Edit tour
Windows
Analysis Report
DYv2ldz5xT.exe
Overview
General Information
| Sample name: | DYv2ldz5xT.exerenamed because original name is a hash value |
| Original sample name: | e78133a2e2dbbab66fe70553907f57e1c22a57477b5c87a5b11ccc75e2fd71bc.exe |
| Analysis ID: | 1590657 |
| MD5: | 9c92157d141608aaa0c10d7a008b1afc |
| SHA1: | 14dcd42877db7ff4a500f43032d1c95a2b8a5939 |
| SHA256: | e78133a2e2dbbab66fe70553907f57e1c22a57477b5c87a5b11ccc75e2fd71bc |
| Tags: | bot7135076584exeuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 84 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Attempt to bypass Chrome Application-Bound Encryption
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for dropped file
Yara detected Telegram Recon
Drops password protected ZIP file
Sigma detected: Potential Data Stealing Via Chromium Headless Debugging
Tries to harvest and steal browser information (history, passwords, etc)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Browser Execution In Headless Mode
Sigma detected: Browser Started with Remote Debugging
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Yara detected Credential Stealer
Classification
- System is w10x64
DYv2ldz5xT.exe (PID: 6540 cmdline: "C:\Users\ user\Deskt op\DYv2ldz 5xT.exe" MD5: 9C92157D141608AAA0C10D7A008B1AFC) 
conhost.exe (PID: 6528 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
msedge.exe (PID: 3132 cmdline: "C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --remot e-debuggin g-port=980 7 --user-d ata-dir="C :\Users\us er\AppData \Local\Mic rosoft\Edg e\User Dat a" --profi le-directo ry="Defaul t" --disab le-popup-b locking -- disable-ex tensions - -disable-g pu --disab le-softwar e-rasteriz er --disab le-dev-shm -usage --n o-sandbox --disable- logging -- disable-cr ash-report er --disab le-web-sec urity --al low-runnin g-insecure -content - -ignore-ce rtificate- errors --d isable-fea tures=Isol ateOrigins ,site-per- process -- disable-bl ink-featur es=Automat ionControl led --disa ble-backgr ound-netwo rking --di sable-defa ult-apps - -disable-h ang-monito r --disabl e-sync --d isable-cli ent-side-p hishing-de tection -- disable-ba ckground-t imer-throt tling --di sable-rend erer-backg rounding - -disable-b ackgroundi ng-occlude d-windows --disable- ipc-floodi ng-protect ion --disa ble-site-i solation-t rials --mu te-audio - -window-si ze=1280,72 0 --window -position= -3000,-300 0 --headle ss MD5: BF154738460E4AB1D388970E1AB13FAB) - msedge.exe (PID: 988 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --n o-sandbox --ignore-c ertificate -errors -- use-angle= swiftshade r-webgl -- use-gl=ang le --mute- audio --ig nore-certi ficate-err ors --head less --dis able-loggi ng --mojo- platform-c hannel-han dle=1464 - -field-tri al-handle= 1404,i,610 6576859525 474661,177 2780434763 6201934,26 2144 --dis able-featu res=Isolat eOrigins,P aintHoldin g,site-per -process / prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB) - msedge.exe (PID: 500 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --remot e-debuggin g-port=948 7 --user-d ata-dir="C :\Users\us er\AppData \Local\Mic rosoft\Edg e\User Dat a" --profi le-directo ry="Defaul t" --disab le-popup-b locking -- disable-ex tensions - -disable-g pu --disab le-softwar e-rasteriz er --disab le-dev-shm -usage --n o-sandbox --disable- logging -- disable-cr ash-report er --disab le-web-sec urity --al low-runnin g-insecure -content - -ignore-ce rtificate- errors --d isable-fea tures=Isol ateOrigins ,site-per- process -- disable-bl ink-featur es=Automat ionControl led --disa ble-backgr ound-netwo rking --di sable-defa ult-apps - -disable-h ang-monito r --disabl e-sync --d isable-cli ent-side-p hishing-de tection -- disable-ba ckground-t imer-throt tling --di sable-rend erer-backg rounding - -disable-b ackgroundi ng-occlude d-windows --disable- ipc-floodi ng-protect ion --disa ble-site-i solation-t rials --mu te-audio - -window-si ze=1280,72 0 --window -position= -3000,-300 0 --headle ss MD5: BF154738460E4AB1D388970E1AB13FAB) - msedge.exe (PID: 6984 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --n o-sandbox --ignore-c ertificate -errors -- use-angle= swiftshade r-webgl -- use-gl=ang le --mute- audio --ig nore-certi ficate-err ors --head less --dis able-loggi ng --mojo- platform-c hannel-han dle=1588 - -field-tri al-handle= 1480,i,902 5372416436 885041,173 6393109725 3414333,26 2144 --dis able-featu res=Isolat eOrigins,P aintHoldin g,site-per -process / prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB) - msedge.exe (PID: 6548 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --remot e-debuggin g-port=943 3 --user-d ata-dir="C :\Users\us er\AppData \Local\Mic rosoft\Edg e\User Dat a" --profi le-directo ry="Defaul t" --disab le-popup-b locking -- disable-ex tensions - -disable-g pu --disab le-softwar e-rasteriz er --disab le-dev-shm -usage --n o-sandbox --disable- logging -- disable-cr ash-report er --disab le-web-sec urity --al low-runnin g-insecure -content - -ignore-ce rtificate- errors --d isable-fea tures=Isol ateOrigins ,site-per- process -- disable-bl ink-featur es=Automat ionControl led --disa ble-backgr ound-netwo rking --di sable-defa ult-apps - -disable-h ang-monito r --disabl e-sync --d isable-cli ent-side-p hishing-de tection -- disable-ba ckground-t imer-throt tling --di sable-rend erer-backg rounding - -disable-b ackgroundi ng-occlude d-windows --disable- ipc-floodi ng-protect ion --disa ble-site-i solation-t rials --mu te-audio - -window-si ze=1280,72 0 --window -position= -3000,-300 0 --headle ss MD5: BF154738460E4AB1D388970E1AB13FAB) - msedge.exe (PID: 6288 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --n o-sandbox --ignore-c ertificate -errors -- use-angle= swiftshade r-webgl -- use-gl=ang le --mute- audio --ig nore-certi ficate-err ors --head less --dis able-loggi ng --mojo- platform-c hannel-han dle=1608 - -field-tri al-handle= 1440,i,177 1779135381 9158895,12 1647231400 62187133,2 62144 --di sable-feat ures=Isola teOrigins, PaintHoldi ng,site-pe r-process /prefetch: 3 MD5: BF154738460E4AB1D388970E1AB13FAB)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_TelegramRecon | Yara detected Telegram Recon | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security |
System Summary |   |
|---|
| Source: | Author: Nasreddine Bencherchali (Nextron Systems): | ||