Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	2.7737530246461977
Filename:	file.exe
Filesize:	9969664
MD5:	18e1d0f8b01ceae85d5d7136c4cf751a
SHA1:	6d79a8cb0795d48ddf9bcf3ff97af16a4508f770
SHA256:	d73bea0eaec1c09fe508f58746a99586c3369be41d08845ba12764a4b2f2a147
SHA512:	22f0cbbf9bcb2f5a1486cf0311ea298950a757af5eb2fbca0cf41cd8513b471eedc81a83db72d99d06cd7aa64d44ad836616f2115e622521a76cf0e90bffa0d4
SSDEEP:	49152:BdDlHdR359lFG9h1347FDDMDquN8qA9NiqaSDT8nfcM8YF1ai:HDlHdZ59li4JMm
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..f...............(..+...................,...@.......................................@... .........................B..

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Drops large PE files	System Summary
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Contains capabilities to detect virtual machines	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Drops PE files	Persistence and Installation Behavior
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
PE file contains sections with non-standard names	Data Obfuscation
Queries information about the installed CPU (vendor, model number etc)	Language, Device and Operating System Detection	Native API
Uses 32bit PE files	Compliance, System Summary	Masquerading
Creates files inside the user directory	System Summary	Masquerading
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Enumerates the file system	Spreading, Malware Analysis System Evasion	File and Directory Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads ini files	System Summary
Reads software policies	System Summary
SQL strings found in memory and binary data	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\service123.exe

PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\service123.exe
Category:	dropped
Dump:	service123.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	0.0023405989925417807
Encrypted:	false
Size:	314617856
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Found evasive API chain (may stop execution after checking mutex)	Malware Analysis System Evasion	Native API
Found stalling execution ending in API Sleep call	Malware Analysis System Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected potential crypto function	System Summary	Encrypted Channel Archive Collected Data
Drops PE files	Persistence and Installation Behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Obfuscated Files or Information Deobfuscate/Decode Files or Information
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains functionality to register its own exception handler	Anti Debugging
Creates mutexes	System Summary
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\Users\user\AppData\Local\Temp\IZImiIFXXrvtVOHFozZW.dll

PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\IZImiIFXXrvtVOHFozZW.dll
Category:	dropped
Dump:	IZImiIFXXrvtVOHFozZW.dll.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\file.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy:	0.05434753529749484
Encrypted:	false
Ssdeep:	49152:TTGv1WxnKPxX8L1111111111111111111111111111111111111111111111R:T6V18
Size:	315803136
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2228
Target ID:	0
Parent PID:	1028
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	9969664
MD5:	18E1D0F8B01CEAE85D5D7136C4CF751A
Time:	18:53:13
Date:	28/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xf00000
Modulesize:	9994240
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Clipboard Hijacker	Stealing of Sensitive Information
Yara detected Cryptbot	Stealing of Sensitive Information, Remote Access Functionality
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\service123.exe

"C:\Users\user\AppData\Local\Temp\service123.exe"

Details

Is windows:	false
Is dropped:	true
PID:	7148
Target ID:	4
Parent PID:	2228
Name:	service123.exe
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\service123.exe"
Size:	314617856
MD5:	F48DE3A26F00253050481FA7F5CD3EC3
Time:	18:54:15
Date:	28/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xcb0000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Clipboard Hijacker	Stealing of Sensitive Information
Drops large PE files	System Summary
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder	System Summary
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

Details

Is windows:	true
Is dropped:	false
PID:	4448
Target ID:	5
Parent PID:	2228
Name:	schtasks.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\schtasks.exe
Commandline:	"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Size:	187904
MD5:	48C2FE20575769DE916F48EF0676A965
Time:	18:54:15
Date:	28/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x2a0000
Modulesize:	204800
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder	System Summary
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

Details

Is windows:	false
Is dropped:	true
PID:	6408
Target ID:	7
Parent PID:	1068
Name:	service123.exe
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Commandline:	C:\Users\user\AppData\Local\Temp\/service123.exe
Size:	314617856
MD5:	F48DE3A26F00253050481FA7F5CD3EC3
Time:	18:54:18
Date:	28/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xcb0000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Clipboard Hijacker	Stealing of Sensitive Information
Drops large PE files	System Summary
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder	System Summary
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\service123.exe

C:\Users\user\AppData\Local\Temp\/service123.exe

Details

Is windows:	false
Is dropped:	true
PID:	5404
Target ID:	8
Parent PID:	1068
Name:	service123.exe
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Commandline:	C:\Users\user\AppData\Local\Temp\/service123.exe
Size:	314617856
MD5:	F48DE3A26F00253050481FA7F5CD3EC3
Time:	18:55:02
Date:	28/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xcb0000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Clipboard Hijacker	Stealing of Sensitive Information
Drops large PE files	System Summary
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder	System Summary
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: Suspicious Schtasks From Env Var Folder	System Summary
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4508
Target ID:	6
Parent PID:	4448
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	18:54:15
Date:	28/09/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

fivevh5pt.top

analforeverlovyu.top

@fivevh5pt.top

https://ac.ecosia.org/autocomplete?q=

unknown

https://duckduckgo.com/chrome_newtab

unknown

https://gcc.gnu.org/bugs/):

unknown

https://duckduckgo.com/ac/?q=

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

http://fivevh5pt.top/9

unknown

https://serviceupdate32.com/update

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://fivevh5pt.top/v1/upload.php

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

https://www.ecosia.org/newtab/

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

There are 6 hidden URLs, click here to show them.

Domains

Name

Malicious

fivevh5pt.top

84.38.182.221

Details

Name:	fivevh5pt.top
IP:	84.38.182.221
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

fp2e7a.wpc.phicdn.net

192.229.221.95

IPs

Domain

Country

Malicious

84.38.182.221

fivevh5pt.top

Russian Federation

Details

IP:	84.38.182.221
TargetID:	0
Current Path:	C:\Users\user\Desktop\file.exe
Country:	Russian Federation
Countrycode:	RUS
ASN number:	49505
ASN name:	SELECTELRU
Private:	false
Domain:	fivevh5pt.top

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

49F0000

heap

page read and write

C70000

heap

page read and write

E210000

heap

page read and write

EC0000

stack

page read and write

1FDB000

heap

page read and write

6C4A8000

unkown

page readonly

F01000

unkown

page execute read

2012000

heap

page read and write

1FE8000

heap

page read and write

CC1000

unkown

page readonly

E243000

heap

page read and write

3E71000

heap

page read and write

1DC0000

remote allocation

page read and write

F00000

unkown

page readonly

456F000

stack

page read and write

3DF1000

heap

page read and write

1FF4000

heap

page read and write

6C45D000

unkown

page read and write

E22D000

heap

page read and write

CC1000

unkown

page readonly

290000

heap

page read and write

C70000

heap

page read and write

6C381000

unkown

page execute read

235F000

unkown

page read and write

1DE5000

heap

page read and write

CCB000

stack

page read and write

1087000

heap

page read and write

FEE000

heap

page read and write

CC1000

unkown

page readonly

CBE000

unkown

page read and write

3E6F000

heap

page read and write

1080000

heap

page read and write

2010000

heap

page read and write

E220000

heap

page read and write

1587000

unkown

page read and write

E33E000

heap

page read and write

1518000

unkown

page read and write

CB1000

unkown

page execute read

1844000

unkown

page readonly

4F5C000

stack

page read and write

1832000

unkown

page readonly

3EAA000

heap

page read and write

47AF000

stack

page read and write

CBA000

unkown

page readonly

C80000

heap

page read and write

150A000

unkown

page read and write

E24B000

heap

page read and write

2056000

heap

page read and write

1C64000

heap

page read and write

E221000

heap

page read and write

FEA000

heap

page read and write

E227000

heap

page read and write

CC1000

unkown

page readonly

1CB0000

heap

page read and write

412D000

stack

page read and write

6C4A9000

unkown

page read and write

3DF1000

heap

page read and write

EA6000

stack

page read and write

1380000

heap

page read and write

1990000

heap

page read and write

DDE000

stack

page read and write

1516000

unkown

page read and write

3E71000

heap

page read and write

3E9D000

heap

page read and write

142E000

stack

page read and write

3EAF000

heap

page read and write

CB0000

unkown

page readonly

CB0000

unkown

page readonly

F01000

unkown

page execute read

1FF4000

heap

page read and write

F30000

heap

page read and write

6C45F000

unkown

page readonly

3E9F000

heap

page read and write

CB1000

unkown

page execute read

1C3E000

stack

page read and write

4D1F000

stack

page read and write

1FD4000

heap

page read and write

CBA000

unkown

page readonly

CBA000

unkown

page readonly

1523000

unkown

page read and write

432D000

stack

page read and write

47EE000

stack

page read and write

3EA3000

heap

page read and write

1511000

unkown

page read and write

11C1000

unkown

page read and write

3E98000

heap

page read and write

1FA0000

heap

page read and write

19DE000

stack

page read and write

1C40000

heap

page read and write

1841000

unkown

page read and write

CBE000

unkown

page write copy

2980000

heap

page read and write

239E000

stack

page read and write

DF0000

heap

page read and write

CB0000

unkown

page readonly

E25F000

heap

page read and write

3EA3000

heap

page read and write

6C380000

unkown

page readonly

CBE000

unkown

page write copy

4B1E000

stack

page read and write

17C8000

unkown

page read and write

E237000

heap

page read and write

1DC0000

remote allocation

page read and write

12C2000

unkown

page read and write

CBE000

unkown

page read and write

C80000

heap

page read and write

3E0E000

heap

page read and write

3DF1000

heap

page read and write

1FAA000

heap

page read and write

1DE0000

heap

page read and write

1DC0000

remote allocation

page read and write

18B0000

heap

page read and write

CB1000

unkown

page execute read

2660000

heap

page read and write

122F000

stack

page read and write

229F000

stack

page read and write

3AAF000

stack

page read and write

CB1000

unkown

page execute read

3E6F000

heap

page read and write

11C1000

unkown

page write copy

436E000

stack

page read and write

3E74000

heap

page read and write

1550000

heap

page read and write

9CC000

stack

page read and write

CB1000

unkown

page execute read

EC7000

stack

page read and write

14A000

stack

page read and write

231E000

unkown

page read and write

49EE000

stack

page read and write

A3C000

stack

page read and write

CB0000

unkown

page readonly

E12D000

heap

page read and write

C3C000

stack

page read and write

C80000

heap

page read and write

1FD4000

heap

page read and write

3E71000

heap

page read and write

1CA0000

heap

page read and write

1507000

unkown

page read and write

1FE8000

heap

page read and write

CBA000

unkown

page readonly

FE0000

heap

page read and write

E23D000

heap

page read and write

ECC000

stack

page read and write

3E1B000

heap

page read and write

3E98000

heap

page read and write

1FAE000

heap

page read and write

3E94000

heap

page read and write

4D5C000

stack

page read and write

CBA000

unkown

page readonly

266B000

heap

page read and write

1302000

unkown

page read and write

CB1000

unkown

page execute read

2007000

heap

page read and write

1841000

unkown

page write copy

3E9D000

heap

page read and write

1844000

unkown

page readonly

3E09000

heap

page read and write

3DF0000

heap

page read and write

1CDA000

heap

page read and write

2790000

heap

page read and write

DE48000

heap

page read and write

1B0000

heap

page read and write

E234000

heap

page read and write

1529000

unkown

page read and write

3E98000

heap

page read and write

9AC000

stack

page read and write

1FEF000

heap

page read and write

F38000

heap

page read and write

3E93000

heap

page read and write

CB0000

unkown

page readonly

CBE000

unkown

page write copy

E245000

heap

page read and write

3E98000

heap

page read and write

E227000

heap

page read and write

CB0000

unkown

page readonly

45AE000

stack

page read and write

23DF000

stack

page read and write

F00000

unkown

page readonly

10D000

stack

page read and write

E92E000

heap

page read and write

14C7000

unkown

page read and write

C20000

heap

page read and write

E3E000

stack

page read and write

CBE000

unkown

page read and write

CBA000

unkown

page readonly

1CD0000

heap

page read and write

EA0000

heap

page read and write

C10000

heap

page read and write

3E9E000

heap

page read and write

CC1000

unkown

page readonly

150E000

unkown

page read and write

6C4AC000

unkown

page readonly

40ED000

stack

page read and write

3DF9000

heap

page read and write

E240000

heap

page read and write

1832000

unkown

page readonly

1C60000

heap

page read and write

3E5B000

heap

page read and write

C00000

heap

page read and write

1FCD000

heap

page read and write

3E60000

heap

page read and write

1DAD000

stack

page read and write

CC1000

unkown

page readonly

ECC000

stack

page read and write

3E9F000

heap

page read and write

EAA000

stack

page read and write

There are 196 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
file.exe