Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SecuriteInfo.com.TROJ_FR.26501A77.11990.exe

PE32 executable (console) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (console) Intel 80386, for MS Windows
Entropy:	5.994294616120263
Filename:	SecuriteInfo.com.TROJ_FR.26501A77.11990.exe
Filesize:	1837568
MD5:	b6e0db27c2b3e62db616b0918a5d8ed8
SHA1:	66c5afcaad55cedfd8fb6d056c1a34802f52969e
SHA256:	1d177ff8ed3a7f17c5e5e4ecebcee3f26f360658bca2e8ad808bd270d1f492de
SHA512:	e99600633a28f9812f0a1e631326310429ec6f11ea773c7255544164a135a76910f8325f5eac86551cc97d5f6701640b5f889e3056cc5aa60d00eaf4bdf258db
SSDEEP:	49152:XB10saFtVM9UHfj96y/Y0ZRPzQOBzY7Sj:Xb0s59UHfJ6uvZQ
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ha.............)........[.......[.......[.......q......j.......j................q..b....q.......[.......q......Rich...........

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging	Security Software Discovery
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to record screenshots	Key, Mouse, Clipboard, Microphone and Screen Capturing	Screen Capture
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Detected potential crypto function	System Summary	System Time Discovery Archive Collected Data
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API Screen Capture
Found evasive API chain (may stop execution after checking a module file name)	Malware Analysis System Evasion
Found large amount of non-executed APIs	Malware Analysis System Evasion	System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
Potential time zone aware malware	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information Security Software Discovery
Contains functionality to create pipes for IPC	Language, Device and Operating System Detection
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection
Contains functionality to query time zone information	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter Security Software Discovery
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary	Security Software Discovery
PE file has a big raw section	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

\Device\ConDrv

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SecuriteInfo.com.TROJ_FR.26501A77.11990.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.300147279309247
Encrypted:	false
Ssdeep:	3:3dDGMDcFsYWryLhQSQoy:MC0sYSyVA
Size:	56
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SecuriteInfo.com.TROJ_FR.26501A77.11990.exe

"C:\Users\user\Desktop\SecuriteInfo.com.TROJ_FR.26501A77.11990.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6240
Target ID:	0
Parent PID:	2580
Name:	SecuriteInfo.com.TROJ_FR.26501A77.11990.exe
Path:	C:\Users\user\Desktop\SecuriteInfo.com.TROJ_FR.26501A77.11990.exe
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.TROJ_FR.26501A77.11990.exe"
Size:	1837568
MD5:	B6E0DB27C2B3E62DB616B0918A5D8ED8
Time:	14:30:58
Date:	20/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x580000
Modulesize:	1875968
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Ncat Network tool	Networking
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE file has a big code size	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	6216
Target ID:	1
Parent PID:	6240
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	14:30:58
Date:	20/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://nmap.org/ncat5.59BETA1Version

unknown

http://nmap.org/ncat

unknown

http://nmap.org/ncat/.

unknown

http://www.openssl.org/support/faq.html

unknown

Memdumps

Base Address

Regiontype

Protect

Malicious

6D6000

unkown

page readonly

6D6000

unkown

page readonly

103F000

stack

page read and write

726000

unkown

page read and write

59D000

unkown

page execute read

725000

unkown

page readonly

C7A000

heap

page read and write

581000

unkown

page execute read

C7E000

heap

page read and write

725000

unkown

page readonly

72D000

unkown

page read and write

BB0000

heap

page read and write

59D000

unkown

page execute read

1040000

heap

page read and write

C70000

heap

page read and write

738000

unkown

page readonly

726000

unkown

page write copy

F3F000

stack

page read and write

1170000

heap

page read and write

727000

unkown

page write copy

B3D000

stack

page read and write

735000

unkown

page read and write

72F000

unkown

page write copy

BD5000

heap

page read and write

C5E000

stack

page read and write

581000

unkown

page execute read

580000

unkown

page readonly

C1E000

stack

page read and write

BD0000

heap

page read and write

BA0000

heap

page read and write

738000

unkown

page readonly

580000

unkown

page readonly

A3C000

stack

page read and write

There are 23 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
SecuriteInfo.com.TROJ_FR.26501A77.11990.exe

Files

Processes

URLs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportSecuriteInfo.com.TROJ_FR.26501A77.11990.exe

Files

Processes

URLs

Memdumps

IOC Report
SecuriteInfo.com.TROJ_FR.26501A77.11990.exe