ID: Sample Name: ikeyhelper.exe Cookbook: default.jbs Time: 16:40:36 Date: 28/12/2017 Version:

Transcription

1 ID: Sample Name: ikeyhelper.exe Cookbook: default.jbs Time: 16:40:36 Date: 28/12/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static PE Info Entrypoint Preview Data Directories Sections Resources Imports Version Infos Network Behavior Code Manipulations Statistics Copyright Joe Security LLC 201 Page 2 of 14

3 Behavior System Behavior Analysis Process: ikeyhelper.exe PID: 336 Parent PID: 306 File Activities Analysis Process: dw20.exe PID: 3416 Parent PID: 336 Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 14

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 16:40:36 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 4s false light ikeyhelper.exe default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 1, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal48.winexe@3/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.exe Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: ikeyhelper.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 14

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Copyright Joe Security LLC 201 Page 5 of 14

6 Signature Overview AV Detection Networking System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section AV Detection: Antivirus detection for submitted file Networking: Urls found in memory or binary data System Summary: Uses Microsoft Silverlight PE file contains a COM descriptor data directory PE file has a big code size Submission file is bigger than most known malware samples Uses new MSVCR Dlls PE file has a big raw section Contains modern PE file flags such as dynamic base (ASLR) or NX Binary contains paths to debug symbols Classification label PE file has an executable.text section and no other executable section Parts of this applications are using the.net runtime (Probably coded in C#) Reads ini files Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Spawns processes Uses an in-process (OLE) Automation server Creates mutexes One or more processes crash PE file contains strange resources Sample file is different than original file name gathered from version info HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging Copyright Joe Security LLC 201 Page 6 of 14

7 Checks if the current process is being debugged Malware Analysis System Evasion: Found a high number of Window / User specific system calls (may be a loop to detect user behavior) May sleep (evasive loops) to hinder dynamic analysis Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Cloud Link ikeyhelper.exe 53% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs Copyright Joe Security LLC 201 Page of 14

8 No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 201 Page 8 of 14

9 Startup System is w ikeyhelper.exe (PID: 336 cmdline: 'C:\Users\user\Desktop\iKeyHelper.exe' MD5: DE0CFA F50C4F1B5) dw20.exe (PID: 3416 cmdline: dw20.exe -x -s 388 MD5: FBA8261A16C65FA441456E366E6E) cleanup Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: PE32 executable (GUI) Intel Mono/.Net assemb ly, for MS Windows TrID: Win32 Executable (generic) a ( /4).20% Generic CIL Executable (.NET, Mono, etc.) (326/58) 0.3% Win16/32 Executable Delphi generic (204/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% File name: ikeyhelper.exe File size: MD5: SHA1: SHA256: SHA512: File Content Preview: de0cfa f50c4f1b5 ac22e45ad8d6204ff3530c80283edaaec1b fe8035cda66b0ce5b0f80d3ed342be50aa1 c155be33c31ba 228f1aa c0601af53da c3ec 32e811dc8cbc0363dac0bf5d31bf8246ecc6e2af38 b4ebc0bdb23bbbea452bd1814 MZ...@...!..L.!Th is program cannot be run in DOS mode...$...pe..l... <.Y...@...]......`...@ @... File Icon Static PE Info Entrypoint: Entrypoint Section: 0x565dde.text Copyright Joe Security LLC 201 Page of 14

10 Digitally signed: false Imagebase: 0x Subsystem: windows gui Image File Characteristics: 32BIT_MACHINE, EXECUTABLE_IMAGE DLL Characteristics: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT Time Stamp: 0x553C15 [Thu Aug 1 06:4:4 201 UTC] TLS Callbacks: CLR (.Net) Version: v OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: f34d5f2d45ed6dceec516c1f5a44 Entrypoint Preview Instruction jmp dword ptr [ h] Copyright Joe Security LLC 201 Page 10 of 14

11 Instruction Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x165d8c 0x4f.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x xf420.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x xc.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 Copyright Joe Security LLC 201 Page 11 of 14

12 Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_IAT 0x2000 0x8.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x2008 0x48.text IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x2000 0x163de4 0x False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rsrc 0x xf420 0x10000 False data IMAGE_SCN_CNT_INITIALIZE D_DATA, IMAGE_SCN_MEM_READ.reloc 0x xc 0x1000 False FoxPro FPT, blocks size 0, next free block index IMAGE_SCN_CNT_INITIALIZE D_DATA, IMAGE_SCN_MEM_DISCARDA BLE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x1666c0 0x114e PNG image data, 256 x 256, 4-bit colormap, noninterlaced RT_ICON 0x x2348 PNG image data, 256 x 256, 8-bit colormap, noninterlaced RT_ICON 0x16b58 0x562a PNG image data, 256 x 256, 8-bit/color RGBA, noninterlaced RT_ICON 0x16f188 0x128 GLS_BINARY_LSB_FIRST RT_ICON 0x16f2b0 0x2e8 data RT_ICON 0x16f58 0x668 data RT_ICON 0x16fc00 0x568 GLS_BINARY_LSB_FIRST RT_ICON 0x x8a8 data RT_ICON 0x10a10 0xea8 data RT_ICON 0x118b8 0x468 GLS_BINARY_LSB_FIRST RT_ICON 0x11d20 0x10a8 data RT_ICON 0x12dc8 0x25a8 data RT_GROUP_ICON 0x1530 0xae MS Windows icon resource - 12 icons, 16-colors RT_VERSION 0x1662f8 0x3c8 data Imports DLL mscoree.dll Import _CorExeMain Version Infos Description Data Translation 0x0000 0x04b0 LegalCopyright Copyright (c) 2008, China Eport Inc. Assembly Version InternalName ikeyhelper.exe FileVersion CompanyName Eport Soft LegalTrademarks Cstt Component Comments SP ProductName ikeyhelper ProductVersion FileDescription ikeyhelper assembly OriginalFilename ikeyhelper.exe Network Behavior No network behavior found Copyright Joe Security LLC 201 Page 12 of 14

13 Code Manipulations Statistics Behavior ikeyhelper.exe dw20.exe Click to jump to process System Behavior Analysis Process: ikeyhelper.exe PID: 336 Parent PID: 306 Start time: 16:42:03 Start date: 28/12/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Users\user\Desktop\iKeyHelper.exe false 'C:\Users\user\Desktop\iKeyHelper.exe' 0x bytes DE0CFA F50C4F1B5.Net C# or VB.NET low File Activities File Path Access Attributes Options Completion Count Source Address Symbol Analysis Process: dw20.exe PID: 3416 Parent PID: 336 Start time: 16:42:03 Start date: 28/12/201 Path: C:\Windows\Microsoft.NET\Framework\v \dw20.exe Wow64 process (32bit): false Commandline: dw20.exe -x -s 388 Copyright Joe Security LLC 201 Page of 14

14 Imagebase: File size: MD5 hash: Programmed in: Reputation: 0x6f bytes FBA8261A16C65FA441456E366E6E C, C++ or other language moderate Registry Activities Key Path Completion Count Source Address Symbol Key Path Name Type Data Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14