Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

1PI1dOAtKY.exe

PE32+ executable (console) x86-64, for MS Windows

initial sample

Details

Filetype:	PE32+ executable (console) x86-64, for MS Windows
Entropy:	6.129641582558878
Filename:	1PI1dOAtKY.exe
Filesize:	645776
MD5:	65265a6752011edf039bdeafeb4e1551
SHA1:	7414c76369b2e5762c93936a22ba530d80488d10
SHA256:	3fe5fd377ea9bde5ca15723d214916b9a8e1b780bd49fab6e75412315c155b52
SHA512:	6356f085894624e61a8dc67b19fc27ebf4c17b75b4cda970f120edc80d63946527ca845224c8b71d2d65a12efe5bfff7d781c050c382a517a958c0d3959afe63
SSDEEP:	12288:y6UPqQaO4tv82UlCKIMBnD1pnS8nWy9i4elej:y6jOK8GKIM5bWy9zj
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O};.!.;.!.;.!..\|..4.!..\|....!..\|....!.....6.!.;. ...!..U..:.!.]T..:.!.]T..:.!.Rich;.!.........PE..d......g.........."........

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging	Security Software Discovery
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to query network adapater information	Malware Analysis System Evasion	Security Software Discovery System Network Configuration Discovery Ingress Tool Transfer
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
Found evaded block containing many API calls	Malware Analysis System Evasion
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Security Software Discovery Account Discovery System Owner/User Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary	Security Software Discovery
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary	Security Software Discovery
PE file has a high image base, often used for DLLs	System Summary

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\1PI1dOAtKY.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.710273607729329
Encrypted:	false
Ssdeep:	24:w3GSdNffPmFMqFh4im3S1emA26uuMj4/4rku3MkHtXDe98vO++ly+Npy+tbDZAd1:9SdkJPAke5uuMqo3ltTI+Z+y+4W+t
Size:	1555
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\1PI1dOAtKY.exe

"C:\Users\user\Desktop\1PI1dOAtKY.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6404
Target ID:	0
Parent PID:	1028
Name:	1PI1dOAtKY.exe
Path:	C:\Users\user\Desktop\1PI1dOAtKY.exe
Commandline:	"C:\Users\user\Desktop\1PI1dOAtKY.exe"
Size:	645776
MD5:	65265A6752011EDF039BDEAFEB4E1551
Time:	00:30:21
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff746d70000
Modulesize:	675840
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a high image base, often used for DLLs	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	1816
Target ID:	1
Parent PID:	6404
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	00:30:21
Date:	23/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://http://Mozilla/5.0

unknown

Memdumps

Base Address

Regiontype

Protect

Malicious

187C3980000

heap

page read and write

7FF746DE1000

unkown

page readonly

7FF2CFC000

stack

page read and write

7FF746D70000

unkown

page readonly

7FF746D71000

unkown

page execute read

7FF746DE1000

unkown

page readonly

187C3A77000

heap

page read and write

187C3970000

heap

page read and write

7FF746E0A000

unkown

page readonly

7FF2DFF000

stack

page read and write

7FF746D71000

unkown

page execute read

187C39EF000

heap

page read and write

7FF746E0A000

unkown

page readonly

187C39BC000

heap

page read and write

187C39FC000

heap

page read and write

7FF746D70000

unkown

page readonly

187C39FF000

heap

page read and write

187C3B80000

heap

page read and write

187C39DA000

heap

page read and write

187C3BA1000

heap

page read and write

187C39B0000

heap

page read and write

7FF746E03000

unkown

page write copy

187C3C3D000

heap

page read and write

187C39D0000

heap

page read and write

187C3A0C000

heap

page read and write

7FF2EFF000

stack

page read and write

187C3BA0000

heap

page read and write

187C3CA0000

heap

page read and write

7FF746E03000

unkown

page read and write

187C39EC000

heap

page read and write

187C3A76000

heap

page read and write

187C3A0E000

heap

page read and write

There are 22 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
1PI1dOAtKY

Files

Processes

URLs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report1PI1dOAtKY

Files

Processes

URLs

Memdumps

IOC Report
1PI1dOAtKY