MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34f907b9f543ecf0f4f99adb7e55963ab5bc1c8e6e64081a8fef9a06043828b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34f907b9f543ecf0f4f99adb7e55963ab5bc1c8e6e64081a8fef9a06043828b7
SHA3-384 hash: 29447aaba3f9f887ad1ea12aa53d7d51457f08a47edeaedd73b47a29415a727308ce761c1a977bf8178321ca71c60744
SHA1 hash: 2ad51f3bc82585a120159510c61db6e90474c2cd
MD5 hash: a587a2af22c7e18a0260cab5c06d980d
humanhash: tango-snake-march-hotel
File name:file.exe
Download: download sample
File size:2'262'404 bytes
First seen:2021-01-05 14:30:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:4zp05O4e/gDaWOtBFvmfYecnmIjlEpDI5R3WRo3NzJX:4lahOtjytcnmIKBI5R3WRo3dJX
Threatray 126 similar samples on MalwareBazaar
TLSH 97A52301BDC2C472D8B269302D37AA60597E7C684F24EBDBE3F8516D9E718D26534B83
Reporter James_inthe_box
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
Suspicious activity
Analysis date:
2021-01-05 14:33:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/65da447e-ec33-4c37-bd32-2551c5b5ad26

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/110585/
Detection(s):
SecuriteInfo.com.BackDoor.SiggenNET.5.27436.8753.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
Creating a window
Searching for the window
Creating a file
Creating a process from a recently created file
Launching a process
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Creating a service
Launching a service
Creating a file in the Windows subdirectories
Sending a UDP request
DNS request
Sending a custom TCP request
Adding an access-denied ACE
Sending an HTTP GET request
Enabling autorun for a service
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/574255
Signature
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Detected unpacking (creates a PE file in dynamic memory)
Installs a global keyboard hook
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 336189 Sample: file.exe Startdate: 05/01/2021 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Detected unpacking (creates a PE file in dynamic memory) 2->56 58 4 other signatures 2->58 7 file.exe 7 2->7         started        10 WMIOEMHelper.exe 2->10         started        13 svchost.exe 2->13         started        15 8 other processes 2->15 process3 dnsIp4 34 C:\Program Files (x86)\...\WMIOEMHelper.exe, PE32 7->34 dropped 36 C:\Program Files (x86)\...36vSmartMax.dll, PE32 7->36 dropped 18 WMIOEMHelper.exe 1 7->18         started        66 Contains functionality to inject threads in other processes 10->66 68 Writes to foreign memory regions 10->68 70 Allocates memory in foreign processes 10->70 72 Creates a thread in another existing process (thread injection) 10->72 21 svchost.exe 32 10->21         started        74 Changes security center settings (notifications, updates, antivirus, firewall) 13->74 23 MpCmdRun.exe 1 13->23         started        48 127.0.0.1 unknown unknown 15->48 50 192.168.2.1 unknown unknown 15->50 file5 signatures6 process7 signatures8 60 Writes to foreign memory regions 18->60 62 Allocates memory in foreign processes 18->62 64 Creates a thread in another existing process (thread injection) 18->64 25 svchost.exe 7 18->25         started        29 svchost.exe 1 19 21->29         started        32 conhost.exe 23->32         started        process9 dnsIp10 38 C:\Users\user\AppData\...\WMIOEMHelper.exe, PE32 25->38 dropped 40 C:\Users\user\AppData\...40vSmartMax.dll, PE32 25->40 dropped 76 Contains functionality to inject threads in other processes 25->76 42 sery.brushupdata.com 185.231.245.119, 49738, 8080 TEAM-HOSTASRU Russian Federation 29->42 44 elb097307-934924932.us-east-1.elb.amazonaws.com 23.21.42.25, 49741, 80 AMAZON-AESUS United States 29->44 46 2 other IPs or domains 29->46 78 System process connects to network (likely due to code injection or exploit) 29->78 80 Installs a global keyboard hook 29->80 file11 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34f907b9f543ecf0f4f99adb7e55963ab5bc1c8e6e64081a8fef9a06043828b7/
Threat name:
Win32.Exploit.BypassUac
Create hunting rule
Status:
Malicious
First seen:
2020-12-31 01:06:00 UTC
File Type:
PE (Exe)
Extracted files:
34
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
2ca24ab7850aa7b67af4817c98c938b7c6e48f96028dee2c7fbe01f95d6f3ba1
4873869d22df0e7fcec173e490e31f14e42b55bf594bf5c722d08ed43a9e5292
4c25202298f76f1598a1e169ca435b80541e1db59c542f55e1eb8e3cbf76a419
6624ce134dd16a37d6615483002f24b74c74c55b45259bc5408b7ae804d0fe22
829b3df0c75971b19d658fd980bdf0302351bdf6ddbdf5e2f5d83632df72215d
86b0b53349b935048562758a34e08ae6190c67fa522e8742f60702b334625d36
91a63868ca56bae97b954c0ece75ed4f66e18bf2c258a9ed5712e376bae7220c
bcee5b3f4acfc85f500a2edd23402b92b87bca11263ffc3ef31f8c0a6c31f6a6
ee2e84f75b0b6043c2a2e3b84bdeabc0be4a4a1e4c6ec6a3ff255963b545425d
fd59571b52f8bfc7244a8ecf6cc057f1690964091b7141227ddd8315bba4d93a
+ 116 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210105-2ydghyhdne/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in System32 directory
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
34f907b9f543ecf0f4f99adb7e55963ab5bc1c8e6e64081a8fef9a06043828b7
MD5 hash:
a587a2af22c7e18a0260cab5c06d980d
SHA1 hash:
2ad51f3bc82585a120159510c61db6e90474c2cd
Link:
https://www.unpac.me/results/a63378bc-c986-4fcb-aa7f-676f405d36c8/
SH256 hash:
6c58b05e4e67947b6622e0c72287d70870a3bcc80a4e660144a79cb97566f302
MD5 hash:
5a97a12bcc56b80ab1c1323ac87d60e5
SHA1 hash:
0a5f89f92d924fbbc51b213244327dbf390a43a9
Link:
https://www.unpac.me/results/a63378bc-c986-4fcb-aa7f-676f405d36c8/
SH256 hash:
300ca354a3fc9d4c39237abb031f625adf98f3a51ed69f21dd7cb4206c602ce2
MD5 hash:
615255d957133b4768b77e08074cc943
SHA1 hash:
15eecac204765ce12ed4230b932a0d3bb7d52e2f
Link:
https://www.unpac.me/results/a63378bc-c986-4fcb-aa7f-676f405d36c8/
SH256 hash:
421da98713b516d8a99e9bc3c54ea16e4c11e234ac270ac4487f3809e3d9b00e
MD5 hash:
a34501819849676075d69e8b613179c9
SHA1 hash:
4a4885653753ba6f8e8cad0cd3673552c34ffd8d
Link:
https://www.unpac.me/results/a63378bc-c986-4fcb-aa7f-676f405d36c8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
WanaCrypt0r
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/34f907b9f543ecf0f4f99adb7e55963ab5bc1c8e6e64081a8fef9a06043828b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/110585/

Comments