Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

reup.exe

PE32+ executable (GUI) x86-64, for MS Windows

initial sample

Details

Filetype:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy:	6.124123890938614
Filename:	reup.exe
Filesize:	338318
MD5:	30fd08b6909e7c61ab934da1c9bb8e40
SHA1:	26f97535f923195475166c3fa7bc197aced503a4
SHA256:	63aa7252e7e0fb3da2dad75515190be17087dd67b592d3f6212a9e8f9825ab01
SHA512:	17dbfeee669fd54a7d2b01b5e17d1575aa347959f200548abb8767422b6dcd42b44232a5599ba6d039fd81118a825ab4da0054dec48a5ded2228cd95338093b4
SSDEEP:	3072:cbXCXysrkPMZ3zzsYL134BXg/BMVrbQRSbAJAQx418PWZ8m1Xf+QYE+ultEkIhRa:NXPY6z4Yd42iyRS0dJB0
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....!g.z..).....&....+.r.....................@.............................P............`... ............................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Found direct / indirect Syscall (likely to bypass EDR)	HIPS / PFW / Operating System Protection Evasion	Abuse Elevation Control Mechanism Security Software Discovery
Machine Learning detection for sample	AV Detection
Contains functionality to call native functions	System Summary	Security Software Discovery
Detected potential crypto function	System Summary	Security Software Discovery Archive Collected Data
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
One or more processes crash	System Summary
PE file contains more sections than normal	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a high image base, often used for DLLs	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_reup.exe_c4144ddf6f397eebaa24f1e81185ec95be2cdb_160b166d_3001f786-4fd1-4962-a087-70279a89038a\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_reup.exe_c4144ddf6f397eebaa24f1e81185ec95be2cdb_160b166d_3001f786-4fd1-4962-a087-70279a89038a\Report.wer
Category:	dropped
Dump:	Report.wer.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.6945482826442844
Encrypted:	false
Ssdeep:	96:xsFLNnbBbRs/hTod7JfUQXIDcQqc6mcEKcw34e4Jd+HbHg/opAnQsZnRmZAX/d5M:GrhRP0kigMJJ6jCzuiFlZ24lO81i
Size:	65536
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE file contains more sections than normal	System Summary
PE file contains sections with non-standard names	Data Obfuscation
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a high image base, often used for DLLs	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0F5.tmp.dmp

Mini DuMP crash report, 14 streams, Thu Oct 31 05:48:59 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0F5.tmp.dmp
Category:	dropped
Dump:	WERD0F5.tmp.dmp.4.dr
ID:	dr_0
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Thu Oct 31 05:48:59 2024, 0x1205a4 type
Entropy:	1.482221170888909
Encrypted:	false
Ssdeep:	192:FVU2b/NUlO6I3O5SUZnBu+ShpppESOR4SSKc:/zUI6I3oSULkxORVSp
Size:	68029
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD182.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERD182.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WERD182.tmp.WERInternalMetadata.xml.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.7015144529425097
Encrypted:	false
Ssdeep:	192:R6l7wVeJKWgsF6YcDROS2jgmfpb4bhpDa89bYrCfi4Im:R6lXJEsF6YmOS2jgmf1EYufiO
Size:	8538
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1C2.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1C2.tmp.xml
Category:	dropped
Dump:	WERD1C2.tmp.xml.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.473018487448725
Encrypted:	false
Ssdeep:	48:cvIwWl8zsdJg771I9fkWpW8VYLYm8M4JEEOKFtryq85l/Oxm0JAuKXd:uIjf3I7A97VXJlt0KmFuKXd
Size:	4655
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.393800889715689
Encrypted:	false
Ssdeep:	6144:+l4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNA4OBSqa:+4vF0MYQUMM6VFYS4U
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\reup.exe

"C:\Users\user\Desktop\reup.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7384
Target ID:	0
Parent PID:	3504
Name:	reup.exe
Path:	C:\Users\user\Desktop\reup.exe
Commandline:	"C:\Users\user\Desktop\reup.exe"
Size:	338318
MD5:	30FD08B6909E7C61AB934DA1C9BB8E40
Time:	01:48:56
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7f05e0000
Modulesize:	348160
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE file contains more sections than normal	System Summary
PE file contains sections with non-standard names	Data Obfuscation
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a high image base, often used for DLLs	System Summary

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 7384 -s 240

Details

Is windows:	true
Is dropped:	false
PID:	7552
Target ID:	4
Parent PID:	7384
Name:	WerFault.exe
Path:	C:\Windows\System32\WerFault.exe
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7384 -s 240
Size:	570736
MD5:	FD27D9F6D02763BDE32511B5DF7FF7A0
Time:	01:48:59
Date:	31/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7c2670000
Modulesize:	581632
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://upx.sf.net

unknown