Edit tour
Windows
Analysis Report
InsertSr.exe
Overview
General Information
Detection
GO Backdoor
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Search for Antivirus process
Suricata IDS alerts for network traffic
Yara detected GO Backdoor
Drops PE files with a suspicious file extension
Found Tor onion address
Injects a PE file into a foreign processes
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Screensaver Binary File Creation
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64
- InsertSr.exe (PID: 6552 cmdline:
"C:\Users\ user\Deskt op\InsertS r.exe" MD5: C4C26460F0F0FC5F6ACB5A9DCA7D251C) - cmd.exe (PID: 6732 cmdline:
"C:\Window s\System32 \cmd.exe" /c copy Cr icket Cric ket.bat & Cricket.ba t MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 4152 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - tasklist.exe (PID: 3656 cmdline:
tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1) - findstr.exe (PID: 5012 cmdline:
findstr /I "wrsa ops svc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E) - tasklist.exe (PID: 3748 cmdline:
tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1) - findstr.exe (PID: 4052 cmdline:
findstr -I "avastui avgui bdse rvicehost nswscsvc s ophoshealt h" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E) - cmd.exe (PID: 5824 cmdline:
cmd /c md 316094 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - findstr.exe (PID: 5840 cmdline:
findstr /V "Sequence OctoberCon tributionR ef" Recrea tion MD5: F1D4BE0E99EC734376FDE474A8D4EA3E) - cmd.exe (PID: 6864 cmdline:
cmd /c cop y /b ..\Me tres + ..\ Scientists + ..\Prep + ..\Resp onsible + ..\Strange r + ..\Com ponents + ..\Medium + ..\Ima + ..\My + . .\Indiana u MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - Intranet.pif (PID: 6448 cmdline:
Intranet.p if u MD5: 18CE19B57F43CE0A5AF149C96AECC685) - cmd.exe (PID: 6464 cmdline:
cmd /k ech o [Interne tShortcut] > "C:\Use rs\user\Ap pData\Roam ing\Micros oft\Window s\Start Me nu\Program s\Startup\ Virtuoso.u rl" & echo URL="C:\U sers\user\ AppData\Lo cal\Immers ive Creati ons Co\Vir tuoso.js" >> "C:\Use rs\user\Ap pData\Roam ing\Micros oft\Window s\Start Me nu\Program s\Startup\ Virtuoso.u rl" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 2120 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - Intranet.pif (PID: 1292 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\316094\ Intranet.p if MD5: 18CE19B57F43CE0A5AF149C96AECC685) - choice.exe (PID: 2036 cmdline:
choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
- wscript.exe (PID: 5204 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Loc al\Immersi ve Creatio ns Co\Virt uoso.js" MD5: A47CBE969EA935BDD3AB568BB126BC80) - Virtuoso.scr (PID: 3748 cmdline:
"C:\Users\ user\AppDa ta\Local\I mmersive C reations C o\Virtuoso .scr" "C:\ Users\user \AppData\L ocal\Immer sive Creat ions Co\D" MD5: 18CE19B57F43CE0A5AF149C96AECC685) - Virtuoso.scr (PID: 2404 cmdline:
"C:\Users\ user\AppDa ta\Local\I mmersive C reations C o\Virtuoso .scr" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_GOBackdoor | Yara detected GO Backdoor | Joe Security | ||
JoeSecurity_GOBackdoor | Yara detected GO Backdoor | Joe Security |
System Summary |
---|
Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: |
Source: | Author: Max Altgelt (Nextron Systems): |
Source: | Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: |
Source: | Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: frack113: |
Source: | Author: Michael Haag: |
Data Obfuscation |
---|
Source: | Author: Joe Security: |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Author: Joe Security: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-29T16:25:40.862913+0100 | 2855536 | 1 | A Network Trojan was detected | 192.168.2.6 | 49730 | 109.172.87.135 | 22016 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-29T16:26:09.536154+0100 | 2855537 | 1 | A Network Trojan was detected | 192.168.2.6 | 49730 | 109.172.87.135 | 22016 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-29T16:26:09.968816+0100 | 2855538 | 1 | A Network Trojan was detected | 109.172.87.135 | 22016 | 192.168.2.6 | 49730 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-29T16:25:40.860487+0100 | 2855539 | 1 | A Network Trojan was detected | 109.172.87.135 | 22016 | 192.168.2.6 | 49730 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Code function: | 0_2_004062D5 | |
Source: | Code function: | 0_2_00402E18 | |
Source: | Code function: | 0_2_00406C9B | |
Source: | Code function: | 19_2_00504005 | |
Source: | Code function: | 19_2_0050C2FF | |
Source: | Code function: | 19_2_0050494A | |
Source: | Code function: | 19_2_0050CD14 | |
Source: | Code function: | 19_2_0050CD9F | |
Source: | Code function: | 19_2_0050F5D8 | |
Source: | Code function: | 19_2_0050F735 | |
Source: | Code function: | 19_2_0050FA36 | |
Source: | Code function: | 19_2_00503CE2 | |
Source: | Code function: | 22_2_001E4005 | |
Source: | Code function: | 22_2_001EC2FF | |
Source: | Code function: | 22_2_001E494A | |
Source: | Code function: | 22_2_001ECD14 | |
Source: | Code function: | 22_2_001ECD9F | |
Source: | Code function: | 22_2_001EF5D8 | |
Source: | Code function: | 22_2_001EF735 | |
Source: | Code function: | 22_2_001EFA36 | |
Source: | Code function: | 22_2_001E3CE2 |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Networking |
---|
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | String found in binary or memory: |