4cf20e\Report.wer
Category:	dropped
Dump:	Report.wer.5.dr
ID:	dr_0
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	1.0425415904336832
Encrypted:	false
Ssdeep:	192://NtB5+s0BU/gjZ/exMzuiFizZ24IO8+U0N:3NtB5+nBU/gjTzuiFizY4IO8+U
Size:	65536
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
PE / OLE file has an invalid certificate	System Summary
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA461.tmp.dmp

Mini DuMP crash report, 15 streams, Tue Jul 2 06:33:04 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERA461.tmp.dmp
Category:	dropped
Dump:	WERA461.tmp.dmp.5.dr
ID:	dr_2
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 15 streams, Tue Jul 2 06:33:04 2024, 0x1205a4 type
Entropy:	1.9963464189301523
Encrypted:	false
Ssdeep:	768:3ViXRpG8BTkqQ2QE0NWmQZ/48wnmphSkIrX:F07QNBE0NW9/on4grX
Size:	125340
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6A5.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6A5.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WERA6A5.tmp.WERInternalMetadata.xml.5.dr
ID:	dr_3
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.706154048719564
Encrypted:	false
Ssdeep:	192:R6l7wVeJ5r6IR1i6YEIHSU9o2hgmfp4HHrpry89bx6sf07m:R6lXJF6I26YE4SU9o2hgmfp4H9xZf1
Size:	8378
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6D4.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6D4.tmp.xml
Category:	dropped
Dump:	WERA6D4.tmp.xml.5.dr
ID:	dr_4
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.509997748119072
Encrypted:	false
Ssdeep:	48:cvIwWl8zs3Jg77aI9iVWpW8VYmYm8M4JeltgF7+q8Hr7E8aeSrSud:uIjfZI7Qk7VGJF0cRWud
Size:	4688
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.5.dr
ID:	dr_1
Target ID:	5
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.42177513978557
Encrypted:	false
Ssdeep:	6144:lSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNc0uhiTw:svloTMW+EZMM6DFyG03w
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\6RVmzn1DzL.exe

"C:\Users\user\Desktop\6RVmzn1DzL.exe"

Details

Is windows:	false
Is dropped:	false
PID:	3276
Target ID:	0
Parent PID:	1028
Name:	6RVmzn1DzL.exe
Path:	C:\Users\user\Desktop\6RVmzn1DzL.exe
Commandline:	"C:\Users\user\Desktop\6RVmzn1DzL.exe"
Size:	587168
MD5:	4D73427DC0B9F3DC4B846ACE0DDC2DEB
Time:	02:32:40
Date:	02/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x620000
Modulesize:	598016
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
PE / OLE file has an invalid certificate	System Summary
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1728

Details

Is windows:	true
Is dropped:	false
PID:	6608
Target ID:	5
Parent PID:	3276
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1728
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	02:33:03
Date:	02/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x200000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://contintnetksows.shop/

unknown

https://contintnetksows.shop/p1

unknown

https://contintnetksows.shop/apien0

unknown

https://contintnetksows.shop/apirofi

unknown

towerxxuytwi.xyz

https://contintnetksows.shop/apin

unknown

https://contintnetksows.shop/apiz

unknown

contintnetksows.shop

https://contintnetksows.shop/apiassw

unknown

https://contintnetksows.shop/pp

unknown

https://contintnetksows.shop/apih

unknown

https://contintnetksows.shop/a7

unknown

https://contintnetksows.shop/apieppgd

unknown

https://contintnetksows.shop/apiT

unknown

https://contintnetksows.shop/%%

unknown

penetratedpoopp.xyz

ellaboratepwsz.xyz

swellfrrgwwos.xyz

https://contintnetksows.shop/api

172.67.141.234

https://contintnetksows.shop/e

unknown

foodypannyjsud.shop

pedestriankodwu.xyz

https://contintnetksows.shop/a

unknown

https://contintnetksows.shop/s8

unknown

potterryisiw.shop

https://contintnetksows.shop/api$

unknown

https://contintnetksows.shop/s

unknown

https://contintnetksows.shop/api%

unknown

https://contintnetksows.shop/p

unknown

https://duckduckgo.com/chrome_newtab

unknown

https://duckduckgo.com/ac/?q=

unknown

https://www.yubsoft.com%dshell32.dllSHGetDesktopFolderSHCreateShellItem

unknown

https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi

unknown

http://ocsps.ssl.com0?

unknown

http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0

unknown

https://github.com/imgdrive/Folder2ISOhttps://github.com/imgdrive/Folder2ISO/issuesVIDEO_TSBDMVBDAVA

unknown

https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.

unknown

http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q

unknown

http://ocsps.ssl.com0

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0

unknown

http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_

unknown

http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0

unknown

http://x1.c.lencr.org/0

unknown

http://x1.i.lencr.org/0

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

https://www.ssl.com/repository0

unknown

https://github.com/imgdrive/Folder2ISO/issues

unknown

https://contintnetksows.shop:443/apiK

unknown

https://support.mozilla.org/products/firefoxgro.all

unknown

https://contintnetksows.shop:443/api_storageCJ

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

https://www.yubsoft.com

unknown

https://contintnetksows.shop:443/api

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://crl.rootca1.amazontrust.com/rootca1.crl0

unknown

http://upx.sf.net

unknown

https://contintnetksows.shop:443/api)

unknown

http://ocsp.rootca1.amazontrust.com0:

unknown

https://www.ecosia.org/newtab/

unknown

https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta

unknown

https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

http://crls.ssl.com/ssl.com-rsa-RootCA.crl0

unknown

https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg

unknown

http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0

unknown

https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg

unknown

http://crt.rootca1.amazontrust.com/rootca1.cer0?

unknown

https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref

unknown

https://github.com/imgdrive/Folder2ISO

unknown

https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477

unknown

http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

There are 63 hidden URLs, click here to show them.

Domains

Name

Malicious

contintnetksows.shop

172.67.141.234

Details

Name:	contintnetksows.shop
IP:	172.67.141.234
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

172.67.141.234

contintnetksows.shop

United States

Details

IP:	172.67.141.234
TargetID:	0
Current Path:	C:\Users\user\Desktop\6RVmzn1DzL.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	contintnetksows.shop

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking