ID: Sample Name: 29UPDYATHD.exe Cookbook: default.jbs Time: 19:03:31 Date: 06/04/2018 Version:

Transcription

1 ID: 5352 Sample Name: 29UPDYATHD.exe Cookbook: default.jbs Time: 19:03:31 Date: 06/04/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: Data Obfuscation: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Possible Origin Network Behavior Copyright Joe Security LLC 201 Page 2 of 14

3 Code Manipulations Statistics System Behavior Analysis Process: 29UPDYATHD.exe PID: 252 Parent PID: 124 General File Activities File Read Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 14

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 5352 Start time: 19:03:31 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 25s false light 29UPDYATHD.exe default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 1, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.winexe@1/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.exe Show All Exclude process from analysis (whitelisted): dllhost.exe Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: 29UPDYATHD.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 201 Page 4 of 14

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 14

6 Networking Data Obfuscation System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Urls found in memory or binary data Data Obfuscation: Binary may include packed or encrypted code System Summary: PE file contains strange resources Sample file is different than original file name gathered from version info PE file has an executable.text section which is very likely to contain packed code (zlib compression ratio < 0.3).NET source code contains calls to encryption/decryption functions Classification label PE file has an executable.text section and no other executable section Parts of this applications are using the.net runtime (Probably coded in C#) Reads software policies Uses Microsoft Silverlight PE file contains a COM descriptor data directory Uses new MSVCR Dlls Contains modern PE file flags such as dynamic base (ASLR) or NX Binary contains paths to debug symbols HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Program does not show much activity (idle) Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: Program does not show much activity (idle) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Copyright Joe Security LLC 201 Page 6 of 14

7 Behavior Graph Hide Legend ID: 5352 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: 29UPDYATHD.exe Startdate: 06/04/201 Architecture: WINDOWS Score: 1 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started 29UPDYATHD.exe 2 Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 201 Page of 14

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 14

9 Startup System is w cleanup 29UPDYATHD.exe (PID: 252 cmdline: 'C:\Users\user\Desktop\29UPDYATHD.exe' MD5: EFA656C51CBDD5DD02EC5A46141A) Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 201 Page 9 of 14

10 Static File Info General File type: Entropy (bit): PE32 executable (GUI) Intel 036 Mono/.Net assemb ly, for MS Windows TrID: Win32 Executable (generic) a ( /4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (/3) 0.00% File name: File size: 2553 MD5: SHA1: SHA256: SHA512: File Content Preview: 29UPDYATHD.exe efa656c51cbdd5dd02ec5a46141a d9dca9cf9f2599ba56312b5ac45bf9e4569b afdfb6f143bd9c2b945c21e92d12d24d066492fa4 960e429dfde1033b bc9b553e6c44a9deaa4e340c3b12b66af66f2d29d 65164ef5b6e01ec5ac35e6aef56f6e6bdfc93e c09f243c5b02f6a911b69ef2f06 MZ...@...!..L.!Th is program cannot be run in DOS mode...$...pe..l...\ U.Z...B......@.....@......@... File Icon Static PE Info General Entrypoint: 0x43c1e Entrypoint Section:.text Digitally signed: false Imagebase: 0x Subsystem: windows gui Image File Characteristics: 32BIT_MACHINE, EXECUTABLE_IMAGE DLL Characteristics: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT Time Stamp: 0x5AC555C [Fri Apr 6 11:09: UTC] TLS Callbacks: CLR (.Net) Version: v OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: f34d5f2d45ed6d9ceec516c1f5a44 Entrypoint Preview Instruction jmp dword ptr [ h] Copyright Joe Security LLC 201 Page 10 of 14

11 Instruction Copyright Joe Security LLC 201 Page 11 of 14

12 Instruction Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x3cc4 0x5.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x3e000 0x3fa4.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x xc.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x2000 0x.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x200 0x4.text IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x2000 0x3a24 0x3aa00 False hp200 (6010) BSD IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rsrc 0x3e000 0x3fa4 0x4000 False data IMAGE_SCN_CNT_INITIALIZED_ DATA, IMAGE_SCN_MEM_READ.reloc 0x xc 0x200 False data IMAGE_SCN_CNT_INITIALIZED_ DATA, IMAGE_SCN_MEM_DISCARDAB LE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x3e14 0x46 GLS_BINARY_LSB_FIRST RT_ICON 0x3e5b0 0x10a data RT_ICON 0x3f65 0x25a dbase IV DBT of `.DBF, blocks size 4, block length 9216, next free block index 40 RT_GROUP_ICON 0x41c00 0x30 MS Windows icon resource - 3 icons, 16x16, 256-colors RT_VERSION 0x41c30 0x34 data Russian Russia Imports DLL mscoree.dll Import _CorExeMain Version Infos Copyright Joe Security LLC 201 Page 12 of 14

13 Description Data LegalCopyright SecurityCode.EU FileDescription DarkEyE Protector Installation FileVersion Comments CompanyName SecurityCode.EU Translation 0x0409 0x04e4 Possible Origin Language of compilation system Country where language is spoken Map Russian Russia Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: 29UPDYATHD.exe PID: 252 Parent PID: 124 General Start time: 19:04:32 Start date: 06/04/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Users\user\Desktop\29UPDYATHD.exe false 'C:\Users\user\Desktop\29UPDYATHD.exe' 0x bytes EFA656C51CBDD5DD02EC5A46141A true.net C# or VB.NET low File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Read File Path Offset Length Completion Count Source Address C:\Windows\Microsoft.NET\Framework\v \CONFIG\machine.config unknown 4095 success or wait 1 6ABC01C unknown Copyright Joe Security LLC 201 Page of 14 Symbol

14 File Path Offset Length Completion Count Source Address C:\Windows\Microsoft.NET\Framework\v \CONFIG\machine.config unknown 6304 success or wait 3 6ABC01C unknown C:\Windows\Microsoft.NET\Framework\v \CONFIG\machine.config unknown 4106 success or wait 1 6ABC01C unknown C:\Windows\Microsoft.NET\Framework\v \CONFIG\machine.config unknown 4095 success or wait 1 6ABF210 ReadFile C:\Windows\Microsoft.NET\Framework\v \CONFIG\machine.config unknown 6304 success or wait 3 6ABF210 ReadFile C:\Windows\Microsoft.NET\Framework\v \CONFIG\machine.config unknown 4106 success or wait 1 6ABF210 ReadFile Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14