Edit tour
Windows
Analysis Report
LexusXA Installer.msi
Overview
General Information
| Sample name: | LexusXA Installer.msi |
| Analysis ID: | 1565536 |
| MD5: | 4a4cda00a1e1a32986cc1130d7db54ca |
| SHA1: | 57bd34c1c3372dd72d5c7ddcaa5bfb1dc387f4e2 |
| SHA256: | 5d2ab1efe433963996b35b16231631e7a69a8f7c951b25009626111fbc23d560 |
| Tags: | msiStealeruser-kafan_shengui |
| Infos: | |
 | |
Detection
| Score: | 32 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 0% |
Signatures
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Creates an undocumented autostart registry key
Tries to harvest and steal browser information (history, passwords, etc)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Extensive use of GetProcAddress (often used to hide API calls)
File is packed with WinRar
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
msiexec.exe (PID: 1368 cmdline: "C:\Window s\System32 \msiexec.e xe" /i "C: \Users\use r\Desktop\ LexusXA In staller.ms i" MD5: E5DA170027542E25EDE42FC54C929077)
- msiexec.exe (PID: 2108 cmdline:
C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077) - msiexec.exe (PID: 2996 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng 80745C9 49CFC24E35 8273D649EA 9B511 C MD5: 9D09DC1EDA745A5F87553048E57620CF) - msiexec.exe (PID: 2492 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng D0A27BF D503CBB4EC D262F85E02 5A5D0 MD5: 9D09DC1EDA745A5F87553048E57620CF)
LexusXA-installer-win_x64.exe (PID: 1072 cmdline: "C:\Progra m Files (x 86)\LexusO RG\LexusXA Installer \LexusXA-i nstaller-w in_x64.exe " MD5: 4A1316F8CF2A432B956BBB00E6AEB2B8) - LexusXA-installer-win_x64.tmp (PID: 2132 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-F3S OF.tmp\Lex usXA-insta ller-win_x 64.tmp" /S L5="$2044C ,19187169, 794112,C:\ Program Fi les (x86)\ LexusORG\L exusXA Ins taller\Lex usXA-insta ller-win_x 64.exe" MD5: C8E01A284D740A1B8962C82CD10667C2) 
version-iexpress-x64.exe (PID: 1228 cmdline: "C:\Users\ user\AppDa ta\Local\P rograms\Le xus\versio n-iexpress -x64.exe" MD5: 18E2B102B1D60F32601C0A398B34301E) 
version-checker-win-x64.exe (PID: 5980 cmdline: C:\Users\u ser\AppDat a\Local\Te mp\IXP000. TMP\versio n-checker- win-x64.ex e MD5: 5191B4E806CD706AF380B5995B602EAE) 
version-checker-won-x64.exe (PID: 2144 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\RarSFX 0\version- checker-wo n-x64.exe" MD5: A58F0BC8A2E552B1E03870D5326FF4DF) - version-checker-won-x64.exe (PID: 928 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\RarSFX 0\version- checker-wo n-x64.exe" MD5: A58F0BC8A2E552B1E03870D5326FF4DF)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||