Infosec Binary Analisys. amd4.exe

Transcription

1 amd4.exe MalScore: 100 File type: File size: PE32 executable (GUI) Intel 80386, for MS Windows KB ( bytes) Compile time: :08:30 MD5: SHA1: Import hash: d b89432c39ee4eeed 1708deae548a1bbe49776b90d91c9f7d1562ad42 baa93d c04d92f7797d9224ce Submitted: :45:06 URL(s) file hosting Antivirus Report Report date Detection Ratio Permalink :34:26 44/67 Import library KERNEL32.dll comctl32.dll 26 Behaviors detected by system signatures Anomalous binary characteristics Page 1 Date: :36:47

2 - anomaly: Unprintable characters found in section name - anomaly: Actual checksum does not match that reported in PE header Checks for the presence of known windows from debuggers and forensic tools - Window: OLLYDBG - Window: GBDYLLO - Window: pediy06 - Window: FilemonClass - Window: File Monitor - Sysinternals: - Window: PROCMON_WINDOW_CLASS - Window: Process Monitor - Sysinternals: - Window: RegmonClass - Window: Registry Monitor - Sysinternals: - Window: A process attempted to delay the analysis task by a long amount of time. - Process: amd4.exe tried to sleep seconds, actually delayed analysis time by 0 seconds - Process: taskeng.exe tried to sleep 540 seconds, actually delayed analysis time by 0 seconds Attempts to repeatedly call a single API many times in order to delay analysis time - Spam: services.exe (488) called API GetSystemTimeAsFileTime times The following process appear to have been packed with Themida: amd4.exe Installs itself for autorun at Windows startup - file: C:\Windows\Tasks\Adobe Flash Player Updater.job - file: C:\Windows\Tasks\Adobe Flash Player Updater.job - task: schtasks /create /tn \Windows\SystemCare\Microsoft /tr "C:\ProgramData\MicrosoftCare.exe" /st 00:00 /sc daily /du 9999:59 /ri 1 /f Creates a hidden or system file - file: C:\ProgramData\MicrosoftCare.exe Checks for the presence of known devices from debuggers and forensic tools Detects the presence of Wine emulator via registry key Checks the version of Bios, possibly for anti-virtualization Detects VirtualBox using ACPI tricks Detects VirtualBox through the presence of a registry key Executed a process and injected code into it, probably while unpacking - Injection: amd4.exe(2540) -> wsqmcons.exe(2096) Deletes its original binary from disk Detects Sandboxie through the presence of a library Creates RWX memory Possible date expiration check, exits too soon after checking local time - process: schtasks.exe, PID 2672 At least one IP Address, Domain, or File Name was found in a crypto call - ioc: inetsim.org0 Expresses interest in specific running processes - process: services.exe - process: net1.exe - process: spoolsv.exe Page 2 Date: :36:47

3 - process: System - process: audiodg.exe - process: conhost.exe - process: svchost.exe - process: SearchFilterHost.exe - process: taskhost.exe - process: mscorsvw.exe Repeatedly searches for a not-found process, may want to run with startbrowser=1 option A process created a hidden window - Process: amd4.exe -> C:\Windows\System32\tasklist.exe HTTP traffic contains suspicious features which may be indicative of malware related traffic - post_no_referer: HTTP traffic contains a POST request with no referer header - suspicious_request: - suspicious_request: - suspicious_request: - suspicious_request: Hhv2XmQQUl0gD6xUIa7myWCPMlC7xxmXSZI4CEAYMGF0qcExPd8gBlISfXSo%3D - suspicious_request: - suspicious_request: Performs some HTTP requests YowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEALE0eWKSmgMVo2jBH5%2BTV8%3D Hhv2XmQQUl0gD6xUIa7myWCPMlC7xxmXSZI4CEAYMGF0qcExPd8gBlISfXSo%3D The binary likely contains encrypted or compressed data. - section: name: \x00, entropy: 7.99, characteristics: IMAGE_SCN_MEM_WRITE, raw_size: 0x0006a400, virtual_size: 0x000e section: name:.rsrc, entropy: 7.10, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE, raw_size: 0x , virtual_size: 0x section: name: dpzogvzm, entropy: 7.92, characteristics: IMAGE_SCN_MEM_WRITE, raw_size: 0x0020f400, virtual_size: 0x section: name: nqvjudhm, entropy: 7.32, characteristics: IMAGE_SCN_MEM_WRITE, raw_size: 0x , virtual_size: 0x Presents an Authenticode digital signature - md5_fingerprint: d6d5a09556e09b29c1e ef sha1_fingerprint: 4ed804a1f4f0111c8bf4529c27e40a cea - cn: Kaspersky Lab - sn: Attempts to connect to a dead IP:Port (2 unique times) Page 3 Date: :36:47

4 - IP: :443 - IP: :80 9 HTTP Request(s) detected tl.cab Hostname: IP Address: tl.cab Hostname: IP Address: AQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEALE0eWKSmgMVo2jBH5%2BTV8%3D Count: 2 Hostname: crl3.digicert.com Page 4 Date: :36:47

5 Hostname: crl4.digicert.com IP Address: pMHhv2XmQQUl0gD6xUIa7myWCPMlC7xxmXSZI4CEAYMGF0qcExPd8gBlISfXSo%3D Hostname: crl3.digicert.com Hostname: crl4.digicert.com IP Address: Page 5 Date: :36:47