Windows Analysis Report
pDxGUuWkQt.exe

Overview

General Information

Sample name:	pDxGUuWkQt.exe renamed because original name is a hash value
Original sample name:	a339f7b56a357c8e93d875311bd1dcded299b4612c651a00e87156a0a24ec219.exe
Analysis ID:	1501756
MD5:	ca40affc3d86ceefd70f1e95425be406
SHA1:	860e6e66a22b4845ad468c85e3d8a1df5ce3baa7
SHA256:	a339f7b56a357c8e93d875311bd1dcded299b4612c651a00e87156a0a24ec219
Tags:	120-46-149-112exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Uses known network protocols on non-standard ports

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: pDxGUuWkQt.exe	ReversingLabs: Detection: 31%
Source: pDxGUuWkQt.exe	Virustotal: Detection: 27%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Source: pDxGUuWkQt.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: E:\Project\remote_cs\x64\Release\remote_cs.pdb source: pDxGUuWkQt.exe

Networking

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49707 -> 8888

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 120.46.149.112:8888

Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown	TCP traffic detected without corresponding DNS query: 120.46.149.112

Source: C:\Users\user\Desktop\pDxGUuWkQt.exe

Code function: 0_2_00007FF7D9201000 InternetOpenW,InternetOpenUrlA,InternetReadFile,

0_2_00007FF7D9201000

Source: global traffic

HTTP traffic detected: GET /safekey HTTP/1.1User-Agent: myappHost: 120.46.149.112:8888Cache-Control: no-cache

Source: pDxGUuWkQt.exe, 00000000.00000002.1662091879.00000174B976C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112/&=c
Source: pDxGUuWkQt.exe, 00000000.00000002.1662091879.00000174B976C000.00000004.00000020.00020000.00000000.sdmp, pDxGUuWkQt.exe, 00000000.00000002.1662091879.00000174B97C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey
Source: pDxGUuWkQt.exe, 00000000.00000002.1662091879.00000174B97C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekey9n%
Source: pDxGUuWkQt.exe, 00000000.00000002.1662091879.00000174B97C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.46.149.112:8888/safekeyfn

Source: classification engine

Classification label: mal56.troj.winEXE@2/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:4032:120:WilError_03

Source: pDxGUuWkQt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\pDxGUuWkQt.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pDxGUuWkQt.exe	ReversingLabs: Detection: 31%
Source: pDxGUuWkQt.exe	Virustotal: Detection: 27%

Source: unknown	Process created: C:\Users\user\Desktop\pDxGUuWkQt.exe "C:\Users\user\Desktop\pDxGUuWkQt.exe"
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\pDxGUuWkQt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: pDxGUuWkQt.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: pDxGUuWkQt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pDxGUuWkQt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pDxGUuWkQt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pDxGUuWkQt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pDxGUuWkQt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pDxGUuWkQt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: pDxGUuWkQt.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: pDxGUuWkQt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: E:\Project\remote_cs\x64\Release\remote_cs.pdb source: pDxGUuWkQt.exe

Source: pDxGUuWkQt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pDxGUuWkQt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pDxGUuWkQt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pDxGUuWkQt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pDxGUuWkQt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49707 -> 8888

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: pDxGUuWkQt.exe, 00000000.00000002.1662091879.00000174B976C000.00000004.00000020.00020000.00000000.sdmp, pDxGUuWkQt.exe, 00000000.00000002.1662091879.00000174B97E6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\pDxGUuWkQt.exe

Code function: 0_2_00007FF7D92018D8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7D92018D8

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Code function: 0_2_00007FF7D9201A80 SetUnhandledExceptionFilter,	0_2_00007FF7D9201A80
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Code function: 0_2_00007FF7D92013E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7D92013E4
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	Code function: 0_2_00007FF7D92018D8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7D92018D8

Source: C:\Users\user\Desktop\pDxGUuWkQt.exe

Code function: 0_2_00007FF7D92017B0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7D92017B0

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\Desktop\pDxGUuWkQt.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
120.46.149.112	unknown	China		4847	CNIX-APChinaNetworksInter-ExchangeCN	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://120.46.149.112:8888/safekey	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

ID:	1501756
Product:	CloudBasic
Start time:	12:42:18
Start date:	30.08.2024
Sample:	pDxGUuWkQt.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ca40affc3d86ceefd70f1e95425be406
SHA1:	860e6e66a22b4845ad468c85e3d8a1df5ce3baa7
SHA256:	a339f7b56a357c8e93d875311bd1dcded299b4612c651a00e87156a0a24ec219
Filetype:	Win64 Executable GUI (202006/5) 92.65%

Windows Analysis Report
pDxGUuWkQt.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report pDxGUuWkQt.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted URLs

Windows Analysis Report
pDxGUuWkQt.exe