Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:15:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:15:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:15:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:15:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 19:15:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3408_938942196\LICENSE

ASCII text

dropped

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3408_938942196\_metadata\verified_contents.json

JSON data

dropped

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3408_938942196\manifest.fingerprint

ASCII text, with no line terminators

dropped

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3408_938942196\manifest.json

JSON data

dropped

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3408_938942196\sets.json

JSON data

dropped

Chrome Cache Entry: 85

MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel

downloaded

Chrome Cache Entry: 86

Web Open Font Format (Version 2), TrueType, length 52280, version 1.0

downloaded

Chrome Cache Entry: 87

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 88

ASCII text, with very long lines (553)

downloaded

There are 6 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2700
Target ID:	0
Parent PID:	1028
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	918016
MD5:	E8F25456A80317E47AF911934A95C228
Time:	16:15:53
Date:	01/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x580000
Modulesize:	942080
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Credential Flusher	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --app="https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-features=CrashRecovery

Details

Is windows:	true
Is dropped:	false
PID:	3408
Target ID:	1
Parent PID:	2700
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --app="https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-features=CrashRecovery
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	16:15:53
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1976,i,7912777509037811501,8680786608040553108,262144 --disable-features=CrashRecovery /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6528
Target ID:	4
Parent PID:	3408
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1976,i,7912777509037811501,8680786608040553108,262144 --disable-features=CrashRecovery /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	16:15:54
Date:	01/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://wieistmeineip.de

unknown

https://mercadoshops.com.co

unknown

https://gliadomain.com

unknown

https://poalim.xyz

unknown

https://mercadolivre.com

unknown

https://reshim.org

unknown

https://nourishingpursuits.com

unknown

https://medonet.pl

unknown

https://unotv.com

unknown

https://mercadoshops.com.br

unknown

https://joyreactor.cc

unknown

https://zdrowietvn.pl

unknown

https://johndeere.com

unknown

https://songstats.com

unknown

https://baomoi.com

unknown

https://supereva.it

unknown

https://elfinancierocr.com

unknown

https://bolasport.com

unknown

https://rws1nvtvt.com

unknown

https://desimartini.com

unknown

https://hearty.app

unknown

https://hearty.gift

unknown

https://mercadoshops.com

unknown

https://heartymail.com

unknown

https://nlc.hu

unknown

https://p106.net

unknown

https://radio2.be

unknown

https://finn.no

unknown

https://hc1.com

unknown

https://kompas.tv

unknown

https://mystudentdashboard.com

unknown

https://songshare.com

unknown

https://smaker.pl

unknown

https://mercadopago.com.mx

unknown

https://p24.hu

unknown

https://talkdeskqaid.com

unknown

https://24.hu

unknown

https://mercadopago.com.pe

unknown

https://cardsayings.net

unknown

https://text.com

unknown

https://apis.google.com/js/api.js

unknown

https://mightytext.net

unknown

https://pudelek.pl

unknown

https://hazipatika.com

unknown

https://joyreactor.com

unknown

https://cookreactor.com

unknown

https://wildixin.com

unknown

https://eworkbookcloud.com

unknown

https://cognitiveai.ru

unknown

https://nacion.com

unknown

https://chennien.com

unknown

https://drimer.travel

unknown

https://deccoria.pl

unknown

https://www.google.com/favicon.ico

142.250.185.68

https://mercadopago.cl

unknown

https://talkdeskstgid.com

unknown

https://naukri.com

unknown

https://interia.pl

unknown

https://bonvivir.com

unknown

https://carcostadvisor.be

unknown

https://salemovetravel.com

unknown

https://sapo.io

unknown

https://wpext.pl

unknown

https://welt.de

unknown

https://poalim.site

unknown

https://drimer.io

unknown

https://infoedgeindia.com

unknown

https://blackrockadvisorelite.it

unknown

https://cognitive-ai.ru

unknown

https://cafemedia.com

unknown

https://graziadaily.co.uk

unknown

https://thirdspace.org.au

unknown

https://mercadoshops.com.ar

unknown

https://smpn106jkt.sch.id

unknown

https://elpais.uy

unknown

https://landyrev.com

unknown

https://the42.ie

unknown

https://commentcamarche.com

unknown

https://tucarro.com.ve

unknown

https://rws3nvtvt.com

unknown

https://eleconomista.net

unknown

https://helpdesk.com

unknown

https://mercadolivre.com.br

unknown

https://clmbtech.com

unknown

https://standardsandpraiserepurpose.com

unknown

https://07c225f3.online

unknown

https://salemovefinancial.com

unknown

https://mercadopago.com.br

unknown

https://commentcamarche.net

unknown

https://etfacademy.it

unknown

https://mighty-app.appspot.com

unknown

https://hj.rs

unknown

https://hearty.me

unknown

https://mercadolibre.com.gt

unknown

https://timesinternet.in

unknown

https://indiatodayne.in

unknown

https://idbs-staging.com

unknown

https://blackrock.com

unknown

https://idbs-eworkbook.com

unknown

https://motherandbaby.com

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

youtube-ui.l.google.com

172.217.18.14

www.google.com

142.250.185.68

Details

Name:	www.google.com
IP:	142.250.185.68
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

youtube.com

142.250.74.206

Details

Name:	youtube.com
IP:	142.250.74.206
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

www.youtube.com

unknown

Details

Name:	www.youtube.com
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

142.250.185.68

www.google.com

United States

142.250.74.206

youtube.com

United States

172.217.18.14

youtube-ui.l.google.com

United States

192.168.2.5

unknown

239.255.255.250

unknown

Reserved

Memdumps

Base Address

Regiontype

Protect

Malicious

654000

unkown

page readonly

1510000

heap

page read and write

654000

unkown

page readonly

12D0000

heap

page read and write

1572000

heap

page read and write

156F000

heap

page read and write

1D4E000

stack

page read and write

580000

unkown

page readonly

650000

unkown

page write copy

214E000

stack

page read and write

122F000

stack

page read and write

1558000

heap

page read and write

1484000

heap

page read and write

1484000

heap

page read and write

142E000

stack

page read and write

580000

unkown

page readonly

1583000

heap

page read and write

1430000

heap

page read and write

1577000

heap

page read and write

3E11000

heap

page read and write

3AC4000

heap

page read and write

1578000

heap

page read and write

3AC0000

heap

page read and write

13ED000

stack

page read and write

1575000

heap

page read and write

1484000

heap

page read and write

581000

unkown

page execute read

642000

unkown

page readonly

1484000

heap

page read and write

1484000

heap

page read and write

1582000

heap

page read and write

61C000

unkown

page readonly

61C000

unkown

page readonly

581000

unkown

page execute read

123E000

stack

page read and write

1576000

heap

page read and write

1484000

heap

page read and write

1582000

heap

page read and write

64C000

unkown

page write copy

1484000

heap

page read and write

3E11000

heap

page read and write

1540000

heap

page read and write

1484000

heap

page read and write

642000

unkown

page readonly

3E10000

heap

page read and write

64C000

unkown

page read and write

125F000

stack

page read and write

E6A000

stack

page read and write

39F0000

trusted library allocation

page read and write

1550000

heap

page read and write

1484000

heap

page read and write

126E000

stack

page read and write

124B000

stack

page read and write

1582000

heap

page read and write

1480000

heap

page read and write

There are 45 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
file.exe