Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

173030718882fd8a78aff7fb8b038f7e8db48cb3c09555ed53a2929bebf8d42568818593e6176.dat-decoded.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.78662608756997
Filename:	173030718882fd8a78aff7fb8b038f7e8db48cb3c09555ed53a2929bebf8d42568818593e6176.dat-decoded.exe
Filesize:	356100
MD5:	1a5a84c727dba020f92a765814abcd28
SHA1:	4cc40dcef25834ceff8dc92bf73dd0087b9c2db6
SHA256:	9ad59d548f173fba235517acc0a5dbd416f3890cbf622767da02c83fc0c051e7
SHA512:	bae6730a7ce17e483757607a2d9a4de3aed391f77f6c8f23cb5945b8db08eb1c2afbcda8a14574de5abc8e3f6cd0b8ddeff078a75e512b29c5c976e16c2996f5
SSDEEP:	6144:dYGQfZuMP44Qw+f5osENySVbhRpRbWzlYUJZX1mR6E9KUOexDsVZc:dMUg4465oDzizyOXgwUOT
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.................N........................@.......................................@.................................R......

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
LummaC encrypted strings found	HIPS / PFW / Operating System Protection Evasion	PowerShell Deobfuscate/Decode Files or Information
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Checks if the current process is being debugged	Anti Debugging	Virtualization/Sandbox Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
One or more processes crash	System Summary
PE file does not import any functions	System Summary
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary	System Information Discovery
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_173030718882fd8a_c62f64ea4a81d8f1291a167fe83d794b7c644a0_31f5604f_b246587a-1b60-4daa-b59e-d61a771d10d5\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_173030718882fd8a_c62f64ea4a81d8f1291a167fe83d794b7c644a0_31f5604f_b246587a-1b60-4daa-b59e-d61a771d10d5\Report.wer
Category:	dropped
Dump:	Report.wer.4.dr
ID:	dr_3
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	0.7152449434996158
Encrypted:	false
Ssdeep:	96:hdDF2ZSFx5tanLBtLtVLsft9hv1yDf0QXIDcQzc6CmcE1cw3CF3tE3ts+HbHg6ZZ:f8YFxObLV0NXfPjEzuiFxZ24IO8KS/
Size:	65536
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE134.tmp.dmp

Mini DuMP crash report, 14 streams, Wed Oct 30 16:55:19 2024, 0x1205a4 type

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERE134.tmp.dmp
Category:	dropped
Dump:	WERE134.tmp.dmp.4.dr
ID:	dr_0
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	Mini DuMP crash report, 14 streams, Wed Oct 30 16:55:19 2024, 0x1205a4 type
Entropy:	2.054564572295005
Encrypted:	false
Ssdeep:	96:5b8Rr/z9y4/LnYtni7nfTru2wfJ+lWI/WItDAIZavHf:SuAjCOLaVx+Baff
Size:	19618
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE24E.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERE24E.tmp.WERInternalMetadata.xml
Category:	dropped
Dump:	WERE24E.tmp.WERInternalMetadata.xml.4.dr
ID:	dr_1
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy:	3.704302124196047
Encrypted:	false
Ssdeep:	192:R6l7wVeJRR6Aj6YN6SU9X0gmfRJPWOJpx389bj6sf9YFshm:R6lXJn6Aj6YASU9X0gmfRJPWO+jZf9Y1
Size:	8548
Whitelisted:	false
Reputation:	low

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2BC.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2BC.tmp.xml
Category:	dropped
Dump:	WERE2BC.tmp.xml.4.dr
ID:	dr_2
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	4.563585452127324
Encrypted:	false
Ssdeep:	48:cvIwWl8zsTJg77aI9NaWpW8VYjYm8M4JIKFw2+q8wiS7rU8r5d:uIjftI7jb7VDJhWSHUc5d
Size:	4893
Whitelisted:	false
Reputation:	low

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

Details

File:	C:\Windows\appcompat\Programs\Amcache.hve
Category:	dropped
Dump:	Amcache.hve.4.dr
ID:	dr_4
Target ID:	4
Process:	C:\Windows\SysWOW64\WerFault.exe
Type:	MS Windows registry file, NT/2000 or above
Entropy:	4.417171185622592
Encrypted:	false
Ssdeep:	6144:Scifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNW5+:/i58oSWIZBk2MM6AFBQo
Size:	1835008
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\173030718882fd8a78aff7fb8b038f7e8db48cb3c09555ed53a2929bebf8d42568818593e6176.dat-decoded.exe

"C:\Users\user\Desktop\173030718882fd8a78aff7fb8b038f7e8db48cb3c09555ed53a2929bebf8d42568818593e6176.dat-decoded.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7468
Target ID:	1
Parent PID:	4056
Name:	173030718882fd8a78aff7fb8b038f7e8db48cb3c09555ed53a2929bebf8d42568818593e6176.dat-decoded.exe
Path:	C:\Users\user\Desktop\173030718882fd8a78aff7fb8b038f7e8db48cb3c09555ed53a2929bebf8d42568818593e6176.dat-decoded.exe
Commandline:	"C:\Users\user\Desktop\173030718882fd8a78aff7fb8b038f7e8db48cb3c09555ed53a2929bebf8d42568818593e6176.dat-decoded.exe"
Size:	356100
MD5:	1A5A84C727DBA020F92A765814ABCD28
Time:	12:55:17
Date:	30/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	385024
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
PE file does not import any functions	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 228

Details

Is windows:	true
Is dropped:	false
PID:	7560
Target ID:	4
Parent PID:	7468
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 228
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	12:55:18
Date:	30/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x2c0000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

goalyfeastz.site

servicedny.site

contemteny.site

faulteyotk.site

computeryrati.site

opposezmny.site

dilemmadu.site

seallysl.site

authorisev.site

http://upx.sf.net

unknown

Domains

Name

Malicious

s-part-0017.t-0009.t-msedge.net

13.107.246.45