Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

2vPsGmF7E2.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.879271398005503
Filename:	2vPsGmF7E2.exe
Filesize:	462848
MD5:	973b6a3341fdea0b7de82697349d3c50
SHA1:	cb0bb65f302f4a7e9b6f90e8a341726eca788b07
SHA256:	6da7f0084b74cddda572b4c839824c50de6965c8b980dd639d15760e85c8c0d3
SHA512:	30f5c87d0164860ca8cd4cc7cc52ba1897c825f43371d22541ace8a332bb8051025dc3cc1aa57f3cf75639e40a9f3ddd5006b07b7297f4b8f1bbdf91ffe47e11
SSDEEP:	12288:/Su2YCRK4dhmsHI0s7UcGkU6nqPfgrbO2LdYm3D3:Ku29wAskynIfgPFLdYMD3
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!g............................~;... ...@....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains method to dynamically call methods (often used by packers)	Data Obfuscation	Software Packing
.NET source code contains potential unpacker	Data Obfuscation
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)	Anti Debugging
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Enables debug privileges	Anti Debugging
One or more processes crash	System Summary
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara signature match	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information
.NET source code contains long base64-encoded strings	System Summary	Disable or Modify Tools Obfuscated Files or Information
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Checks the free space of harddrives	Malware Analysis System Evasion	System Information Discovery
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2vPsGmF7E2.exe_ebe7824e783d8dd956eebe3f8ae6df8cc8696_c718f7ac_f305f120-9219-4b40-a255-f29053f1022f\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2vPsGmF7E2.exe_ebe7824e783d8dd956eebe3f8ae6df8cc8696_c718f7ac_f305f120-9219-4b40-a255-f29053f1022f\Report.wer
Category:	dropped
Dump:	Report.wer.10.dr
ID:	dr_0
Target ID:	10
Process:	C:\Windows\System32\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	1.2099610461393973
Encrypted:	false
Ssdeep:	192:4hWPxI+F0NxM4aWz8iyUp2lxPzuiFgZ24lO8mi:a4x4NxM4a48iMxPzuiFgY4lO8mi
Size:	65536
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD106.tmp.dmp

Mini DuMP crash report, 16 streams, Thu Oct 31 19:13:17 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERD106.tmp.dmp
Category:	dropped
Dump:	WERD106.tmp.dmp.10.dr
ID:	dr_2
Target ID:	10
Process:	C:\Windows\System32\WerFault.exe
Type:	Mini DuMP crash report, 16 streams, Thu Oct 31 19:13:17 2024, 0x1205a4 type
Entropy:	3.0636406663192397
Encrypted:	false
Ssdeep:	3072:NS6SHlKRj9Huqa1CCq3A3+vaP8MX4/bj1A2VMcSUCm5i:kFHlkjhyq3A3Qa0AUfeg4
Size:	450652
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD29D.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERD29D.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WERD29D.tmp.WERInternalMetadata.xml.10.dr
ID:	dr_3
Target ID:	10
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.698935390993593
Encrypted:	false
Ssdeep:	192:R6l7wVeJNlO6YNZfAYKgmfZ71KpDG89bZkMf8Tm:R6lXJfO6YTfAYKgmf11YZ3fF
Size:	8776
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD30C.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERD30C.tmp.xml
Category:	dropped
Dump:	WERD30C.tmp.xml.10.dr
ID:	dr_4
Target ID:	10
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.448485220945956
Encrypted:	false
Ssdeep:	48:cvIwWl8zs5Jg771I9jiJWpW8VYESYm8M4JAqPF7yq8vhqIlSCqd:uIjfLI74i47VfJtW5SCqd
Size:	4784
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.10.dr
ID:	dr_1
Target ID:	10
Process:	C:\Windows\System32\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.416751793465787
Encrypted:	false
Ssdeep:	6144:Bcifpi6ceLPL9skLmb0mfSWSPtaJG8nAgex285i2MMhA20X4WABlGuN75+:ei58fSWIZBk2MM6AFBNo
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\2vPsGmF7E2.exe

"C:\Users\user\Desktop\2vPsGmF7E2.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5736
Target ID:	0
Parent PID:	4056
Name:	2vPsGmF7E2.exe
Path:	C:\Users\user\Desktop\2vPsGmF7E2.exe
Commandline:	"C:\Users\user\Desktop\2vPsGmF7E2.exe"
Size:	462848
MD5:	973B6A3341FDEA0B7DE82697349D3C50
Time:	15:13:11
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7d0000
Modulesize:	98304
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected XWorm	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Yara detected Generic Downloader	Networking
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 5736 -s 1652

Details

Is windows:	true
Is dropped:	false
PID:	812
Target ID:	10
Parent PID:	5736
Name:	WerFault.exe
Path:	C:\Windows\System32\WerFault.exe
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5736 -s 1652
Size:	570736
MD5:	FD27D9F6D02763BDE32511B5DF7FF7A0
Time:	15:13:16
Date:	31/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff61fbc0000
Modulesize:	581632
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

completed-rally.gl.at.ply.gg

Details

Name:	completed-rally.gl.at.ply.gg
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\2vPsGmF7E2.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection

http://upx.sf.net

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://rentry.co/8wum7vax/raw

unknown

http://ip-api.com/line/?fields=hosting

208.95.112.1

Details

Name:	http://ip-api.com/line/?fields=hosting
IP:	208.95.112.1
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\2vPsGmF7E2.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking

http://ip-api.com

unknown

Domains

Name

Malicious

ip-api.com

208.95.112.1

Details

Name:	ip-api.com
IP:	208.95.112.1
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Check if machine is in data center or colocation facility	Malware Analysis System Evasion	Security Software Discovery
HTTP GET or POST without a user agent	Networking
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

208.95.112.1

ip-api.com

United States

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\2vPsGmF7E2_RASMANCS

FileDirectory