Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

A6QFRW2WiY.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.988522009011023
Filename:	A6QFRW2WiY.exe
Filesize:	377384
MD5:	0cee1d66332dec523210f62e479284b9
SHA1:	33f950916e13a6ec654c52160ee47e88c64a5724
SHA256:	0a6a258bfdb9b1947f2945b44e274ff3f06a7c5c733ff83c2a71c5f911fa9cc0
SHA512:	603aa4834c6d3a9f3b6b1629eeb2108cecfd7192110f0cf948f2971957a9231ad9d405d8424e3a41b32a8ff415d8f84e55afdec38bf996703093084162d11972
SSDEEP:	6144:uXfqISDaHCXsYQkiJ0j0Zt/d/WCIRibFrzae5LpVGbM/5Pg+rq8ZrPbXbCEO:uCvXsWtI/dVHbdastVG2ycWEO
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v#.f................................. ........@.. ....................................`................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Process Injection
.NET source code contains very large array initializations	System Summary	Process Injection Disable or Modify Tools
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion	Clipboard Data
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Process Injection Deobfuscate/Decode Files or Information
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
PE / OLE file has an invalid certificate	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Process Injection Masquerading
Binary may include packed or encrypted code	Data Obfuscation	Process Injection Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Process Injection
Contains functionality to modify the execution of threads in other processes
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Process Injection Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking	Process Injection
PE file contains a debug data directory	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A6QFRW2WiY.exe.log

CSV text

modified

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A6QFRW2WiY.exe.log
Category:	modified
Dump:	A6QFRW2WiY.exe.log.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\A6QFRW2WiY.exe
Type:	CSV text
Entropy:	5.353683843266035
Encrypted:	false
Ssdeep:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
Size:	425
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
PE / OLE file has an invalid certificate	System Summary
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

\Device\ConDrv

ASCII text, with CRLF, LF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\A6QFRW2WiY.exe
Type:	ASCII text, with CRLF, LF line terminators
Entropy:	2.2845972159140855
Encrypted:	false
Ssdeep:	3:i6vvRyMivvRya:iKvHivD
Size:	33
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\A6QFRW2WiY.exe

"C:\Users\user\Desktop\A6QFRW2WiY.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6380
Target ID:	0
Parent PID:	1028
Name:	A6QFRW2WiY.exe
Path:	C:\Users\user\Desktop\A6QFRW2WiY.exe
Commandline:	"C:\Users\user\Desktop\A6QFRW2WiY.exe"
Size:	377384
MD5:	0CEE1D66332DEC523210F62E479284B9
Time:	16:10:11
Date:	06/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x1d0000
Modulesize:	393216
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
PE / OLE file has an invalid certificate	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6404
Target ID:	3
Parent PID:	6380
Name:	RegAsm.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Size:	65440
MD5:	0D5DF43AF2916F47D00C1573797C1A13
Time:	16:10:13
Date:	06/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xed0000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	2716
Target ID:	1
Parent PID:	6380
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	16:10:11
Date:	06/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

stogeneratmns.shop

reinforcenh.shop

ghostreedmnu.shop

https://steamcommunity.com/profiles/76561199724331900

104.102.49.254

https://steamcommunity.com/profiles/76561199724331900/inventory/

unknown

fragnantbui.shop

gutterydhowi.shop

offensivedzvju.shop

drawzhotdog.shop

https://sergei-esenin.com/api

172.67.206.204

vozmeatillu.shop

https://steamcommunity.com/profiles/76561199724331900/badges

unknown

https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english

unknown

http://ocsp.entrust.net03

unknown

http://ocsp.entrust.net02

unknown

https://sergei-esenin.com/

unknown

http://store.steampowered.com/subscriber_agreement/

unknown

https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org

unknown

https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6

unknown

https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1

unknown

https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp

unknown

https://drawzhotdog.shop/api-

unknown

https://sergei-esenin.com/apiD

unknown

https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1

unknown

https://reinforcenh.shop/api

unknown

https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&

unknown

https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL

unknown

https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz

unknown

http://crl.entrust.net/ts1ca.crl0

unknown

https://store.steampowered.com/legal/

unknown

https://community.akamai.steamstatic.com/public/shared/javascript

unknown

https://steamcommunity.com/m

unknown

https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english

unknown

https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl

unknown

http://www.entrust.net/rpa03

unknown

http://store.steampowered.com/privacy_agreement/

unknown

http://aia.entrust.net/ts1-chain256.cer01

unknown

https://vozmeatillu.shop/api

unknown

https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw

unknown

https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif

unknown

https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a

unknown

https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg

unknown

https://ghostreedmnu.shop/api

unknown

https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en

unknown

https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0

unknown

https://sergei-esenin.com:443/api

unknown

https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R

unknown

https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english

unknown

https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english

unknown

http://store.steampowered.com/account/cookiepreferences/

unknown

https://steamcommunity.com/

unknown

https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis

unknown

http://crl.entrust.net/2048ca.crl0

unknown

https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC

unknown

https://www.entrust.net/rpa0

unknown

There are 45 hidden URLs, click here to show them.

Domains

Name

Malicious

sergei-esenin.com

172.67.206.204

fragnantbui.shop

unknown

gutterydhowi.shop

unknown

offensivedzvju.shop

unknown

stogeneratmns.shop

unknown

reinforcenh.shop

unknown

drawzhotdog.shop

unknown

ghostreedmnu.shop

unknown

vozmeatillu.shop

unknown

steamcommunity.com

104.102.49.254

IPs

Domain

Country

Malicious

172.67.206.204

sergei-esenin.com

United States

Details

IP:	172.67.206.204
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	sergei-esenin.com

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

104.102.49.254

steamcommunity.com

United States

Details

IP:	104.102.49.254
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	16625
ASN name:	AKAMAI-ASUS
Private:	false
Domain:	steamcommunity.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

400000

remote allocation

page execute and read and write

136E000

stack

page read and write

C20000

heap

page read and write

FD5000

heap

page read and write

1456000

heap

page read and write

FF0000

heap

page read and write

6ED000

heap

page read and write

703000

heap

page read and write

13EE000

heap

page read and write

904000

trusted library allocation

page read and write

6CA000

heap

page read and write

34D1000

trusted library allocation

page read and write

3B8000

stack

page read and write

24D1000

trusted library allocation

page execute and read and write

903000

trusted library allocation

page execute and read and write

FD0000

heap

page read and write

22C000

unkown

page readonly

466E000

stack

page read and write

2F7D000

stack

page read and write

13AA000

heap

page read and write

914000

trusted library allocation

page read and write

6C0000

heap

page read and write

F7C000

stack

page read and write

36DE000

stack

page read and write

45D000

remote allocation

page execute and read and write

8F0000

trusted library allocation

page read and write

13CF000

heap

page read and write

1463000

heap

page read and write

BFE000

stack

page read and write

30BE000

stack

page read and write

630000

heap

page read and write

2BC000

stack

page read and write

31FD000

stack

page read and write

1760000

heap

page read and write

6AE000

stack

page read and write

1370000

heap

page read and write

49B0000

trusted library allocation

page read and write

C00000

heap

page read and write

12FC000

stack

page read and write

1D0000

unkown

page readonly

6CE000

heap

page read and write

B47000

trusted library allocation

page execute and read and write

13A0000

heap

page read and write

37DF000

stack

page read and write

1300000

heap

page read and write

30FD000

stack

page read and write

2FBE000

stack

page read and write

13F1000

heap

page read and write

34D5000

trusted library allocation

page read and write

916000

trusted library allocation

page read and write

8D0000

heap

page read and write

910000

trusted library allocation

page read and write

173D000

stack

page read and write

B2E000

stack

page read and write

13D8000

heap

page read and write

13C6000

heap

page read and write

367E000

stack

page read and write

357E000

stack

page read and write

B4B000

trusted library allocation

page execute and read and write

BB0000

heap

page execute and read and write

BAE000

stack

page read and write

C10000

trusted library allocation

page execute and read and write

620000

heap

page read and write

24D3000

trusted library allocation

page read and write

1D2000

unkown

page readonly

660000

heap

page read and write

1407000

heap

page read and write

A2F000

stack

page read and write

144E000

heap

page read and write

920000

heap

page read and write

8CE000

stack

page read and write

665000

heap

page read and write

6F5000

heap

page read and write

24CE000

stack

page read and write

B3A000

trusted library allocation

page execute and read and write

2E7F000

stack

page read and write

There are 66 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
A6QFRW2WiY.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportA6QFRW2WiY.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
A6QFRW2WiY.exe