Windows
Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.218.20145.exe
Overview
General Information
Detection
Score: | 60 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- SecuriteInfo.com.Win32.MalwareX-gen.218.20145.exe (PID: 4464 cmdline:
"C:\Users\ user\Deskt op\Securit eInfo.com. Win32.Malw areX-gen.2 18.20145.e xe" MD5: B8192D9E9CE7362A3ABA5A02FD309A32) - conhost.exe (PID: 5228 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
Click to jump to signature section
AV Detection |
---|
Source: | Avira: |
Source: | ReversingLabs: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
System Summary |
---|
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Classification label: |
Source: | Mutant created: |
Source: | Key opened: | Jump to behavior |
Source: | ReversingLabs: |
Source: | Process created: | ||
Source: | Process created: |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Static file information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Source: | Last function: |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 System Information Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 DLL Side-Loading | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
39% | ReversingLabs | Win32.Trojan.Generic | ||
100% | Avira | TR/AVI.Agent.hopoj |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1529188 |
Start date and time: | 2024-10-08 18:24:06 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 22s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 6 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | SecuriteInfo.com.Win32.MalwareX-gen.218.20145.exe |
Detection: | MAL |
Classification: | mal60.winEXE@2/0@0/0 |
EGA Information: | Failed |
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target SecuriteInfo.com.Win32.MalwareX-gen.218.20145.exe, PID 4464 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- VT rate limit hit for: SecuriteInfo.com.Win32.MalwareX-gen.218.20145.exe
File type: | |
Entropy (8bit): | 7.9726915726766885 |
TrID: |
|
File name: | SecuriteInfo.com.Win32.MalwareX-gen.218.20145.exe |
File size: | 7'209'984 bytes |
MD5: | b8192d9e9ce7362a3aba5a02fd309a32 |
SHA1: | 93a36ca96babd90db517f329a6a37fc3931667f3 |
SHA256: | 75f0da5d20808037e11e583ccfe0ec12d848e562e768e339e3da321019180806 |
SHA512: | 521cae440f454dfa1b9504c90755ff73499c986954046bc74b937fb09496116428feada8beb7d8de1714d4ade227c04e51e18757509117c48eec11380c66c8bb |
SSDEEP: | 196608:CiSFfmdI7uriJk0NbLEaPHQpmJJ/kkVXTZVJNKqV+:ZWfJ0zcL5Pwp4xTD3JfA |
TLSH: | 757633632275118AF8D5CD3A8637FEE5B1F603ABCA81EC7854DE29C17D134E19723862 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V<1d...............#............=.............@.................................W.n...@.............................O.. |
Icon Hash: | 90cececece8e8eb0 |
Entrypoint: | 0xceba3d |
Entrypoint Section: | .CF6 |
Digitally signed: | true |
Imagebase: | 0x400000 |
Subsystem: | windows cui |
Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
Time Stamp: | 0x64313C56 [Sat Apr 8 10:05:10 2023 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 6 |
OS Version Minor: | 0 |
File Version Major: | 6 |
File Version Minor: | 0 |
Subsystem Version Major: | 6 |
Subsystem Version Minor: | 0 |
Import Hash: | e9d3b3b3fc4283cfcbc15752f4953517 |
Signature Valid: | false |
Signature Issuer: | CN=Daniyar, E=espex@outlook.com, O=EspEx comp, L=Moscow, C=RU |
Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
Error Number: | -2146762487 |
Not Before, Not After |
|
Subject Chain |
|
Version: | 3 |
Thumbprint MD5: | 56ABEF17A392306016865A0C0A159F85 |
Thumbprint SHA-1: | 4722993BB461F9F4C2B0530476CE43C727DBE7FD |
Thumbprint SHA-256: | D7157AB9FFE3645FB0E998D98D08776DFB6EF1EBB25E8C6E07F6702962A8C21E |
Serial: | 6143C24F375C4E3C |
Instruction |
---|
call 00007F665D15DA0Ch |
add ebp, 00000004h |
cmp esp, edi |
cmp edi, 3B205DF5h |
xor ecx, ebx |
stc |
clc |
not ecx |
add ecx, 63880039h |
clc |
cmc |
stc |
ror ecx, 02h |
cmc |
test ebp, 5C8E5288h |
not ecx |
cmc |
xor ebx, ecx |
test esi, edi |
cmp ecx, 02987A6Bh |
jmp 00007F665CCDDCCAh |
jne 00007F665CCFEF7Bh |
mov eax, dword ptr [ebp+00h] |
jmp 00007F665D093CBEh |
dec ecx |
jmp 00007F665CBFCDA2h |
mov ecx, dword ptr [ebp+00h] |
xor dx, bx |
rcr dx, FF8Ch |
movzx dx, dl |
movzx dx, byte ptr [ecx] |
cwde |
add ebp, 00000002h |
mov word ptr [ebp+00h], dx |
movzx ax, bl |
movsx eax, si |
and ax, 00002C41h |
lea edi, dword ptr [edi-00000004h] |
mov eax, dword ptr [edi] |
cmc |
xor eax, ebx |
jmp 00007F665CC77342h |
dec edx |
cmc |
ror edx, 1 |
cmp eax, 4726086Bh |
lea edx, dword ptr [edx+5B0D3454h] |
xor ebx, edx |
cmc |
add esi, edx |
jmp 00007F665D0DFE21h |
jmp esi |
jmp 00007F665CCF9451h |
xor eax, ebx |
test bp, si |
cmp di, bp |
sub eax, 28C363FBh |
cmp sp, 7D2Ch |
clc |
neg eax |
sub eax, 239D495Fh |
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x9d1ce4 | 0xc4f | .CF6 |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0xae96cc | 0x1cc | .CF6 |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xafa000 | 0x1d5 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x6dec00 | 0x1800 | .CF6 |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xaf9000 | 0x608 | .reloc |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x9dad08 | 0x18 | .CF6 |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0xaf82f0 | 0x40 | .CF6 |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x41a000 | 0xc8 | ._h |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x48cf1 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x4a000 | 0xa6b2 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x55000 | 0xda4 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.+&` | 0x56000 | 0x3c395d | 0x0 | d41d8cd98f00b204e9800998ecf8427e | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
._h | 0x41a000 | 0x758 | 0x800 | 4076ab28271f3618c3fcf818ab574a6f | False | 0.07421875 | data | 0.47187042525883377 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.CF6 | 0x41b000 | 0x6dd590 | 0x6dd600 | e5882c3c0b424499bd4230b9f2d11d65 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.reloc | 0xaf9000 | 0x608 | 0x800 | ead0c3977d28c7fcca6af6545f5f6c41 | False | 0.42138671875 | data | 3.5293489168392984 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.rsrc | 0xafa000 | 0x1d5 | 0x200 | 76e8d8753216a6d0e8ebea67318bc15a | False | 0.53125 | data | 4.7176788329467545 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
RT_MANIFEST | 0xafa058 | 0x17d | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5931758530183727 |
DLL | Import |
---|---|
KERNEL32.dll | Process32First |
USER32.dll | DispatchMessageA |
ADVAPI32.dll | GetUserNameA |
MSVCP140.dll | ??Bid@locale@std@@QAEIXZ |
d3d11.dll | D3D11CreateDeviceAndSwapChain |
dwmapi.dll | DwmExtendFrameIntoClientArea |
IMM32.dll | ImmReleaseContext |
D3DCOMPILER_43.dll | D3DCompile |
XINPUT1_3.dll | |
VCRUNTIME140.dll | _CxxThrowException |
api-ms-win-crt-heap-l1-1-0.dll | _callnewh |
api-ms-win-crt-runtime-l1-1-0.dll | _seh_filter_exe |
api-ms-win-crt-stdio-l1-1-0.dll | fflush |
api-ms-win-crt-string-l1-1-0.dll | strncpy |
api-ms-win-crt-utility-l1-1-0.dll | qsort |
api-ms-win-crt-convert-l1-1-0.dll | atof |
api-ms-win-crt-locale-l1-1-0.dll | setlocale |
api-ms-win-crt-math-l1-1-0.dll | _CIfmod |
api-ms-win-crt-filesystem-l1-1-0.dll | _lock_file |
KERNEL32.dll | GetSystemTimeAsFileTime |
USER32.dll | CharUpperBuffW |
KERNEL32.dll | LocalAlloc, LocalFree, GetModuleFileNameW, ExitProcess, LoadLibraryA, GetModuleHandleA, GetProcAddress |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
English | United States |
Click to jump to process
Click to jump to process
Click to jump to process
Target ID: | 0 |
Start time: | 12:24:56 |
Start date: | 08/10/2024 |
Path: | C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.218.20145.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0xe40000 |
File size: | 7'209'984 bytes |
MD5 hash: | B8192D9E9CE7362A3ABA5A02FD309A32 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | false |
Target ID: | 1 |
Start time: | 12:24:57 |
Start date: | 08/10/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff7699e0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |