Analysis date (UTC): 1 December 2020, 17:49Analysis environment: Windows 7 Pro, build 7601, x86

Corona-virus-Map.com.bin

MD5:73DA2C02C6F8BFD4662DC84820DCD983

SHA1:949B69BF87515AD8945CE9A79F68F8B788C0AE39

SHA256:2B35AA9C70EF66197ABFB9BC409952897F9F70818633AB43DA85B3825B256307

Analysis result

Threat level:Malicious activity

Tags:

covid19stealerevasionautoittrojanqulab

Full analysis:Analysis Corona-virus-Map.com.bin (MD5: 73DA2C02C6F8BFD4662DC84820DCD983) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Corona.exe (PID: 2452)
Corona-virus-Map.com.exe (PID: 3100)
Corona.sfx.exe (PID: 3956)
Corona.exe (PID: 2384)
bin.exe (PID: 588)
Windows.Globalization.Fontgroups.exe (PID: 2160)
Build.exe (PID: 2488)

Drops executable file immediately after starts

Corona.exe (PID: 2452)
Corona.sfx.exe (PID: 3956)
Corona.exe (PID: 2384)

Loads the Task Scheduler COM API

Build.exe (PID: 2488)
Windows.Globalization.Fontgroups.exe (PID: 2160)

Actions looks like stealing of personal data

Windows.Globalization.Fontgroups.exe (PID: 2160)

Stealing of credential data

Windows.Globalization.Fontgroups.exe (PID: 2160)

Changes settings of System certificates

Corona-virus-Map.com.exe (PID: 3100)

QULAB was detected

Windows.Globalization.Fontgroups.exe (PID: 2160)

SUSPICIOUS

Drops a file that was compiled in debug mode

Corona-virus-Map.com.bin.exe (PID: 2528)
Corona.exe (PID: 2452)

Executable content was dropped or overwritten

Corona-virus-Map.com.bin.exe (PID: 2528)
Corona.exe (PID: 2452)
Corona.exe (PID: 2384)
Corona.sfx.exe (PID: 3956)
Build.exe (PID: 2488)

Drops a file with too old compile date

Corona-virus-Map.com.bin.exe (PID: 2528)

Creates files in the user directory

Corona-virus-Map.com.bin.exe (PID: 2528)
Corona.exe (PID: 2384)
Build.exe (PID: 2488)
Windows.Globalization.Fontgroups.module.exe (PID: 2604)
Windows.Globalization.Fontgroups.exe (PID: 2160)

Starts CMD.EXE for commands execution

Corona.exe (PID: 2452)

Drops a file with a compile date too recent

Corona.exe (PID: 2384)

Starts itself from another location

Build.exe (PID: 2488)

Reads the cookies of Mozilla Firefox

Windows.Globalization.Fontgroups.exe (PID: 2160)

Adds / modifies Windows certificates

Corona-virus-Map.com.exe (PID: 3100)

Reads the cookies of Google Chrome

Windows.Globalization.Fontgroups.exe (PID: 2160)

Reads internet explorer settings

Corona-virus-Map.com.exe (PID: 3100)

Uses ATTRIB.EXE to modify file attributes

Windows.Globalization.Fontgroups.exe (PID: 2160)

INFO

Drops Coronavirus (possible) decoy

Corona-virus-Map.com.bin.exe (PID: 2528)
Corona.sfx.exe (PID: 3956)
Corona.exe (PID: 2452)

Reads settings of System Certificates

Windows.Globalization.Fontgroups.exe (PID: 2160)

Threats

PID	Process	Class	Message
1064	svchost.exe	Potentially Bad Traffic	ET INFO Suspicious Domain Request for Possible COVID-19 Domain M2
1064	svchost.exe	Potentially Bad Traffic	ET INFO Suspicious Domain Request for Possible COVID-19 Domain M2
1064	svchost.exe	Potential Corporate Privacy Violation	ET POLICY External IP Lookup Domain (ipapi .co in DNS lookup)
2160	Windows.Globalization.Fontgroups.exe	Potentially Bad Traffic	ET INFO TLS Handshake Failure
2160	Windows.Globalization.Fontgroups.exe	Potential Corporate Privacy Violation	ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
2160	Windows.Globalization.Fontgroups.exe	Potential Corporate Privacy Violation	ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
2160	Windows.Globalization.Fontgroups.exe	Potentially Bad Traffic	ET INFO TLS Handshake Failure
2160	Windows.Globalization.Fontgroups.exe	Potential Corporate Privacy Violation	ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
2160	Windows.Globalization.Fontgroups.exe	Potential Corporate Privacy Violation	ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile