Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

origin.bin.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	4.115057124214167
Filename:	origin.bin.exe
Filesize:	26112
MD5:	0b8bb8ed90799aa967281f96d1b3a75d
SHA1:	f083724cffd51f9bd9afe08419598c9672cf8caf
SHA256:	5016ba92afac1c2b2a2a6b17a09406869bd6f58cfe680f25030af1a1ba1c29a2
SHA512:	9571b38bc86971adeb6a0f18e6bdcdcb704e00a845bd5c8f62e3d4237789221e3fb8962a6ae5d7860fbf3ec6a1ba7a7ec263cf1f343a50704ed0620809f27e38
SSDEEP:	192:YLj1DESCjSLuZmff5XLO4gZYQHbEvNesGhv:YZE5WLuoff5XLOZYCgvNesc
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...."................0......L......F6... ...@....@.. ....................................`................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains potential unpacker	Data Obfuscation	Software Packing
Machine Learning detection for sample	AV Detection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Checks if the current process is being debugged	Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Archive Collected Data
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
One or more processes crash	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_origin.bin.exe_7d6a97761f20f53c7dc4c45612edad3adb8344b_fcb3c975_4933da78-9d97-4b66-b347-40729795de4e\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_origin.bin.exe_7d6a97761f20f53c7dc4c45612edad3adb8344b_fcb3c975_4933da78-9d97-4b66-b347-40729795de4e\Report.wer
Category:	dropped
Dump:	Report.wer.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	1.2333184430792796
Encrypted:	false
Ssdeep:	192:6KRleBb6Nlm0BU/KaWOJooZruNcJzuiF/Z24IO8D:6SIBb6VBU/KaxUcJzuiF/Y4IO8D
Size:	65536
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83F6.tmp.dmp

Mini DuMP crash report, 15 streams, Tue Oct 1 15:03:05 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER83F6.tmp.dmp
Category:	dropped
Dump:	WER83F6.tmp.dmp.4.dr
ID:	dr_0
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 15 streams, Tue Oct 1 15:03:05 2024, 0x1205a4 type
Entropy:	3.7168636686773247
Encrypted:	false
Ssdeep:	3072:t0xLZa4uEqLLTgoCkpBy+Ci7hg1j9zjUKMnS:tELZa4ITgoCWy+zSrQK
Size:	349409
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER87B0.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER87B0.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER87B0.tmp.WERInternalMetadata.xml.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.6942624208781187
Encrypted:	false
Ssdeep:	192:R6l7wVeJSjh68uri6Y9hSU9M19gmfZ8ppre89b0Vsf+cm:R6lXJkh68u+6Y7SU9M19gmfuj0ufc
Size:	8454
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER87D0.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER87D0.tmp.xml
Category:	dropped
Dump:	WER87D0.tmp.xml.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.477203865109298
Encrypted:	false
Ssdeep:	48:cvIwWl8zs3Jg77aI9h+WpW8VYlYm8M4JVEFlj+q8v0WHTTWhd:uIjfZI73/7VVJuKHTTWhd
Size:	4787
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.465554192294244
Encrypted:	false
Ssdeep:	6144:PIXfpi67eLPU9skLmb0b4fWSPKaJG8nAgejZMMhA2gX4WABl0uNTdwBCswSbB:gXD94fWlLZMM6YFHd+B
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\origin.bin.exe

"C:\Users\user\Desktop\origin.bin.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7308
Target ID:	0
Parent PID:	2580
Name:	origin.bin.exe
Path:	C:\Users\user\Desktop\origin.bin.exe
Commandline:	"C:\Users\user\Desktop\origin.bin.exe"
Size:	26112
MD5:	0B8BB8ED90799AA967281F96D1B3A75D
Time:	11:02:54
Date:	01/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xa80000
Modulesize:	49152
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7308 -s 2340

Details

Is windows:	true
Is dropped:	false
PID:	7684
Target ID:	4
Parent PID:	7308
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7308 -s 2340
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	11:03:04
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x820000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://savory.com.bd/comments/feed/

unknown

https://savory.com.bd/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.24.4

unknown

https://savory.com.bd/wp-content/plugins/simple-job-board/sjb-block/dist/blocks.style.build.css

unknown

https://savory.com.bd/wp-includes/css/dist/preferences/style.min.css?ver=6.6.2

unknown

http://www.fontbureau.com/designers

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/css/thegem-widgets.css?ver=6.6.2

unknown

http://ogp.me/ns/fb#

unknown

https://savory.com.bd/

unknown

http://www.sajatypeworks.com

unknown

http://www.founder.com.cn/cn/cThe

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/css/thegem-grid.css?ver=6.6.2

unknown

http://savory.com.bd/sav/Ztvfo.pngd

unknown

https://savory.com.bd/wp-includes/css/dist/block-library/style.min.css?ver=6.6.2

unknown

http://savory.com.bd/sav/Ztvfo.png

65.181.111.142

https://savory.com.bd/wp-content/plugins/simple-job-board/includes/css/font-awesome.min.css?ver=5.15

unknown

http://www.galapagosdesign.com/DPlease

unknown

https://savory.com.bd/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

unknown

https://savory.com.bd/xmlrpc.php

unknown

http://www.urwpp.deDPlease

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=9.3.3

unknown

http://www.zhongyicts.com.cn

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=9.3.3

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://savory.com.bd/wp-content/plugins/easy-login-woocommerce/xoo-form-fields-fw/lib/fontawesome5/

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/fonts/WooCommerce.svg#WooCommerce

unknown

http://savory.com.bd/wp-content/uploads/2022/04/Loginiage5.jpg);

unknown

https://savory.com.bd/wp-content/plugins/jetwoo-widgets-for-elementor/assets/css/jet-woo-widgets.css

unknown

https://savory.com.bd/wp-content/plugins/thegem-elements-elementor/inc/gdpr/assets/css/public.css?ve

unknown

http://savory.com.bdd

unknown

https://savory.com.bd/wp-content/plugins/zilla-likes/scripts/zilla-likes.js?ver=6.6.2

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/css/thegem-woocommerce-minicart.css?ver=6.6

unknown

https://savory.com.bd/wp-includes/css/dist/block-editor/style.min.css?ver=6.6.2

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/fonts/WooCommerce.eot?#iefix

unknown

https://savory.com.bd/wp-content/plugins/easy-login-woocommerce/xoo-form-fields-fw/assets/css/xoo-af

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/css/thegem-new-css.css?ver=6.6.2

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/style.css?ver=6.6.2

unknown

https://schema.org

unknown

https://savory.com.bd/wp-content/plugins/simple-job-board/public/css/jquery-ui.css?ver=1.12.1

unknown

http://gmpg.org/xfn/11

unknown

http://www.carterandcone.coml

unknown

http://www.fontbureau.com/designers/frere-user.html

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?

unknown

https://savory.com.bd/wp-includes/css/dist/editor/style.min.css?ver=6.6.2

unknown

http://ogp.me/ns#

unknown

https://savory.com.bd/?s=

unknown

https://savory.com.bd/wp-content/plugins/easy-login-woocommerce/assets/css/xoo-el-style.css?ver=2.7.

unknown

https://savory.com.bd/wp-json/

unknown

https://savory.com.bd/wp-content/plugins/LayerSlider/assets/static/layerslider/css/layerslider.css?v

unknown

http://www.fontbureau.com/designersG

unknown

http://savory.com.bd

unknown

https://savory.com.bd/sav/Ztvfo.png

65.181.111.142

https://savory.com.bd/wp-content/themes/thegem-elementor/css/custom-3qA74UHG.css?ver=6.6.2

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/css/thegem-preloader.css?ver=6.6.2

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.founder.com.cn/cn/bThe

unknown

https://savory.com.bd/xmlrpc.php?rsd

unknown

https://yoast.com/wordpress/plugins/seo/

unknown

http://www.fontbureau.com/designers?

unknown

https://savory.com.bd

unknown

http://savory.com.bd8

unknown

http://www.tiro.com

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/fonts/WooCommerce.ttf

unknown

http://www.goodfont.co.kr

unknown

https://savory.com.bd/feed/

unknown

https://savory.com.bd/wp-content/plugins/simple-job-board/public/css/simple-job-board-public.css?ver

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/css/thegem-perevazka-css.css?ver=6.6.2

unknown

https://savory.com.bd/wp-includes/css/dist/components/style.min.css?ver=6.6.2

unknown

https://layerslider.kreaturamedia.com

unknown

http://www.typography.netD

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

https://savory.com.bd/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9.8

unknown

https://savory.com.bd/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/css/vi

unknown

https://savory.com.bd/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/wishlist.css?ver=3.38.0

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/fonts/WooCommerce.eot

unknown

https://savory.com.bd/#website

unknown

http://www.sakkal.com

unknown

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/css/thegem-reset.css?ver=6.6.2

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-

unknown

https://savory.com.bd/wp-content/plugins/woocommerce/assets/fonts/WooCommerce.woff

unknown

https://api.w.org/

unknown

http://upx.sf.net

unknown

http://www.microsoft.

unknown

https://savory.com.bd/wp-content/plugins/easy-login-woocommerce/xoo-form-fields-fw/assets/js/xoo-aff

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/js/fancyBox/jquery.fancybox.min.css?ver=6.6

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.founder.com.cn/cn

unknown

http://www.jiyu-kobo.co.jp/

unknown

https://savory.com.bd/wp-includes/css/dist/patterns/style.min.css?ver=6.6.2

unknown

http://www.fontbureau.com/designers8

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/css/thegem-header.css?ver=6.6.2

unknown

https://savory.com.bd/wp-content/themes/thegem-elementor/js/html5.js?ver=3.7.3

unknown

https://savory.com.bd/wp-includes/css/dist/reusable-blocks/style.min.css?ver=6.6.2

unknown

https://savory.com.bd/wp-content/plugins/easy-login-woocommerce/assets/css/xoo-el-fonts.css?ver=2.7.

unknown

There are 88 hidden URLs, click here to show them.

Domains

Name

Malicious

savory.com.bd

65.181.111.142

Details

Name:	savory.com.bd
IP:	65.181.111.142
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

65.181.111.142

savory.com.bd

United States

Details

IP:	65.181.111.142
TargetID:	0
Current Path:	C:\Users\user\Desktop\origin.bin.exe
Country:	United States
Countrycode:	USA
ASN number:	25653
ASN name:	FORTRESSITXUS
Private:	false
Domain:	savory.com.bd

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking