Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.30005.24109.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	5.8509246594471795
Filename:	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.30005.24109.exe
Filesize:	483328
MD5:	45a2f42df3774d813e2d638b27e53b8a
SHA1:	89c90b0c5a73266fb141d0a7b85f9fc9211b1d37
SHA256:	fefc9036e37301f30cd68b062023d6495fbd70a42bc8870c0ce081491ea315a4
SHA512:	6535f39d4758e45e395703e55f2556ed2665961346625d27108fdbf4c5cd0135fb09543d8753021956a23929a87dc1978240b3e1c202cc3b4f118f6a4b60d5a5
SSDEEP:	6144:1TNGkzlAtHP1CK4zjBx3R3hMrM3GwkEhk3ci2Osy0iHl:15GkJA9PD4Hv3wERk+kDmyJF
Preview:	MZ......................@...............................................!.L.!This file was created by ClamAV for internal use and should not be run...ClamAV - A GPL virus scanner - http://www.clamav.net..$...PE..L...CLAM.....................(.............

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for sample	AV Detection
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion Security Software Discovery
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
One or more processes crash	System Summary
PE file does not import any functions	System Summary
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Reads software policies	System Summary	System Information Discovery
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_57f2573d54cfaddfa3969fb05552fe58a08559f_c9530808_a5669089-e744-4afe-9718-5d722dd29950\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_57f2573d54cfaddfa3969fb05552fe58a08559f_c9530808_a5669089-e744-4afe-9718-5d722dd29950\Report.wer
Category:	dropped
Dump:	Report.wer.3.dr
ID:	dr_3
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.6848859857906743
Encrypted:	false
Ssdeep:	96:JwFO2icL+eMWs2jhMyoI7JfdQXIDcQvc6QcEVcw3cE/DxN+HbHg6ZAX/d5FMT2SY:aEL4iWi0BU/QjEzuiFUPZ24IO8j
Size:	65536
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1272.tmp.dmp

Mini DuMP crash report, 14 streams, Fri Jul 5 04:19:56 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER1272.tmp.dmp
Category:	dropped
Dump:	WER1272.tmp.dmp.3.dr
ID:	dr_0
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Fri Jul 5 04:19:56 2024, 0x1205a4 type
Entropy:	1.9599600380292403
Encrypted:	false
Ssdeep:	96:5G8oWvfWH7oS2i7nOWz4LJe5fv8x0cC9WIkWI0gI4YUfK0wKa4:zVDOlKy38xMaYhQa4
Size:	18590
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER12E0.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER12E0.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER12E0.tmp.WERInternalMetadata.xml.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.701807390443628
Encrypted:	false
Ssdeep:	192:R6l7wVeJpS6O6YEIwSU96SP1gmfbC7prB89b7jsf0Upm:R6lXJ86O6YE/SU96YgmfWY7IfK
Size:	8494
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1300.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER1300.tmp.xml
Category:	dropped
Dump:	WER1300.tmp.xml.3.dr
ID:	dr_2
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.577438655833099
Encrypted:	false
Ssdeep:	48:cvIwWl8zs+Jg77aI9CtWpW8VYJYm8M4JZ43gFbS+q8QrxT8E4+h4Ud:uIjf0I7Ec7VdJZ4jpd8E4+h4Ud
Size:	4834
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.3.dr
ID:	dr_4
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.421780526538336
Encrypted:	false
Ssdeep:	6144:GSvfpi6ceLP/9skLmb0OTqWSPHaJG8nAgeMZMMhA2fX4WABlEnNj0uhiTw:lvloTqW+EZMM6DFyJ03w
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.30005.24109.exe

"C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.30005.24109.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4720
Target ID:	0
Parent PID:	1028
Name:	SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.30005.24109.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.30005.24109.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.30005.24109.exe"
Size:	483328
MD5:	45A2F42DF3774D813E2D638B27E53B8A
Time:	00:19:55
Date:	05/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	483328
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for sample	AV Detection
PE file does not import any functions	System Summary
Uses 32bit PE files	Compliance, System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 232

Details

Is windows:	true
Is dropped:	false
PID:	2180
Target ID:	3
Parent PID:	4720
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 232
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	00:19:56
Date:	05/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x8f0000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://www.clamav.net

unknown

http://upx.sf.net

unknown

http://www.repairfile.com

unknown