Windows Analysis Report
6zZSlt35Hr.exe

Overview

General Information

Sample name: 6zZSlt35Hr.exe
renamed because original name is a hash value
Original sample name: b9c3973d895aa77be8a1a62e249f94aa8c6db03cdcc8c6798ccd3416d5d985ec.exe
Analysis ID: 1501758
MD5: 32ee8c01dc56e509b041e6451a4b18d6
SHA1: 7176af0c03b15009ba1cf26c278228ef249ad75c
SHA256: b9c3973d895aa77be8a1a62e249f94aa8c6db03cdcc8c6798ccd3416d5d985ec
Tags: 120-46-149-112exe
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Uses known network protocols on non-standard ports
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Detected TCP or UDP traffic on non-standard ports
Program does not show much activity (idle)
Sigma detected: Communication To Uncommon Destination Ports

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 6zZSlt35Hr.exe ReversingLabs: Detection: 31%
Source: 6zZSlt35Hr.exe Virustotal: Detection: 40% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: 6zZSlt35Hr.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: E:\Project\remote_cs\x64\Release\remote_cs.pdb source: 6zZSlt35Hr.exe

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 8888
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.10:49700 -> 120.46.149.112:8888
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: unknown TCP traffic detected without corresponding DNS query: 120.46.149.112
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Code function: 0_2_00007FF60A861000 InternetOpenW,InternetOpenUrlA,InternetReadFile,VirtualProtect, 0_2_00007FF60A861000
Source: global traffic HTTP traffic detected: GET /safekey HTTP/1.1User-Agent: myappHost: 120.46.149.112:8888Cache-Control: no-cache
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB6C000.00000004.00000020.00020000.00000000.sdmp, 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey#
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey2a
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey5
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey6
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey7
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekey=
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekeyb
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB6C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://120.46.149.112:8888/safekeyy
Source: classification engine Classification label: mal56.troj.winEXE@1/0@0/1
Source: 6zZSlt35Hr.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 6zZSlt35Hr.exe ReversingLabs: Detection: 31%
Source: 6zZSlt35Hr.exe Virustotal: Detection: 40%
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: 6zZSlt35Hr.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: 6zZSlt35Hr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 6zZSlt35Hr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 6zZSlt35Hr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 6zZSlt35Hr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 6zZSlt35Hr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 6zZSlt35Hr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 6zZSlt35Hr.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: 6zZSlt35Hr.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: E:\Project\remote_cs\x64\Release\remote_cs.pdb source: 6zZSlt35Hr.exe
Source: 6zZSlt35Hr.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 6zZSlt35Hr.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 6zZSlt35Hr.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 6zZSlt35Hr.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 6zZSlt35Hr.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 8888
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB95000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB95000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWmv
Source: 6zZSlt35Hr.exe, 00000000.00000002.1484506899.0000024E1EB51000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Code function: 0_2_00007FF60A8618F8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF60A8618F8
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Code function: 0_2_00007FF60A8618F8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF60A8618F8
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Code function: 0_2_00007FF60A861404 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF60A861404
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Code function: 0_2_00007FF60A861AA0 SetUnhandledExceptionFilter, 0_2_00007FF60A861AA0
Source: C:\Users\user\Desktop\6zZSlt35Hr.exe Code function: 0_2_00007FF60A8617D0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF60A8617D0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1501758 Sample: 6zZSlt35Hr.exe Startdate: 30/08/2024 Architecture: WINDOWS Score: 56 10 Multi AV Scanner detection for submitted file 2->10 12 Uses known network protocols on non-standard ports 2->12 14 AI detected suspicious sample 2->14 5 6zZSlt35Hr.exe 6 2->5         started        process3 dnsIp4 8 120.46.149.112, 49700, 8888 CNIX-APChinaNetworksInter-ExchangeCN China 5->8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
120.46.149.112
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://120.46.149.112:8888/safekey false
  • 4%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown