Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe

PE32 executable (console) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (console) Intel 80386, for MS Windows
Entropy:	6.549941232930169
Filename:	SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe
Filesize:	219648
MD5:	f32e47eeab5658904b67a491c4c08a39
SHA1:	11661085721eaa76651e7132f4e4ff36722f7ea4
SHA256:	0bda73349659b682a08172de94196235b902784d74457d3cd837aa47f16144f8
SHA512:	7ce6a0111c55ef9403d32d042e333baeb447bd72b8964b3b96fd31639c4d3a9ded955645f89e78921887dc36d5bb9277e2072c70fd03d49dd7a2d3484abb1c45
SSDEEP:	3072:taDgZcejNH8Q24LTOgxIAZlqH1U21uURyFFtRDeAg0FujU4Vlexh:tXjjt8wHxJqVU2Dg/eAOoGMh
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S2^..S0..S0..S0......S0......S0......S0.,.3..S0.,.5.-S0.,.4.4S0......S0..S1.{S0...5..S0......S0...2..S0.Rich.S0.........PE..L..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging
Might use command line arguments	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.569971639959732
Encrypted:	false
Ssdeep:	3:tSyuvaWNoGKcVFBALsJGKgernmK6vk/1dy:8WKbxCsIGrm1/
Size:	116
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe

"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7508
Target ID:	0
Parent PID:	2580
Name:	SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe"
Size:	219648
MD5:	F32E47EEAB5658904B67A491C4C08A39
Time:	06:40:18
Date:	12/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x650000
Modulesize:	241664
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7516
Target ID:	1
Parent PID:	7508
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	06:40:18
Date:	12/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

Details

Is windows:	true
Is dropped:	false
PID:	7560
Target ID:	2
Parent PID:	7508
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	C:\Windows\system32\cmd.exe /c pause
Size:	236544
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Time:	06:40:18
Date:	12/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x240000
Modulesize:	368640
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

Memdumps

Base Address

Regiontype

Protect

Malicious

D0D000

stack

page read and write

687000

unkown

page readonly

10FD000

stack

page read and write

139A000

heap

page read and write

D70000

heap

page read and write

687000

unkown

page readonly

674000

unkown

page readonly

674000

unkown

page readonly

650000

unkown

page readonly

1390000

heap

page read and write

1230000

heap

page read and write

D80000

heap

page read and write

685000

unkown

page readonly

651000

unkown

page execute read

683000

unkown

page write copy

651000

unkown

page execute read

139E000

heap

page read and write

683000

unkown

page read and write

650000

unkown

page readonly

685000

unkown

page readonly

There are 10 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe

Files

Processes

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportSecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe

Files

Processes

Memdumps

IOC Report
SecuriteInfo.com.Win32.Trojan-gen.8494.11198.exe