ScreenShot
| Created | 2025.04.22 11:58 | Machine | s1_win7_x6403 |
| Filename | pOqYWAZ.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 46 detected (AIDetectMalware, Redline, Jalapeno, Unsafe, malicious, confidence, high confidence, multiple detections, Miner, Coinminer, CLASSIC, PotentialRisk, AMADEY, YXFDTZ, Detected, RedLineSteal, felfp, GrayWare, Vigorf, ABMiner, NSSG, Artemis, Rzfl, HackTool) | ||
| md5 | 8c2df7e94aecf922bac33303693edc40 | ||
| sha256 | 0775e8cd43f856f12da4aa77fcef506b45c1da669bd37a93ddcb1a1a1f1d4aa3 | ||
| ssdeep | 49152:kDjlabwz922E1G8hl3INPHfdBcZiyuNFBAkpVOZgyo2upnA4yOQC2:0qwE2E1G4ONHdBcMyuNFBAkHOZNoBA4m | ||
| imphash | b1c5b1beabd90d9fdabd1df0779ea832 | ||
| impfuzzy | 48:S9lOXR7cLbc1XFjsX1Pfc++6s1DCpt0/XyGBzX:Szc7cLbc1XFgX1Pfc++gpt0/XyGBzX | ||
Network IP location
Signature (37cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 46 AntiVirus engines on VirusTotal as malicious |
| watch | Collects information about installed applications |
| watch | Communicates with host for which no DNS query was performed |
| watch | Created a service where a service was also not started |
| watch | Creates a suspicious Powershell process |
| watch | Detects Virtual Machines through their custom firmware |
| watch | Drops a binary and executes it |
| watch | Harvests credentials from local FTP client softwares |
| watch | Installs itself for autorun at Windows startup |
| watch | Looks for the Windows Idle Time to determine the uptime |
| watch | One or more non-whitelisted processes were created |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Uses Sysinternals tools in order to add additional command line functionality |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops an executable to the user AppData folder |
| notice | One or more potentially interesting buffers were extracted |
| notice | Queries for potentially installed applications |
| notice | Steals private information from local Internet browsers |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (52cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | detect_Redline_Stealer_V2 | (no description) | binaries (download) |
| danger | RedLine_Stealer_b_Zero | RedLine stealer | binaries (download) |
| danger | RedLine_Stealer_m_Zero | RedLine stealer | memory |
| danger | XMRig_Miner_IN | XMRig Miner | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Network_Downloader | File Downloader | memory |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| watch | Win32_Trojan_PWS_Net_1_Zero | Win32 Trojan PWS .NET Azorult | binaries (download) |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | Is_DotNET_EXE | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
Suricata ids
ET INFO Microsoft net.tcp Connection Initialization Activity
ET MALWARE Redline Stealer TCP CnC Activity
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC - Id1Response
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)
ET MALWARE Redline Stealer TCP CnC Activity
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC - Id1Response
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140048000 LocalFree
0x140048008 GetLastError
0x140048010 SetLastError
0x140048018 FormatMessageW
0x140048020 GetCurrentProcess
0x140048028 DeviceIoControl
0x140048030 SetFileTime
0x140048038 CloseHandle
0x140048040 RemoveDirectoryW
0x140048048 CreateFileW
0x140048050 DeleteFileW
0x140048058 CreateHardLinkW
0x140048060 GetShortPathNameW
0x140048068 GetLongPathNameW
0x140048070 MoveFileW
0x140048078 GetFileType
0x140048080 GetStdHandle
0x140048088 WriteFile
0x140048090 ReadFile
0x140048098 FlushFileBuffers
0x1400480a0 SetEndOfFile
0x1400480a8 SetFilePointer
0x1400480b0 GetCurrentProcessId
0x1400480b8 CreateDirectoryW
0x1400480c0 SetFileAttributesW
0x1400480c8 GetFileAttributesW
0x1400480d0 FindClose
0x1400480d8 FindFirstFileW
0x1400480e0 FindNextFileW
0x1400480e8 GetVersionExW
0x1400480f0 GetModuleFileNameW
0x1400480f8 SetCurrentDirectoryW
0x140048100 GetCurrentDirectoryW
0x140048108 GetFullPathNameW
0x140048110 FoldStringW
0x140048118 GetModuleHandleW
0x140048120 FindResourceW
0x140048128 FreeLibrary
0x140048130 GetProcAddress
0x140048138 ExpandEnvironmentStringsW
0x140048140 ExitProcess
0x140048148 SetThreadExecutionState
0x140048150 Sleep
0x140048158 LoadLibraryW
0x140048160 GetSystemDirectoryW
0x140048168 CompareStringW
0x140048170 AllocConsole
0x140048178 FreeConsole
0x140048180 AttachConsole
0x140048188 WriteConsoleW
0x140048190 GetProcessAffinityMask
0x140048198 CreateThread
0x1400481a0 SetThreadPriority
0x1400481a8 InitializeCriticalSection
0x1400481b0 EnterCriticalSection
0x1400481b8 LeaveCriticalSection
0x1400481c0 DeleteCriticalSection
0x1400481c8 SetEvent
0x1400481d0 ResetEvent
0x1400481d8 ReleaseSemaphore
0x1400481e0 WaitForSingleObject
0x1400481e8 CreateEventW
0x1400481f0 CreateSemaphoreW
0x1400481f8 GetSystemTime
0x140048200 SystemTimeToTzSpecificLocalTime
0x140048208 TzSpecificLocalTimeToSystemTime
0x140048210 SystemTimeToFileTime
0x140048218 FileTimeToLocalFileTime
0x140048220 LocalFileTimeToFileTime
0x140048228 FileTimeToSystemTime
0x140048230 GetCPInfo
0x140048238 IsDBCSLeadByte
0x140048240 MultiByteToWideChar
0x140048248 WideCharToMultiByte
0x140048250 GlobalAlloc
0x140048258 LockResource
0x140048260 GlobalLock
0x140048268 GlobalUnlock
0x140048270 GlobalFree
0x140048278 GlobalMemoryStatusEx
0x140048280 LoadResource
0x140048288 SizeofResource
0x140048290 GetTimeFormatW
0x140048298 GetDateFormatW
0x1400482a0 GetExitCodeProcess
0x1400482a8 GetLocalTime
0x1400482b0 GetTickCount
0x1400482b8 MapViewOfFile
0x1400482c0 UnmapViewOfFile
0x1400482c8 CreateFileMappingW
0x1400482d0 OpenFileMappingW
0x1400482d8 GetCommandLineW
0x1400482e0 SetEnvironmentVariableW
0x1400482e8 GetTempPathW
0x1400482f0 MoveFileExW
0x1400482f8 GetLocaleInfoW
0x140048300 GetNumberFormatW
0x140048308 SetFilePointerEx
0x140048310 GetConsoleMode
0x140048318 GetConsoleCP
0x140048320 HeapSize
0x140048328 SetStdHandle
0x140048330 GetProcessHeap
0x140048338 FreeEnvironmentStringsW
0x140048340 GetEnvironmentStringsW
0x140048348 GetCommandLineA
0x140048350 GetOEMCP
0x140048358 IsValidCodePage
0x140048360 FindNextFileA
0x140048368 RaiseException
0x140048370 GetSystemInfo
0x140048378 VirtualProtect
0x140048380 VirtualQuery
0x140048388 LoadLibraryExA
0x140048390 RtlCaptureContext
0x140048398 RtlLookupFunctionEntry
0x1400483a0 RtlVirtualUnwind
0x1400483a8 UnhandledExceptionFilter
0x1400483b0 SetUnhandledExceptionFilter
0x1400483b8 TerminateProcess
0x1400483c0 IsProcessorFeaturePresent
0x1400483c8 InitializeCriticalSectionAndSpinCount
0x1400483d0 WaitForSingleObjectEx
0x1400483d8 IsDebuggerPresent
0x1400483e0 GetStartupInfoW
0x1400483e8 QueryPerformanceCounter
0x1400483f0 GetCurrentThreadId
0x1400483f8 GetSystemTimeAsFileTime
0x140048400 InitializeSListHead
0x140048408 RtlPcToFileHeader
0x140048410 RtlUnwindEx
0x140048418 EncodePointer
0x140048420 TlsAlloc
0x140048428 TlsGetValue
0x140048430 TlsSetValue
0x140048438 TlsFree
0x140048440 LoadLibraryExW
0x140048448 QueryPerformanceFrequency
0x140048450 GetModuleHandleExW
0x140048458 GetModuleFileNameA
0x140048460 GetACP
0x140048468 HeapFree
0x140048470 HeapAlloc
0x140048478 GetStringTypeW
0x140048480 HeapReAlloc
0x140048488 LCMapStringW
0x140048490 FindFirstFileExA
OLEAUT32.dll
0x1400484a0 SysAllocString
0x1400484a8 SysFreeString
0x1400484b0 VariantClear
gdiplus.dll
0x1400484c0 GdipCloneImage
0x1400484c8 GdipFree
0x1400484d0 GdipDisposeImage
0x1400484d8 GdipCreateBitmapFromStream
0x1400484e0 GdipCreateHBITMAPFromBitmap
0x1400484e8 GdiplusStartup
0x1400484f0 GdiplusShutdown
0x1400484f8 GdipAlloc
EAT(Export Address Table) Library
KERNEL32.dll
0x140048000 LocalFree
0x140048008 GetLastError
0x140048010 SetLastError
0x140048018 FormatMessageW
0x140048020 GetCurrentProcess
0x140048028 DeviceIoControl
0x140048030 SetFileTime
0x140048038 CloseHandle
0x140048040 RemoveDirectoryW
0x140048048 CreateFileW
0x140048050 DeleteFileW
0x140048058 CreateHardLinkW
0x140048060 GetShortPathNameW
0x140048068 GetLongPathNameW
0x140048070 MoveFileW
0x140048078 GetFileType
0x140048080 GetStdHandle
0x140048088 WriteFile
0x140048090 ReadFile
0x140048098 FlushFileBuffers
0x1400480a0 SetEndOfFile
0x1400480a8 SetFilePointer
0x1400480b0 GetCurrentProcessId
0x1400480b8 CreateDirectoryW
0x1400480c0 SetFileAttributesW
0x1400480c8 GetFileAttributesW
0x1400480d0 FindClose
0x1400480d8 FindFirstFileW
0x1400480e0 FindNextFileW
0x1400480e8 GetVersionExW
0x1400480f0 GetModuleFileNameW
0x1400480f8 SetCurrentDirectoryW
0x140048100 GetCurrentDirectoryW
0x140048108 GetFullPathNameW
0x140048110 FoldStringW
0x140048118 GetModuleHandleW
0x140048120 FindResourceW
0x140048128 FreeLibrary
0x140048130 GetProcAddress
0x140048138 ExpandEnvironmentStringsW
0x140048140 ExitProcess
0x140048148 SetThreadExecutionState
0x140048150 Sleep
0x140048158 LoadLibraryW
0x140048160 GetSystemDirectoryW
0x140048168 CompareStringW
0x140048170 AllocConsole
0x140048178 FreeConsole
0x140048180 AttachConsole
0x140048188 WriteConsoleW
0x140048190 GetProcessAffinityMask
0x140048198 CreateThread
0x1400481a0 SetThreadPriority
0x1400481a8 InitializeCriticalSection
0x1400481b0 EnterCriticalSection
0x1400481b8 LeaveCriticalSection
0x1400481c0 DeleteCriticalSection
0x1400481c8 SetEvent
0x1400481d0 ResetEvent
0x1400481d8 ReleaseSemaphore
0x1400481e0 WaitForSingleObject
0x1400481e8 CreateEventW
0x1400481f0 CreateSemaphoreW
0x1400481f8 GetSystemTime
0x140048200 SystemTimeToTzSpecificLocalTime
0x140048208 TzSpecificLocalTimeToSystemTime
0x140048210 SystemTimeToFileTime
0x140048218 FileTimeToLocalFileTime
0x140048220 LocalFileTimeToFileTime
0x140048228 FileTimeToSystemTime
0x140048230 GetCPInfo
0x140048238 IsDBCSLeadByte
0x140048240 MultiByteToWideChar
0x140048248 WideCharToMultiByte
0x140048250 GlobalAlloc
0x140048258 LockResource
0x140048260 GlobalLock
0x140048268 GlobalUnlock
0x140048270 GlobalFree
0x140048278 GlobalMemoryStatusEx
0x140048280 LoadResource
0x140048288 SizeofResource
0x140048290 GetTimeFormatW
0x140048298 GetDateFormatW
0x1400482a0 GetExitCodeProcess
0x1400482a8 GetLocalTime
0x1400482b0 GetTickCount
0x1400482b8 MapViewOfFile
0x1400482c0 UnmapViewOfFile
0x1400482c8 CreateFileMappingW
0x1400482d0 OpenFileMappingW
0x1400482d8 GetCommandLineW
0x1400482e0 SetEnvironmentVariableW
0x1400482e8 GetTempPathW
0x1400482f0 MoveFileExW
0x1400482f8 GetLocaleInfoW
0x140048300 GetNumberFormatW
0x140048308 SetFilePointerEx
0x140048310 GetConsoleMode
0x140048318 GetConsoleCP
0x140048320 HeapSize
0x140048328 SetStdHandle
0x140048330 GetProcessHeap
0x140048338 FreeEnvironmentStringsW
0x140048340 GetEnvironmentStringsW
0x140048348 GetCommandLineA
0x140048350 GetOEMCP
0x140048358 IsValidCodePage
0x140048360 FindNextFileA
0x140048368 RaiseException
0x140048370 GetSystemInfo
0x140048378 VirtualProtect
0x140048380 VirtualQuery
0x140048388 LoadLibraryExA
0x140048390 RtlCaptureContext
0x140048398 RtlLookupFunctionEntry
0x1400483a0 RtlVirtualUnwind
0x1400483a8 UnhandledExceptionFilter
0x1400483b0 SetUnhandledExceptionFilter
0x1400483b8 TerminateProcess
0x1400483c0 IsProcessorFeaturePresent
0x1400483c8 InitializeCriticalSectionAndSpinCount
0x1400483d0 WaitForSingleObjectEx
0x1400483d8 IsDebuggerPresent
0x1400483e0 GetStartupInfoW
0x1400483e8 QueryPerformanceCounter
0x1400483f0 GetCurrentThreadId
0x1400483f8 GetSystemTimeAsFileTime
0x140048400 InitializeSListHead
0x140048408 RtlPcToFileHeader
0x140048410 RtlUnwindEx
0x140048418 EncodePointer
0x140048420 TlsAlloc
0x140048428 TlsGetValue
0x140048430 TlsSetValue
0x140048438 TlsFree
0x140048440 LoadLibraryExW
0x140048448 QueryPerformanceFrequency
0x140048450 GetModuleHandleExW
0x140048458 GetModuleFileNameA
0x140048460 GetACP
0x140048468 HeapFree
0x140048470 HeapAlloc
0x140048478 GetStringTypeW
0x140048480 HeapReAlloc
0x140048488 LCMapStringW
0x140048490 FindFirstFileExA
OLEAUT32.dll
0x1400484a0 SysAllocString
0x1400484a8 SysFreeString
0x1400484b0 VariantClear
gdiplus.dll
0x1400484c0 GdipCloneImage
0x1400484c8 GdipFree
0x1400484d0 GdipDisposeImage
0x1400484d8 GdipCreateBitmapFromStream
0x1400484e0 GdipCreateHBITMAPFromBitmap
0x1400484e8 GdiplusStartup
0x1400484f0 GdiplusShutdown
0x1400484f8 GdipAlloc
EAT(Export Address Table) Library