Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\injcheat.exe

"C:\Users\user\Desktop\injcheat.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7516
Target ID:	1
Parent PID:	4056
Name:	injcheat.exe
Path:	C:\Users\user\Desktop\injcheat.exe
Commandline:	"C:\Users\user\Desktop\injcheat.exe"
Size:	561016
MD5:	46F8135073242F0382B575B73C992AA6
Time:	00:44:09
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x810000
Modulesize:	565248
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Machine Learning detection for sample	AV Detection
PE / OLE file has an invalid certificate	System Summary
PE file contains an invalid checksum	Data Obfuscation
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7572
Target ID:	3
Parent PID:	7516
Name:	MSBuild.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Size:	262432
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
Time:	00:44:09
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x6a0000
Modulesize:	262144
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 304

Details

Is windows:	true
Is dropped:	false
PID:	7656
Target ID:	6
Parent PID:	7516
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 304
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	00:44:09
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x5f0000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 1620

Details

Is windows:	true
Is dropped:	false
PID:	7848
Target ID:	9
Parent PID:	7572
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 1620
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	00:44:12
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x5f0000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

frizzettei.sbs

laddyirekyi.sbs

https://frizzettei.sbs/api

188.114.96.3

https://epiloggati.sbs/api

188.114.96.3

wickedneatr.sbs

bemuzzeki.sbs

invinjurhey.sbs

epiloggati.sbs

isoplethui.sbs

exilepolsiy.sbs

exemplarou.sbs

http://upx.sf.net

unknown

There are 2 hidden URLs, click here to show them.

Domains

Name

Malicious

frizzettei.sbs

188.114.96.3

Details

Name:	frizzettei.sbs
IP:	188.114.96.3
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

epiloggati.sbs

188.114.96.3

Details

Name:	epiloggati.sbs
IP:	188.114.96.3
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Sample uses string decryption to hide its real strings	AV Detection
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

s-part-0032.t-0009.t-msedge.net

13.107.246.60

time.windows.com

unknown

IPs

Domain

Country

Malicious

188.114.96.3

frizzettei.sbs

European Union

Details

IP:	188.114.96.3
TargetID:	3
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Country:	European Union
Countrycode:	EU
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	frizzettei.sbs

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Sigma detected: Silenttrinity Stager Msbuild Activity	System Summary
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

ProgramId

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

FileId

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

LowerCaseLongPath

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

LongPathHash

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

Name

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

OriginalFileName

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

Publisher

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

Version

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

BinFileVersion

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

BinaryType

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

ProductName

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

ProductVersion

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

LinkDate

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

BinProductVersion

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

AppxPackageFullName

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

AppxPackageRelativeId

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

Size

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

Language

\REGISTRY\A\{03e07d0f-5d75-0d80-c17d-c49ec5ccedd5}\Root\InventoryApplicationFile\injcheat.exe|5efd08f0c441310b

Usn

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData

ClockTimeSeconds

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData

TickCount