ScreenShot
| Created | 2025.04.21 10:57 | Machine | s1_win7_x6401 |
| Filename | TestDumpAll.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 29 detected (Ghanarava, GenericKD, Unsafe, Voj3, malicious, confidence, Detected, Wacatac, ABTrojan, VWYV, Artemis, Chgt, R002H09BO25, susgen, Behavior) | ||
| md5 | fb7ed42de60e8d14b02441f6b2a76fa0 | ||
| sha256 | eef68514cef38f206e48c5b9160358aeea375e4296810b3492d8808aafda40c5 | ||
| ssdeep | 96:dm14s0v1Fvs6KqnC7iyZKxKgddZjvDlPZTh+sWTgkQJJGT+RqKyC7tCEA9m:dm1onvvKqnoK/7ZTh+sSIJJqEqKPA9 | ||
| imphash | 565a435038abcead7cf0faa0feb0ad0f | ||
| impfuzzy | 24:MDtzxTUO70z7LDRdqBzCasVafinkzFv5FV+l:6+Oy7Ltdqx8aKnQF9+l | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 29 AntiVirus engines on VirusTotal as malicious |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Drops an executable to the user AppData folder |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Yara rule detected in process memory |
| info | This executable has a PDB path |
Rules (51cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | IAmTheKing_Family | IAmTheKing Family | binaries (download) |
| danger | Win32_Trojan_Emotet_2_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Microsoft_Office_File_Downloader_Zero | Microsoft Office File Downloader | binaries (download) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | ASPack_Zero | ASPack packed file | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Network_Downloader | File Downloader | binaries (download) |
| watch | Network_Downloader | File Downloader | memory |
| watch | schtasks_Zero | task schedule | memory |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | DllRegisterServer_Zero | execute regsvr32.exe | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | Microsoft_Office_File_Zero | Microsoft Office File | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x402010 CloseHandle
0x402014 GetProcAddress
0x402018 GetModuleHandleA
0x40201c OpenProcess
0x402020 CreateToolhelp32Snapshot
0x402024 Process32First
0x402028 Process32Next
0x40202c CreateFileA
0x402030 DeleteFileA
0x402034 GetNativeSystemInfo
0x402038 CreateDirectoryA
0x40203c GetTickCount
0x402040 QueryPerformanceCounter
0x402044 IsDebuggerPresent
0x402048 SetUnhandledExceptionFilter
0x40204c UnhandledExceptionFilter
0x402050 GetCurrentProcess
0x402054 TerminateProcess
0x402058 InterlockedCompareExchange
0x40205c Sleep
0x402060 InterlockedExchange
0x402064 GetCurrentProcessId
0x402068 GetSystemTimeAsFileTime
0x40206c GetCurrentThreadId
ADVAPI32.dll
0x402000 LookupPrivilegeValueA
0x402004 OpenProcessToken
0x402008 AdjustTokenPrivileges
MSVCR90.dll
0x402074 __p__commode
0x402078 __p__fmode
0x40207c _encode_pointer
0x402080 __set_app_type
0x402084 _crt_debugger_hook
0x402088 ?terminate@@YAXXZ
0x40208c _unlock
0x402090 __dllonexit
0x402094 _lock
0x402098 _onexit
0x40209c _decode_pointer
0x4020a0 _except_handler4_common
0x4020a4 _invoke_watson
0x4020a8 _controlfp_s
0x4020ac __setusermatherr
0x4020b0 _configthreadlocale
0x4020b4 _initterm_e
0x4020b8 _initterm
0x4020bc __initenv
0x4020c0 exit
0x4020c4 _XcptFilter
0x4020c8 _exit
0x4020cc _cexit
0x4020d0 __getmainargs
0x4020d4 _amsg_exit
0x4020d8 sprintf
0x4020dc _adjust_fdiv
0x4020e0 memset
dbghelp.dll
0x4020e8 MiniDumpWriteDump
EAT(Export Address Table) is none
KERNEL32.dll
0x402010 CloseHandle
0x402014 GetProcAddress
0x402018 GetModuleHandleA
0x40201c OpenProcess
0x402020 CreateToolhelp32Snapshot
0x402024 Process32First
0x402028 Process32Next
0x40202c CreateFileA
0x402030 DeleteFileA
0x402034 GetNativeSystemInfo
0x402038 CreateDirectoryA
0x40203c GetTickCount
0x402040 QueryPerformanceCounter
0x402044 IsDebuggerPresent
0x402048 SetUnhandledExceptionFilter
0x40204c UnhandledExceptionFilter
0x402050 GetCurrentProcess
0x402054 TerminateProcess
0x402058 InterlockedCompareExchange
0x40205c Sleep
0x402060 InterlockedExchange
0x402064 GetCurrentProcessId
0x402068 GetSystemTimeAsFileTime
0x40206c GetCurrentThreadId
ADVAPI32.dll
0x402000 LookupPrivilegeValueA
0x402004 OpenProcessToken
0x402008 AdjustTokenPrivileges
MSVCR90.dll
0x402074 __p__commode
0x402078 __p__fmode
0x40207c _encode_pointer
0x402080 __set_app_type
0x402084 _crt_debugger_hook
0x402088 ?terminate@@YAXXZ
0x40208c _unlock
0x402090 __dllonexit
0x402094 _lock
0x402098 _onexit
0x40209c _decode_pointer
0x4020a0 _except_handler4_common
0x4020a4 _invoke_watson
0x4020a8 _controlfp_s
0x4020ac __setusermatherr
0x4020b0 _configthreadlocale
0x4020b4 _initterm_e
0x4020b8 _initterm
0x4020bc __initenv
0x4020c0 exit
0x4020c4 _XcptFilter
0x4020c8 _exit
0x4020cc _cexit
0x4020d0 __getmainargs
0x4020d4 _amsg_exit
0x4020d8 sprintf
0x4020dc _adjust_fdiv
0x4020e0 memset
dbghelp.dll
0x4020e8 MiniDumpWriteDump
EAT(Export Address Table) is none