Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

XJQkTVvJ3I.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.321067041627892
Filename:	XJQkTVvJ3I.exe
Filesize:	712704
MD5:	85bb8945ac7b0a1ceeb1f3783168b6ea
SHA1:	c8f62675f94208f80d9ac054963e87583cf01680
SHA256:	78f70275d462340e3f57293641aedd5de6112df4b51c1d9d11d35676260c147c
SHA512:	31826d492b5d6c53ceee068dc0a920c46c324604d69c9e25ff4bc23373aff756152b4cd9030b0b4d5fa5bddc7f789d23782696c916337aa3739f59fbc2e74cad
SSDEEP:	12288:pmqHGU8sNLDze0yUA1EkrogYuc+SXgo5tBzYc7spg0FsE8uopVxVSr:pVmDstB/AGk9ego5tZsC0NG/VS
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.{..........4...4...4...4...4...U....Bn.)......W...4...+...4...+...4...+...Rich*...................PE..L....s.d...........

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing Security Software Discovery
Multi AV Scanner detection for submitted file	AV Detection	Create Account
Found evasive API chain (may stop execution after checking locale)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection	Security Software Discovery
Searches for specific processes (likely to inject)	HIPS / PFW / Operating System Protection Evasion	Security Software Discovery
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging	Security Software Discovery
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging	Anti Debugging
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to read the PEB	Anti Debugging	Security Software Discovery
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Detected potential crypto function	System Summary	System Time Discovery Process Discovery Archive Collected Data
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
Found evaded block containing many API calls	Malware Analysis System Evasion	Process Discovery
Found large amount of non-executed APIs	Malware Analysis System Evasion	System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
One or more processes crash	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API
Uses 32bit PE files	Compliance, System Summary	Create Account Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information Security Software Discovery
Binary may include packed or encrypted code	Data Obfuscation
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
Contains functionality to create a new desktop	Protection of GUI	Create Account
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary	Security Software Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Security Software Discovery Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
Uses new MSVCR Dlls	Compliance, System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XJQkTVvJ3I.exe_f5d3fb8a9d5d48a109cbda4e8feebb5f948f95a_e5070e2e_ac075564-9e75-4fc0-a002-559ed5ca0241\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XJQkTVvJ3I.exe_f5d3fb8a9d5d48a109cbda4e8feebb5f948f95a_e5070e2e_ac075564-9e75-4fc0-a002-559ed5ca0241\Report.wer
Category:	dropped
Dump:	Report.wer.3.dr
ID:	dr_3
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.9645859330758414
Encrypted:	false
Ssdeep:	192:z3uoke0KZkOqfjsqZrP2izuiFKZ24IO8X:LuokFKZkOqfjlFzuiFKY4IO8X
Size:	65536
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE file contains sections with non-standard names	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15C8.tmp.dmp

Mini DuMP crash report, 14 streams, Thu Oct 31 23:27:00 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER15C8.tmp.dmp
Category:	dropped
Dump:	WER15C8.tmp.dmp.3.dr
ID:	dr_0
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Thu Oct 31 23:27:00 2024, 0x1205a4 type
Entropy:	1.8995493248004316
Encrypted:	false
Ssdeep:	384:Grqvn2/MGgEdGDacfdGNbuVg0qVSzX0j3:G2/25gEwacANaVg0nz8
Size:	65108
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16B3.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER16B3.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER16B3.tmp.WERInternalMetadata.xml.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.702088445831646
Encrypted:	false
Ssdeep:	192:R6l7wVeJeN6dYEDZd6Y9SSUiGgmf6opDQ89bVL2sf0Aavzm:R6lXJk6dYid6YISUiGgmf6oVLVfTaq
Size:	8334
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16E3.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER16E3.tmp.xml
Category:	dropped
Dump:	WER16E3.tmp.xml.3.dr
ID:	dr_2
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.491434509286758
Encrypted:	false
Ssdeep:	48:cvIwWl8zsOJg77aI9YLWpW8VYmYm8M4JQSvFcFrh+q81EGgI9nbqzHF19d:uIjfEI7q67V2JQ2F+hkEGXmzl19d
Size:	4579
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.3.dr
ID:	dr_4
Target ID:	3
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.465440225227793
Encrypted:	false
Ssdeep:	6144:+IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNOdwBCswSbT:TXD94+WlLZMM6YFHQ+T
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\XJQkTVvJ3I.exe

"C:\Users\user\Desktop\XJQkTVvJ3I.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6588
Target ID:	0
Parent PID:	2580
Name:	XJQkTVvJ3I.exe
Path:	C:\Users\user\Desktop\XJQkTVvJ3I.exe
Commandline:	"C:\Users\user\Desktop\XJQkTVvJ3I.exe"
Size:	712704
MD5:	85BB8945AC7B0A1CEEB1F3783168B6EA
Time:	19:26:57
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	3067904
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Powershell download and execute	HIPS / PFW / Operating System Protection Evasion
Yara detected Stealc	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
PE file contains sections with non-standard names	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 1332

Details

Is windows:	true
Is dropped:	false
PID:	7116
Target ID:	3
Parent PID:	6588
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 1332
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	19:26:59
Date:	31/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x8a0000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://185.235.128.16

unknown

http://185.235.128.16/

185.235.128.16

http://185.235.128.16/562c1eb14955c897.php

185.235.128.16

http://185.235.128.16/562c1eb14955c897.php~M

unknown

http://185.235.128.16/562c1eb14955c897.phpk

unknown

http://upx.sf.net

unknown

http://185.235.128.16/562c1eb14955c897.phpx

unknown

http://185.235.128.16/562c1eb14955c897.php4

unknown

http://185.235.128.16/562c1eb14955c897.phpQ

unknown

http://185.235.128.16/ws

unknown

http://185.235.128.16e

unknown

https://docs.rs/getrandom#nodejs-es-module-support

unknown

There are 2 hidden URLs, click here to show them.

IPs

Domain

Country

Malicious

185.235.128.16

unknown

Ukraine

Details

IP:	185.235.128.16
TargetID:	0
Current Path:	C:\Users\user\Desktop\XJQkTVvJ3I.exe
Country:	Ukraine
Countrycode:	UKR
ASN number:	204601
ASN name:	ON-LINE-DATAServerlocation-NetherlandsDrontenNL
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
HTTP GET or POST without a user agent	Networking
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking