Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:24:48 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:24:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:24:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:24:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:24:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 100

ASCII text, with very long lines (553)

downloaded

Chrome Cache Entry: 101

ASCII text, with very long lines (1694)

downloaded

Chrome Cache Entry: 102

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 103

ASCII text, with very long lines (2544)

downloaded

Chrome Cache Entry: 104

ASCII text, with very long lines (2907)

downloaded

Chrome Cache Entry: 105

ASCII text, with very long lines (533)

downloaded

Chrome Cache Entry: 106

HTML document, ASCII text, with very long lines (681)

downloaded

Chrome Cache Entry: 107

ASCII text, with very long lines (3190)

downloaded

Chrome Cache Entry: 108

ASCII text, with very long lines (522)

downloaded

Chrome Cache Entry: 93

ASCII text, with very long lines (755)

downloaded

Chrome Cache Entry: 94

ASCII text, with very long lines (395)

downloaded

Chrome Cache Entry: 95

MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel

downloaded

Chrome Cache Entry: 96

ASCII text, with very long lines (570)

downloaded

Chrome Cache Entry: 97

Web Open Font Format (Version 2), TrueType, length 52280, version 1.0

downloaded

Chrome Cache Entry: 98

ASCII text, with very long lines (683)

downloaded

Chrome Cache Entry: 99

ASCII text, with very long lines (468)

downloaded

There are 13 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5800
Target ID:	0
Parent PID:	1028
Name:	file.exe
Path:	C:\Users\user\Desktop\file.exe
Commandline:	"C:\Users\user\Desktop\file.exe"
Size:	918528
MD5:	EAB946495E838F5895A34747E727374F
Time:	11:24:43
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x750000
Modulesize:	942080
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Credential Flusher	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars

Details

Is windows:	true
Is dropped:	false
PID:	5332
Target ID:	1
Parent PID:	5800
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	11:24:43
Date:	02/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1948,i,14814395722568013072,14306919227150370928,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	4220
Target ID:	4
Parent PID:	5332
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1948,i,14814395722568013072,14306919227150370928,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	11:24:44
Date:	02/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5604 --field-trial-handle=1948,i,14814395722568013072,14306919227150370928,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	8104
Target ID:	5
Parent PID:	5332
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5604 --field-trial-handle=1948,i,14814395722568013072,14306919227150370928,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	11:24:56
Date:	02/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 --field-trial-handle=1948,i,14814395722568013072,14306919227150370928,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	8112
Target ID:	6
Parent PID:	5332
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 --field-trial-handle=1948,i,14814395722568013072,14306919227150370928,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	11:24:56
Date:	02/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://play.google/intl/

unknown

https://families.google.com/intl/

unknown

https://youtube.com/t/terms?gl=

unknown

https://policies.google.com/technologies/location-data

unknown

https://www.google.com/intl/

unknown

https://apis.google.com/js/api.js

unknown

https://policies.google.com/privacy/google-partners

unknown

https://play.google.com/work/enroll?identifier=

unknown

https://policies.google.com/terms/service-specific

unknown

https://g.co/recover

unknown

https://policies.google.com/privacy/additional

unknown

https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072

unknown

https://play.google.com/log?format=json&hasfast=true&authuser=0

172.217.18.110

https://policies.google.com/technologies/cookies

unknown

https://www.google.com/favicon.ico

216.58.206.68

https://policies.google.com/terms

unknown

https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=

unknown

https://www.google.com

unknown

https://play.google.com/log?hasfast=true&authuser=0&format=json

172.217.18.110

https://play.google.com/log?format=json&hasfast=true

unknown

https://www.youtube.com/t/terms?chromeless=1&hl=

unknown

https://support.google.com/accounts?hl=

unknown

https://policies.google.com/terms/location

unknown

https://policies.google.com/privacy

unknown

https://support.google.com/accounts?p=new-si-ui

unknown

https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage

unknown

There are 16 hidden URLs, click here to show them.

Domains

Name

Malicious

youtube-ui.l.google.com

142.250.185.78

www3.l.google.com

216.58.206.46

play.google.com

172.217.18.110

Details

Name:	play.google.com
IP:	172.217.18.110
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

216.58.206.68

Details

Name:	www.google.com
IP:	216.58.206.68
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

youtube.com

142.250.185.78

Details

Name:	youtube.com
IP:	142.250.185.78
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

accounts.youtube.com

unknown

Details

Name:	accounts.youtube.com
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.youtube.com

unknown

Details

Name:	www.youtube.com
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

142.250.185.78

youtube-ui.l.google.com

United States

192.168.2.5

unknown

216.58.206.68

www.google.com

United States

216.58.206.46

www3.l.google.com

United States

239.255.255.250

unknown

Reserved

142.250.184.206

unknown

United States

172.217.18.110

play.google.com

United States

Memdumps

Base Address

Regiontype

Protect

Malicious

1715000

heap

page read and write

1715000

heap

page read and write

171C000

heap

page read and write

171D000

heap

page read and write

143B000

stack

page read and write

2330000

trusted library allocation

page read and write

81C000

unkown

page write copy

142F000

stack

page read and write

1709000

heap

page read and write

23A0000

heap

page read and write

1534000

heap

page read and write

4031000

heap

page read and write

144F000

stack

page read and write

22DE000

stack

page read and write

3CE4000

heap

page read and write

1702000

heap

page read and write

812000

unkown

page readonly

14FE000

stack

page read and write

1534000

heap

page read and write

751000

unkown

page execute read

824000

unkown

page readonly

81C000

unkown

page read and write

1715000

heap

page read and write

1706000

heap

page read and write

14B0000

heap

page read and write

3CE0000

heap

page read and write

164E000

stack

page read and write

170A000

heap

page read and write

4030000

heap

page read and write

16FF000

heap

page read and write

1534000

heap

page read and write

145E000

stack

page read and write

820000

unkown

page write copy

4031000

heap

page read and write

1713000

heap

page read and write

1534000

heap

page read and write

1534000

heap

page read and write

2310000

heap

page read and write

1534000

heap

page read and write

1705000

heap

page read and write

750000

unkown

page readonly

1534000

heap

page read and write

751000

unkown

page execute read

171B000

heap

page read and write

812000

unkown

page readonly

170A000

heap

page read and write

824000

unkown

page readonly

7EC000

unkown

page readonly

1EDE000

stack

page read and write

4031000

heap

page read and write

1534000

heap

page read and write

7EC000

unkown

page readonly

1534000

heap

page read and write

2330000

trusted library allocation

page read and write

1059000

stack

page read and write

141F000

stack

page read and write

16E0000

heap

page read and write

1530000

heap

page read and write

1500000

heap

page read and write

1715000

heap

page read and write

750000

unkown

page readonly

1715000

heap

page read and write

16E8000

heap

page read and write

There are 53 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
file.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportfile.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
file.exe