Edit tour
Windows
Analysis Report
l39HA25qjw.exe
Overview
General Information
Detection
ManusCrypt, Socelars
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (creates a PE file in dynamic memory)
Snort IDS alert for network traffic
Yara detected UAC Bypass using CMSTP
DLL reload attack detected
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected ManusCrypt
Yara detected Socelars
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Found strings related to Crypto-Mining
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Uses known network protocols on non-standard ports
Creates processes via WMI
Machine Learning detection for sample
Drops PE files to the document folder of the user
Allocates memory in foreign processes
Performs DNS queries to domains with low reputation
Injects a PE file into a foreign processes
Creates a thread in another existing process (thread injection)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Sets a auto configuration URL for Internet Explorer (IE settings are enforced automatically)
Detected VMProtect packer
Drops PE files with a suspicious file extension
Writes to foreign memory regions
Overwrites Mozilla Firefox settings
Installs new ROOT certificates
Renames NTDLL to bypass HIPS
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Obfuscated command line found
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Sets debug register (to hijack the execution of another thread)
Found API chain indicative of sandbox detection
Antivirus or Machine Learning detection for unpacked file
Drops PE files to the application program directory (C:\ProgramData)
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality to simulate keystroke presses
Downloads executable code via HTTP
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
Modifies existing windows services
OS version to string mapping found (often used in BOTs)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Found evasive API chain checking for process token information
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Contains functionality to retrieve information about pressed keystrokes
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
Contains functionality to execute programs as a different user
PE file contains sections with non-standard names
Stores large binary data to the registry
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to communicate with device drivers
Contains functionality to read the clipboard data
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Entry point lies outside standard sections
Enables debug privileges
AV process strings found (often used to terminate AV products)
PE file does not import any functions
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Enables driver privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Detected TCP or UDP traffic on non-standard ports
Contains functionality to launch a program with higher privileges
Potential key logger detected (key state polling based)
Enables security privileges
Queries disk information (often used to detect virtual machines)
Uses Microsoft's Enhanced Cryptographic Provider
Contains functionality to simulate mouse events
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Classification
- System is w10x64native
- l39HA25qjw.exe (PID: 7684 cmdline:
C:\Users\u ser\Deskto p\l39HA25q jw.exe MD5: 5417B1CA4DA061FC9BB034627FBBDA40) - at.exe (PID: 420 cmdline:
at 3874982 763784yhwg dfg7823478 9s42809374 918uf MD5: 2AE20048111861FA09B709D3CC551AD6) - conhost.exe (PID: 7132 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - cmd.exe (PID: 1348 cmdline:
cmd /c cmd < Virtual .wms & pin g -n 5 loc alhost MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 3972 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - cmd.exe (PID: 1244 cmdline:
cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - tasklist.exe (PID: 1288 cmdline:
tasklist / FI "imagen ame eq Ava stUI.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1) - find.exe (PID: 6952 cmdline:
find /I /N "avastui. exe" MD5: 31D06677CD9ACA84EA2E2E8E3BF22D65) - tasklist.exe (PID: 5504 cmdline:
tasklist / FI "imagen ame eq AVG UI.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1) - find.exe (PID: 7832 cmdline:
find /I /N "avgui.ex e" MD5: 31D06677CD9ACA84EA2E2E8E3BF22D65) - findstr.exe (PID: 7900 cmdline:
findstr /V /R "^xAuY KKZEsy$" S imilarly.w ms MD5: F1D4BE0E99EC734376FDE474A8D4EA3E) - Fuck.exe.pif (PID: 2268 cmdline:
Fuck.exe.p if h MD5: 6987E4CD3F256462F422326A7EF115B9) - Fuck.exe.pif (PID: 6488 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\IXP000. TMP\Fuck.e xe.pif MD5: 6987E4CD3F256462F422326A7EF115B9) - Fuck.exe.pif (PID: 7152 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\IXP000. TMP\Fuck.e xe.pif MD5: 6987E4CD3F256462F422326A7EF115B9) - FagLhQ (PID: 628 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\qymasQH squYhjAFGo a\FagLhQ - /SP- /VERY SILENT /SU PPRESSMSGB OXES /pid= 767 MD5: 19B20FC498D366730C470BACAB083FE7) - FagLhQ.tmp (PID: 3436 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-3CD C9.tmp\Fag LhQ.tmp" / SL5="$5040 E,11860388 ,791040,C: \Users\use r\AppData\ Local\Temp \qymasQHsq uYhjAFGoa\ FagLhQ" -/ SP- /VERYS ILENT /SUP PRESSMSGBO XES /pid=7 67 MD5: 64F68F0B5364A0313EF5C2EDE5FEAC47) - WyFBnl (PID: 7960 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\ZMozrHw lcUivWMjcw g\WyFBnl MD5: 2F8CBF74871165688C040E0C95DCE0F0) - WerFault.exe (PID: 4388 cmdline:
C:\Windows \system32\ WerFault.e xe -u -p 7 960 -s 272 MD5: 5C06542FED8EE68994D43938E7326D75) - MpVMRr (PID: 7940 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\zamzGuU AZjRRZhjPe C\MpVMRr MD5: 1725996A931F0F5164CB69E713608F1F) - conhost.exe (PID: 5604 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - EfRhfn (PID: 2776 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\PxuBIvV omAwNlxRye m\EfRhfn MD5: 78C42D6817AF1AD96CABDF6FF2F7F3DA) - WerFault.exe (PID: 1928 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 2 776 -s 856 MD5: 40A149513D721F096DDF50C04DA2F01F) - DMLnyt (PID: 3452 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\BmJXgWa KpkcZyvlBV T\DMLnyt MD5: E3C664A4A00BCBD6BD73D48169421458) - PING.EXE (PID: 844 cmdline:
ping local host -n 5 MD5: B3624DD758CCECF93A1226CEF252CA12) - PING.EXE (PID: 7148 cmdline:
ping -n 5 localhost MD5: B3624DD758CCECF93A1226CEF252CA12)
- rundll32.exe (PID: 3436 cmdline:
C:\Windows \system32\ rundll32.e xe" C:\Win dows\syste m32\advpac k.dll,DelN odeRunDLL3 2 "C:\User s\user\App Data\Local \Temp\IXP0 00.TMP\ MD5: EF3179D498793BF4234F708D3BE28633) - vc_redist.x64.exe (PID: 1828 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-A3Q 0E.tmp\vc_ redist.x64 .exe" /ins tall /quie t /noresta rt MD5: CDCE5D5EE259D8071FA82F522C5C7D6E) - vc_redist.x64.exe (PID: 8120 cmdline:
"C:\Window s\Temp\{AC 1CDB68-D92 A-427E-A09 B-9742E51C 62BE}\.cr\ vc_redist. x64.exe" - burn.clean .room="C:\ Users\user \AppData\L ocal\Temp\ is-A3Q0E.t mp\vc_redi st.x64.exe " -burn.fi lehandle.a ttached=63 6 -burn.fi lehandle.s elf=644 /i nstall /qu iet /nores tart MD5: D940EA062ED6E99F6D873C2F5F09D1C9) - VC_redist.x64.exe (PID: 5796 cmdline:
"C:\Window s\Temp\{07 D0B832-8F4 0-4A09-81B 7-C92B2488 52DA}\.be\ VC_redist. x64.exe" - q -burn.el evated Bur nPipe.{F78 64B24-BD58 -4321-8DAF -90AD3F7AE D80} {2D0A 5E22-0BB0- 4C91-8FDC- D5C3E4413F 94} 8120 MD5: D940EA062ED6E99F6D873C2F5F09D1C9)
- svchost.exe (PID: 7204 cmdline:
C:\Windows \System32\ svchost.ex e -k WerSv cGroup MD5: F586835082F632DC8D9404D83BC16316) - WerFault.exe (PID: 2692 cmdline:
C:\Windows \system32\ WerFault.e xe -pss -s 480 -p 79 60 -ip 796 0 MD5: 5C06542FED8EE68994D43938E7326D75) - WerFault.exe (PID: 6728 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -pss -s 436 -p 27 76 -ip 277 6 MD5: 40A149513D721F096DDF50C04DA2F01F) - WerFault.exe (PID: 2724 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -pss -s 544 -p 34 52 -ip 345 2 MD5: 40A149513D721F096DDF50C04DA2F01F)
- rundll32.exe (PID: 3352 cmdline:
rundll32.e xe "C:\Use rs\user\Ap pData\Loca l\Temp\db. dll",open MD5: EF3179D498793BF4234F708D3BE28633) - rundll32.exe (PID: 7288 cmdline:
rundll32.e xe "C:\Use rs\user\Ap pData\Loca l\Temp\db. dll",open MD5: 889B99C52A60DD49227C5E485A016679) - svchost.exe (PID: 7380 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s A ppinfo MD5: F586835082F632DC8D9404D83BC16316) - svchost.exe (PID: 1572 cmdline:
C:\Windows \system32\ svchost.ex e -k WspSe rvice MD5: F586835082F632DC8D9404D83BC16316) - svchost.exe (PID: 2752 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: F586835082F632DC8D9404D83BC16316)
- VSSVC.exe (PID: 6936 cmdline:
C:\Windows \system32\ vssvc.exe MD5: AA98234C89499A69BD55C2DCCC4BCCC9)
- svchost.exe (PID: 8072 cmdline:
C:\Windows \System32\ svchost.ex e -k swprv MD5: F586835082F632DC8D9404D83BC16316)
- cleanup
{"C2 url": "https://dfgrthres.s3.eu-west-3.amazonaws.com/aysdg930"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_UACBypassusingCMSTP | Yara detected UAC Bypass using CMSTP | Joe Security | ||
JoeSecurity_Socelars | Yara detected Socelars | Joe Security | ||
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM | Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) | ditekSHen |
| |
JoeSecurity_UACBypassusingCMSTP | Yara detected UAC Bypass using CMSTP | Joe Security | ||
JoeSecurity_Socelars | Yara detected Socelars | Joe Security | ||
Click to see the 1 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_UACBypassusingCMSTP | Yara detected UAC Bypass using CMSTP | Joe Security | ||
SUSP_XORed_MSDOS_Stub_Message | Detects suspicious XORed MSDOS stub message | Florian Roth |
| |
SUSP_XORed_MSDOS_Stub_Message | Detects suspicious XORed MSDOS stub message | Florian Roth |
| |
JoeSecurity_ManusCrypt | Yara detected ManusCrypt | Joe Security | ||
Windows_Trojan_Generic_a681f24a | unknown | unknown |
| |
Click to see the 62 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
SUSP_XORed_MSDOS_Stub_Message | Detects suspicious XORed MSDOS stub message | Florian Roth |
| |
JoeSecurity_ManusCrypt | Yara detected ManusCrypt | Joe Security | ||
MALWARE_Win_Chebka | Detects Chebka | ditekSHen |
| |
Windows_Trojan_Generic_a681f24a | unknown | unknown |
| |
SUSP_XORed_MSDOS_Stub_Message | Detects suspicious XORed MSDOS stub message | Florian Roth |
| |
Click to see the 61 entries |
⊘No Sigma rule has matched
Timestamp: | 192.168.11.201.1.1.153457532027757 10/04/22-07:11:10.317756 |
SID: | 2027757 |
Source Port: | 53457 |
Destination Port: | 53 |
Protocol: | UDP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 192.168.11.2034.142.181.18160830532014702 10/04/22-07:10:26.141908 |
SID: | 2014702 |
Source Port: | 60830 |
Destination Port: | 53 |
Protocol: | UDP |
Classtype: | Potential Corporate Privacy Violation |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: |
Source: | Code function: | 1_2_00402F10 |
Exploits |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Bitcoin Miner |
---|
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Compliance |
---|
Source: | Unpacked PE file: |
Source: | Static PE information: |
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: | ||
Source: | File created: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | File created: | Jump to behavior |
Source: | Registry value created: | Jump to behavior |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 1_2_00402395 | |
Source: | Code function: | 13_2_00ECE27D | |
Source: | Code function: | 13_2_00ECD72C | |
Source: | Code function: | 13_2_00ECDA5F | |
Source: | Code function: | 13_2_00EDA37B | |
Source: | Code function: | 13_2_00ED64E7 | |
Source: | Code function: | 13_2_00E9C522 | |
Source: | Code function: | 13_2_00ED71DF | |
Source: | Code function: | 13_2_00ED713E | |
Source: | Code function: | 13_2_00ED9E92 | |
Source: | Code function: | 13_2_00ED9FED | |
Source: | Code function: | 19_2_00ECE27D | |
Source: | Code function: | 19_2_00EDA37B | |
Source: | Code function: | 19_2_00ED64E7 | |
Source: | Code function: | 19_2_00E9C522 | |
Source: | Code function: | 19_2_00ED71DF | |
Source: | Code function: | 19_2_00ED713E | |
Source: | Code function: | 19_2_00ECD72C | |
Source: | Code function: | 19_2_00ECDA5F | |
Source: | Code function: | 19_2_00ED9E92 | |
Source: | Code function: | 19_2_00ED9FED |
Networking |
---|
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | DNS query: | ||
Source: | DNS query: |
Source: | Process created: |
Source: | URLs: |
Source: | JA3 fingerprint: | ||
Source: | JA3 fingerprint: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTP traffic detected: |