Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.5862426649660595
Filename:	17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Filesize:	493056
MD5:	77d09a6a9cc911ea2c1ae36f7446aabd
SHA1:	9e41f4d68254513e3f7feef21f87255d3574c344
SHA256:	cf856b0d4d3c9b06338e977a5438ad7f53765e086717f71ded4b598b0a788b53
SHA512:	6844d8936c4a8a7ddc7101e73c1dc77b0f90a3a12351ddb7b884acea12ddbf4c5af25c0b3318a8ae2224fdc6130801053f4203731547bebc15fd9ac6f7b07780
SSDEEP:	12288:XuD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSA+DY:K09AfNIEYsunZvZ19ZTs
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)...H...H...H....(..H....*..H....+..H...0]..H..&....H... ...H... ...H... ...H...0J..H...H...I...!...H...!&..H...!...H..Rich.H.

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to bypass UAC (CMSTPLUA)	Privilege Escalation	Bypass User Account Control Access Token Manipulation
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Credentials In Files Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation System Time Discovery
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Machine Learning detection for sample	AV Detection
Abnormal high CPU Usage	System Summary	Access Token Manipulation
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery Ingress Tool Transfer
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Command and Scripting Interpreter Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Information Discovery System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Uses 32bit PE files	Compliance, System Summary
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography	Encrypted Channel
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Creates mutexes	System Summary	Access Token Manipulation
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Might use command line arguments	System Summary
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery Archive Collected Data
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

C:\ProgramData\windir\ops2.dat

data

dropped

Details

File:	C:\ProgramData\windir\ops2.dat
Category:	dropped
Dump:	ops2.dat.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Type:	data
Entropy:	6.701107119467832
Encrypted:	false
Ssdeep:	3:9Tu/celIQg78UKwkXRvGKt9wxopG8/UBGkfx4NElYw8KFfl:Zu/ceSQggUKwkXB39ronGkJFlG+l
Size:	144
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe

"C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe"

Details

Is windows:	false
Is dropped:	false
PID:	3836
Target ID:	0
Parent PID:	4056
Name:	17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Path:	C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Commandline:	"C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe"
Size:	493056
MD5:	77D09A6A9CC911EA2C1AE36F7446AABD
Time:	00:53:43
Date:	23/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	520192
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Uses 32bit PE files	Compliance, System Summary
Yara detected Keylogger Generic	Key, Mouse, Clipboard, Microphone and Screen Capturing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary

URLs

Name

Malicious

championsleague24.duckdns.org

Details

Name:	championsleague24.duckdns.org
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

http://geoplugin.net/json.gp

unknown

Details

Name:	http://geoplugin.net/json.gp
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Source:	17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp/C

unknown

Details

Name:	http://geoplugin.net/json.gp/C
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Source:	17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

championsleague24.duckdns.org

180.19.180.122

Details

Name:	championsleague24.duckdns.org
IP:	180.19.180.122
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

180.19.180.122

championsleague24.duckdns.org

Japan

Details

IP:	180.19.180.122
TargetID:	0
Current Path:	C:\Users\user\Desktop\17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe
Country:	Japan
Countrycode:	JPN
ASN number:	4713
ASN name:	OCNNTTCommunicationsCorporationJP
Private:	false
Domain:	championsleague24.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\wsbdetrdfeyt45-3U0BF6

exepath

HKEY_CURRENT_USER\SOFTWARE\wsbdetrdfeyt45-3U0BF6

licence

HKEY_CURRENT_USER\SOFTWARE\wsbdetrdfeyt45-3U0BF6

time

Memdumps

Base Address

Regiontype

Protect

Malicious

457000

unkown

page readonly

6BE000

heap

page read and write

457000

unkown

page readonly

25E0000

heap

page read and write

20DE000

stack

page read and write

6BA000

heap

page read and write

8AF000

stack

page read and write

9C000

stack

page read and write

22CF000

stack

page read and write

400000

unkown

page readonly

4D6000

heap

page read and write

211C000

stack

page read and write

219E000

stack

page read and write

5EE000

stack

page read and write

24CF000

stack

page read and write

473000

unkown

page read and write

4D0000

heap

page read and write

476000

unkown

page readonly

1F0000

heap

page read and write

23CF000

stack

page read and write

401000

unkown

page execute read

21A0000

heap

page read and write

480000

heap

page read and write

401000

unkown

page execute read

25D0000

heap

page read and write

470000

unkown

page read and write

215C000

stack

page read and write

6B0000

heap

page read and write

19C000

stack

page read and write

470000

unkown

page write copy

25CF000

stack

page read and write

21C0000

heap

page read and write

400000

unkown

page readonly

476000

unkown

page readonly

There are 24 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
17323410667d9914389510ca21e4da9d52e0e3e1cf605c3d0e38cbeee51b87b9fe9bfcb9f3306.dat-decoded.exe