ID: Sample Name: MobaXterm_installer.dat Cookbook: default.jbs Time: 18:29:43 Date: 25/05/2018 Version:

Transcription

1 ID: 1259 Sample Name: MobaXterm_installer.dat Cookbook: default.jbs Time: 1:29:43 Date: 25/05/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis Process: explorer.exe PID: 29 Parent PID: 544 General File Activities Registry Activities Copyright Joe Security LLC 201 Page 2 of

3 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 11

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 1259 Start time: 1:29:43 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 3s false light MobaXterm_installer.dat (renamed file extension from dat to zip) default.jbs Analysis system description: Windows SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.winzip@1/0@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 201 Page 4 of 11

5 Strategy Score Range Further Analysis Required? Threshold true Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Copyright Joe Security LLC 201 Page 5 of 11

6 Signature Overview Networking System Summary HIPS / PFW / Operating System Protection Evasion Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section Networking: Urls found in memory or binary data System Summary: Classification label Launches a second explorer.exe instance Reads ini files Reads software policies Uses an in-process (OLE) Automation server Uses Rich Edit Controls Submission file is bigger than most known malware samples HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Malware Analysis System Evasion: Found a high number of Window / User specific system calls (may be a loop to detect user behavior) May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Behavior Graph Copyright Joe Security LLC 201 Page of 11

7 Hide Legend ID: 1259 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: MobaXterm_installer.dat Startdate: 25/05/201 Architecture: WINDOWS Score: 0 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started explorer.exe 3 4 Simulations Behavior and APIs Time Type Description 1:30:30 API Interceptor 1203x Sleep call for process: explorer.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link MobaXterm_installe.zip 0% virustotal Browse No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Copyright Joe Security LLC 201 Page of 11

8 No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Screenshots Copyright Joe Security LLC 201 Page of 11

9 Startup System is w cleanup explorer.exe (PID: 29 cmdline: C:\Windows\explorer.exe /factory,{ceff45ee-c2-41de-aee2-a022c1eda92} -Embedding MD5: DDCA324434FFA50CFDC4E51DB935) Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 201 Page 9 of 11

10 Static File Info General File type: Zip archive data, at least v1.0 to extract Entropy (bit): TrID: ZIP compressed archive (4004/1) 42.13% Java Script embedded in Visual Basic Script (3500/0) 3.3% Java Script (2000/0) 21.04% File name: File size: MD5: SHA1: SHA25: SHA512: File Content Preview: MobaXterm_installe.zip 1ccfbaee5a190b5eacec9454d ecdacb0ffde4cf49d94ff41c50c190 00aabd0a05db05019b291f0f2c2a23a2de0d de45dba4e 09f9abaf3f9fcb3f44b4a2e34ae1323cc3 ac152eff1933cd1cde5dcded41f99a1bf91a3ec b3e e1f40ecef0dec PK...J..w...CygUtils.pluginSDn...2]..cd`i.a` q!..t..a.e."t.~fa.f.zn.r.ut...gy...y+rixpk...j......bin/pk...i3`.5...bin/analyzelogs File Icon Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: explorer.exe PID: 29 Parent PID: 544 General Start time: 1:30:30 Start date: 25/05/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: C:\Windows\explorer.exe false C:\Windows\explorer.exe /factory,{ceff45ee-c2-41de-aee2-a022c1eda92} -Embedding 0x bytes DDCA324434FFA50CFDC4E51DB935 true C, C++ or other language Copyright Joe Security LLC 201 Page of 11

11 Reputation: high File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Offset Length Value Ascii Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Registry Activities Key Path Name Type Data Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 11 of 11