Edit tour
Windows
Analysis Report
snmpapi.exe
Overview
General Information
Detection
Braodo
Score: | 80 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Attempt to bypass Chrome Application-Bound Encryption
Multi AV Scanner detection for submitted file
Yara detected Braodo
Yara detected Telegram RAT
Excessive usage of taskkill to terminate processes
Tries to harvest and steal browser information (history, passwords, etc)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Browser Started with Remote Debugging
Stores large binary data to the registry
Too many similar processes found
Uses taskkill to terminate processes
Classification
- System is w10x64
- snmpapi.exe (PID: 7348 cmdline:
"C:\Users\ user\Deskt op\snmpapi .exe" MD5: 2EB50A8C7B87DDF8A979FC5AF1FC20EF) - snmpapi.exe (PID: 7416 cmdline:
"C:\Users\ user\Deskt op\snmpapi .exe" MD5: 2EB50A8C7B87DDF8A979FC5AF1FC20EF) - taskkill.exe (PID: 7480 cmdline:
taskkill / F /IM chro me.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7488 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7540 cmdline:
taskkill / F /IM Tele gram.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7548 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7600 cmdline:
taskkill / F /IM msed ge.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7608 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7660 cmdline:
taskkill / F /IM chro mium.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7668 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7720 cmdline:
taskkill / F /IM thor ium.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7728 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7772 cmdline:
taskkill / F /IM viva ldi.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7780 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7832 cmdline:
taskkill / F /IM irid ium.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7840 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7896 cmdline:
taskkill / F /IM 7sta r.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7904 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7956 cmdline:
taskkill / F /IM cent browser.ex e MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7964 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8024 cmdline:
taskkill / F /IM ched ot.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 8032 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8084 cmdline:
taskkill / F /IM kome ta.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 8092 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8148 cmdline:
taskkill / F /IM elem ents.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 8156 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 4940 cmdline:
taskkill / F /IM epic .exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 5216 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 2656 cmdline:
taskkill / F /IM uran .exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 5772 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7268 cmdline:
taskkill / F /IM fenr ir.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 3332 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 6888 cmdline:
taskkill / F /IM citr io.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 6604 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 6812 cmdline:
taskkill / F /IM coow on.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7128 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 1868 cmdline:
taskkill / F /IM lieb ao.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7436 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7504 cmdline:
taskkill / F /IM qips urf.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7512 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7544 cmdline:
taskkill / F /IM orbi tum.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7540 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7600 cmdline:
taskkill / F /IM drag on.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7636 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7668 cmdline:
taskkill / F /IM 360b rowser.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7760 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7792 cmdline:
taskkill / F /IM maxt hon.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7820 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7844 cmdline:
taskkill / F /IM kmel on.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7880 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7900 cmdline:
taskkill / F /IM cocc oc.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7896 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8004 cmdline:
taskkill / F /IM brav e.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7980 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8076 cmdline:
taskkill / F /IM amig o.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 8048 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8128 cmdline:
taskkill / F /IM torc h.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 8088 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8180 cmdline:
taskkill / F /IM sput nik.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 4908 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8016 cmdline:
taskkill / F /IM edge .exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 5660 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 3808 cmdline:
taskkill / F /IM dcbr owser.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 1456 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 2144 cmdline:
taskkill / F /IM yand ex.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 2656 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 2316 cmdline:
taskkill / F /IM urbr owser.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 5776 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7396 cmdline:
taskkill / F /IM slim jet.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 6700 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7524 cmdline:
taskkill / F /IM oper a.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7500 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7580 cmdline:
taskkill / F /IM oper agx.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7480 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 3448 cmdline:
taskkill / F /IM spee d360.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7644 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7676 cmdline:
taskkill / F /IM qqbr owser.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7604 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7708 cmdline:
taskkill / F /IM sogo u.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7752 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7740 cmdline:
taskkill / F /IM disc ord.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7824 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7792 cmdline:
taskkill / F /IM disc ordcanary. exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7808 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 7908 cmdline:
taskkill / F /IM ligh tcord.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7884 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - taskkill.exe (PID: 8008 cmdline:
taskkill / F /IM disc ordptb.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7) - conhost.exe (PID: 7904 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - chrome.exe (PID: 8064 cmdline:
"C:/Progra m Files/Go ogle/Chrom e/Applicat ion/chrome .exe" --re mote-debug ging-port= 9222 --pro file-direc tory=Defau lt --remot e-allow-or igins=* -- window-pos ition=1000 0,10000 -- window-siz e=1,1 --di sable-gpu --no-sandb ox MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 3652 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-sandb ox --mojo- platform-c hannel-han dle=1964 - -field-tri al-handle= 1936,i,152 7717951761 6739558,42 2501542677 8427459,26 2144 /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7852 cmdline:
"C:/Progra m Files/Go ogle/Chrom e/Applicat ion/chrome .exe" --re mote-debug ging-port= 9222 --pro file-direc tory=Defau lt --remot e-allow-or igins=* -- window-pos ition=1000 0,10000 -- window-siz e=1,1 --di sable-gpu --no-sandb ox MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6172 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-sandb ox --mojo- platform-c hannel-han dle=1980 - -field-tri al-handle= 1956,i,140 1743295400 2140929,13 1562980559 35422513,2 62144 /pre fetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6836 cmdline:
"C:/Progra m Files/Go ogle/Chrom e/Applicat ion/chrome .exe" --re mote-debug ging-port= 9222 --pro file-direc tory=Defau lt --remot e-allow-or igins=* -- window-pos ition=1000 0,10000 -- window-siz e=1,1 --di sable-gpu --no-sandb ox MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7708 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-sandb ox --mojo- platform-c hannel-han dle=1964 - -field-tri al-handle= 1920,i,176 5662918144 8511312,82 3125610695 3708749,26 2144 /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - WMIADAP.exe (PID: 7668 cmdline:
wmiadap.ex e /F /T /R MD5: 1BFFABBD200C850E6346820E92B915DC)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Braodo | Yara detected Braodo | Joe Security | ||
JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
JoeSecurity_Braodo | Yara detected Braodo | Joe Security |
Source: | Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): |
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | File created: | Jump to behavior | ||
Source: | File created: | Jump to behavior |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |