Edit tour

Windows Analysis Report
grass.exe

Overview

General Information

Sample name:	grass.exe
Analysis ID:	1559571
MD5:	bde4b588168e995961f49b6cb7576594
SHA1:	1a28c66e77e4a7cea5b2e49d116dd20d3d046120
SHA256:	bedf5dc3e40558fcffb4eee7d9efc20db06a1f77433e0c46d247dd4f2640e6f0
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found pyInstaller with non standard icon

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Classification

Process Tree

System is w7x64

grass.exe (PID: 3356 cmdline: "C:\Users\user\Desktop\grass.exe" MD5: BDE4B588168E995961F49B6CB7576594)

grass.exe (PID: 3420 cmdline: "C:\Users\user\Desktop\grass.exe" MD5: BDE4B588168E995961F49B6CB7576594)

cleanup

Code function: 0_2_000000013F124C60 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_000000013F124C60

Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\yarl\_quoting_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_brotli.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\aiohttp\_http_writer.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\propcache\_helpers_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\aiohttp\_helpers.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\frozenlist\_frozenlist.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\multidict\_multidict.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\aiohttp\_http_parser.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\grass.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33562\aiohttp\_websocket.cp310-win_amd64.pyd	Jump to dropped file