Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

PE32+ executable (console) x86-64, for MS Windows

initial sample

Details

Filetype:	PE32+ executable (console) x86-64, for MS Windows
Entropy:	4.845965663277242
Filename:	SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
Filesize:	63351
MD5:	038aeec194f57b9b270b4c7163d5a6b3
SHA1:	c901cf779694e1d7f5a79f9de088744b17068adb
SHA256:	5cb230932976abcbdc63ecb275ff92d00d37f94b31cb482cb60dfb4400f86568
SHA512:	cd96a7655c7336b9ad194efce10cc74b8028acc944ef70b7437e75d559efe39d3a9fd86bb6f652966e784e502874c149189d5e5dd3fe01095a4a01901cb109ee
SSDEEP:	768:M1QRyU/GyIfEqTIYv4gKNwFPbJdqPpgawruN4+NPv:HRgEqTIm4gKN2PbJeKh+V
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...7..b.z..c.....'......&...J................@..............................0................ ............................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Found API chain indicative of debugger detection	Anti Debugging
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion Security Software Discovery
One or more processes crash	System Summary
PE file contains more sections than normal	System Summary
PE file contains sections with non-standard names	Data Obfuscation
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service System Time Discovery System Information Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival
PE file has an executable .text section and no other executable section	System Summary
Queries a list of all running processes	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_a3d5b28f45f55dfcfad94157e0e1426378f45bdc_27ead845_a6f82c43-7a16-4296-8c91-11f0f1e3d529\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_a3d5b28f45f55dfcfad94157e0e1426378f45bdc_27ead845_a6f82c43-7a16-4296-8c91-11f0f1e3d529\Report.wer
Category:	dropped
Dump:	Report.wer.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.7010845932714582
Encrypted:	false
Ssdeep:	96:yVF4APlXUsvhDi2GjxfUQXIDcQMc6WcENcw38Y+HbHg/opAnhZAX/d5FMT2SlPkh:uFVUOM0iS3ijRzuiFpZ24lO8nn
Size:	65536
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BB9.tmp.dmp

Mini DuMP crash report, 14 streams, Mon Oct 7 17:26:58 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BB9.tmp.dmp
Category:	dropped
Dump:	WER5BB9.tmp.dmp.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 17:26:58 2024, 0x1205a4 type
Entropy:	1.4893803531684575
Encrypted:	false
Ssdeep:	96:5X8xyXh32rK3zBYi7n9+3A2YXpnxVvnVYmJTGTeRqZiyWIHsIhh+XYqIcvc:CgPmOn5T1numfqsohcYx
Size:	49322
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C08.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C08.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WER5C08.tmp.WERInternalMetadata.xml.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.7020255586272253
Encrypted:	false
Ssdeep:	192:R6l7wVeJlGE46Y9WL9sgmf/zprO89b3wzsf0B9m:R6lXJEE46YcL9sgmf/J3ksff
Size:	8650
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C28.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C28.tmp.xml
Category:	dropped
Dump:	WER5C28.tmp.xml.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.532573630777288
Encrypted:	false
Ssdeep:	48:cvIwWl8zsnrJg771I9oTWpW8VYiYm8M4J5nZlFryq85dzzYX959hQd:uIjfnFI7/i7VSJfiYN7hQd
Size:	4820
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.4.dr
ID:	dr_5
Target ID:	4
Process:	C:\Windows\System32\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.465845532028439
Encrypted:	false
Ssdeep:	6144:lIXfpi67eLPU9skLmb0b4WWSPKaJG8nAgejZMMhA2gX4WABl0uNodwBCswSbu:GXD94WWlLZMM6YFHO+u
Size:	1835008
Whitelisted:	false
Reputation:	low

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.923810216147091
Encrypted:	false
Ssdeep:	3:TsuvdARFSKJKF0CF1JfsEmS/IEbEsbUYGXG:x16FSso0zEQsqXG
Size:	101
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe

"C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7256
Target ID:	0
Parent PID:	2580
Name:	SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.24652.477.exe"
Size:	63351
MD5:	038AEEC194F57B9B270B4C7163D5A6B3
Time:	13:26:58
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	77824
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
PE file contains more sections than normal	System Summary
PE file contains sections with non-standard names	Data Obfuscation
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7264
Target ID:	1
Parent PID:	7256
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	13:26:58
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 7256 -s 208

Details

Is windows:	true
Is dropped:	false
PID:	7364
Target ID:	4
Parent PID:	7256
Name:	WerFault.exe
Path:	C:\Windows\System32\WerFault.exe
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7256 -s 208
Size:	570736
MD5:	FD27D9F6D02763BDE32511B5DF7FF7A0
Time:	13:26:58
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff677760000
Modulesize:	581632
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://upx.sf.net

unknown