Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

3ZD5tEC5DH.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.989600940155032
Filename:	3ZD5tEC5DH.exe
Filesize:	374784
MD5:	149131a90f99225e6c7e28a06164dd9a
SHA1:	f9d0e7ae3bed79498bf4da92c0ef9568d4e5595e
SHA256:	6b176bab868dc372496ab3c6ce97518d276c17143f77ae15c992970c1efdf21f
SHA512:	d6f611d974402adba0548c6f15527f2d7f45e2e5a3466ff2d1b93fcd9eb5ae22a96468e8d4c8d428167a0801f2e1f4a702384878a4fec230f79529ba975b309a
SSDEEP:	6144:+aiiJ6qfl9snkFV8FDU+CEMltZVMUwMDp8Aj/TmbGIenjfa9ckFuzyNQhsqayCcp:+aiiJjynkFVnTzl0Aj/TmbNenLnSQhsq
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c.f................................. ........@.. ....................... ............`................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Process Injection
.NET source code contains very large array initializations	System Summary	Process Injection Disable or Modify Tools
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Process Injection Masquerading
Binary may include packed or encrypted code	Data Obfuscation	Process Injection Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Process Injection
Contains functionality to modify the execution of threads in other processes
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse usering and debugging	Anti Debugging	Process Injection Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a debug data directory	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3ZD5tEC5DH.exe.log

CSV text

modified

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3ZD5tEC5DH.exe.log
Category:	modified
Dump:	3ZD5tEC5DH.exe.log.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\3ZD5tEC5DH.exe
Type:	CSV text
Entropy:	5.353683843266035
Encrypted:	false
Ssdeep:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
Size:	425
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

\Device\ConDrv

ASCII text, with CRLF, LF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\3ZD5tEC5DH.exe
Type:	ASCII text, with CRLF, LF line terminators
Entropy:	2.2845972159140855
Encrypted:	false
Ssdeep:	3:i6vvRyMivvRya:iKvHivD
Size:	33
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\3ZD5tEC5DH.exe

"C:\Users\user\Desktop\3ZD5tEC5DH.exe"

Details

Is windows:	false
Is dropped:	false
PID:	404
Target ID:	0
Parent PID:	4004
Name:	3ZD5tEC5DH.exe
Path:	C:\Users\user\Desktop\3ZD5tEC5DH.exe
Commandline:	"C:\Users\user\Desktop\3ZD5tEC5DH.exe"
Size:	374784
MD5:	149131A90F99225E6C7E28A06164DD9A
Time:	03:58:33
Date:	26/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x1e0000
Modulesize:	401408
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5396
Target ID:	3
Parent PID:	404
Name:	RegAsm.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Size:	65440
MD5:	0D5DF43AF2916F47D00C1573797C1A13
Time:	03:58:35
Date:	26/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x950000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	972
Target ID:	1
Parent PID:	404
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	03:58:33
Date:	26/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff66e660000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://drawzhotdog.shop/api

172.67.162.108

lootebarrkeyn.shop

https://gutterydhowi.shop/api

104.21.4.136

stogeneratmns.shop

reinforcenh.shop

https://reinforcenh.shop/api

172.67.208.139

ghostreedmnu.shop

https://steamcommunity.com/profiles/76561199724331900

104.102.49.254

https://vozmeatillu.shop/api

188.114.96.3

https://stogeneratmns.shop/api

188.114.96.3

https://steamcommunity.com/profiles/76561199724331900/inventory/

unknown

https://ghostreedmnu.shop/api

188.114.97.3

fragnantbui.shop

gutterydhowi.shop

https://offensivedzvju.shop/api

188.114.96.3

https://fragnantbui.shop/api

188.114.96.3

offensivedzvju.shop

drawzhotdog.shop

https://performenj.shop/api

172.67.189.2

vozmeatillu.shop

https://steamcommunity.com/profiles/76561199724331900/badges

unknown

https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english

unknown

https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTS

unknown

https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=gC

unknown

https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff

unknown

https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l

unknown

https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=B0lGn8MokmdT&l=e

unknown

http://store.steampowered.com/subscriber_agreement/

unknown

https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org

unknown

https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6

unknown

https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1

unknown

https://offensivedzvju.shop/

unknown

https://performenj.shop/6&

unknown

https://vozmeatillu.shop/

unknown

https://stogeneratmns.shop/&-7

unknown

https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp

unknown

https://steamcommunity.com/N

unknown

https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.c

unknown

https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1

unknown

https://reinforcenh.shop/d&

unknown

https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&

unknown

https://offensivedzvju.shop/W

unknown

https://avatars.akamai.steamstatic.com/fef49e7fa7e199731

unknown

https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL

unknown

https://store.steampowered.com/legal/

unknown

https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e

unknown

https://drawzhotdog.shop/

unknown

https://ghostreedmnu.shop/

unknown

https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english

unknown

https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv

unknown

https://performenj.shop/pi

unknown

https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl

unknown

https://performenj.shop/

unknown

https://gutterydhowi.shop/apiO

unknown

http://store.steampowered.com/privacy_agreement/

unknown

https://community.akamaoE

unknown

https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw

unknown

https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif

unknown

https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg

unknown

https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en

unknown

https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0

unknown

https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg

unknown

https://performenj.shop/apit

unknown

https://stogeneratmns.shop/apiJ

unknown

https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am

unknown

https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english

unknown

https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english

unknown

https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english

unknown

http://store.steampowered.com/account/cookiepreferences/

unknown

https://steamcommunity.com/

unknown

https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english

unknown

https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis

unknown

https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC

unknown

There are 63 hidden URLs, click here to show them.

Domains

Name

Malicious

fragnantbui.shop

188.114.96.3

performenj.shop

172.67.189.2

gutterydhowi.shop

104.21.4.136

offensivedzvju.shop

188.114.96.3

stogeneratmns.shop

188.114.96.3

reinforcenh.shop

172.67.208.139

drawzhotdog.shop

172.67.162.108

ghostreedmnu.shop

188.114.97.3

vozmeatillu.shop

188.114.96.3

lootebarrkeyn.shop

unknown

steamcommunity.com

104.102.49.254

fp2e7a.wpc.phicdn.net

192.229.221.95

There are 2 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

104.21.4.136

gutterydhowi.shop

United States

Details

IP:	104.21.4.136
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	gutterydhowi.shop

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

172.67.189.2

performenj.shop

United States

Details

IP:	172.67.189.2
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	performenj.shop

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

188.114.97.3

ghostreedmnu.shop

European Union

Details

IP:	188.114.97.3
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	European Union
Countrycode:	EU
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	ghostreedmnu.shop

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

172.67.162.108

drawzhotdog.shop

United States

Details

IP:	172.67.162.108
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	drawzhotdog.shop

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

188.114.96.3

fragnantbui.shop

European Union

Details

IP:	188.114.96.3
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	European Union
Countrycode:	EU
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	fragnantbui.shop

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

172.67.208.139

reinforcenh.shop

United States

Details

IP:	172.67.208.139
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	reinforcenh.shop

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

104.102.49.254

steamcommunity.com

United States

Details

IP:	104.102.49.254
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	16625
ASN name:	AKAMAI-ASUS
Private:	false
Domain:	steamcommunity.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

D60000

heap

page read and write

36A5000

trusted library allocation

page read and write

7AE000

stack

page read and write

C20000

trusted library allocation

page read and write

EBA000

heap

page read and write

11BE000

stack

page read and write

F1F000

heap

page read and write

F9A000

heap

page read and write

B5B000

trusted library allocation

page execute and read and write

F6F000

heap

page read and write

2690000

heap

page execute and read and write

977000

heap

page read and write

9B9000

heap

page read and write

2AAD000

stack

page read and write

DDE000

stack

page read and write

E10000

heap

page read and write

460000

remote allocation

page execute and read and write

95E000

heap

page read and write

94A000

trusted library allocation

page execute and read and write

B4F000

stack

page read and write

950000

heap

page read and write

924000

trusted library allocation

page read and write

3278000

trusted library allocation

page read and write

985000

heap

page read and write

923000

trusted library allocation

page execute and read and write

2CAF000

stack

page read and write

F76000

heap

page read and write

640000

heap

page read and write

E5D000

stack

page read and write

24A0000

heap

page read and write

F14000

heap

page read and write

EFF000

heap

page read and write

993000

heap

page read and write

1200000

heap

page read and write

720000

heap

page read and write

7B5000

heap

page read and write

F91000

heap

page read and write

1E0000

unkown

page readonly

23E000

unkown

page readonly

302E000

stack

page read and write

2BAE000

stack

page read and write

C30000

heap

page read and write

326F000

stack

page read and write

26A3000

trusted library allocation

page read and write

DE0000

heap

page read and write

E9E000

stack

page read and write

26A1000

trusted library allocation

page execute and read and write

95A000

heap

page read and write

EB0000

heap

page read and write

F25000

heap

page read and write

316E000

stack

page read and write

36A1000

trusted library allocation

page read and write

936000

trusted library allocation

page read and write

BFE000

stack

page read and write

ED7000

heap

page read and write

B57000

trusted library allocation

page execute and read and write

F8D000

heap

page read and write

934000

trusted library allocation

page read and write

BBE000

stack

page read and write

76E000

stack

page read and write

400000

remote allocation

page execute and read and write

117F000

stack

page read and write

F0B000

heap

page read and write

8BF000

stack

page read and write

F78000

heap

page read and write

2DC000

stack

page read and write

EE9000

heap

page read and write

1E2000

unkown

page readonly

CFC000

stack

page read and write

930000

trusted library allocation

page read and write

F02000

heap

page read and write

97C000

heap

page read and write

C00000

trusted library allocation

page execute and read and write

7B0000

heap

page read and write

3287000

trusted library allocation

page read and write

312D000

stack

page read and write

3D8000

stack

page read and write

C10000

heap

page read and write

EE3000

heap

page read and write

25AF000

stack

page read and write

9FC000

stack

page read and write

D70000

heap

page read and write

910000

trusted library allocation

page read and write

E15000

heap

page read and write

479D000

stack

page read and write

3270000

trusted library allocation

page read and write

F72000

heap

page read and write

8D0000

heap

page read and write

There are 78 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
3ZD5tEC5DH.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report3ZD5tEC5DH.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
3ZD5tEC5DH.exe