Create Interactive Tour
Windows
Analysis Report
apnmcp.exe
Overview
General Information
| Sample Name: | apnmcp.exe |
| Analysis ID: | 609650 |
| MD5: | abd7edc38ff72ec115031a6cb98ad26e |
| SHA1: | 91f424bf783e3c7f83b2d1987b2b1fe011b61603 |
| SHA256: | c6c84273291a7e21d92d1eef0b92cc8d58dfdc40fa43d8ba52094f937528d92e |
| Infos: |  |
 | |
Detection
| Score: | 48 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Uses 32bit PE files
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Uses Microsoft's Enhanced Cryptographic Provider
Contains functionality to delete services
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64
cmd.exe (PID: 4068 cmdline: cmd /c sc create gjM gd binpath = "C:\User s\user\Des ktop\apnmc p.exe" >> C:\service reg.log 2> &1 MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 5980 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) 
sc.exe (PID: 6288 cmdline: sc create gjMgd binp ath= "C:\U sers\user\ Desktop\ap nmcp.exe" MD5: 24A3E2603E63BCB9695A2935D3B24695)
- cmd.exe (PID: 3976 cmdline:
cmd /c sc start gjMg d >> C:\se rvicestart .log 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 204 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - sc.exe (PID: 6224 cmdline:
sc start g jMgd MD5: 24A3E2603E63BCB9695A2935D3B24695)
- apnmcp.exe (PID: 2124 cmdline:
C:\Users\u ser\Deskto p\apnmcp.e xe MD5: ABD7EDC38FF72EC115031A6CB98AD26E)
- svchost.exe (PID: 4524 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 5656 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 6996 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 5504 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- cleanup
⊘No configs have been found
⊘No yara matches
There are no malicious signatures, click here to show all signatures.
| Source: | Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: | ||
| Source: | Author: frack113: | ||
⊘No Snort rule has matched
- • AV Detection
- • Cryptography
- • Compliance
- • Spreading
- • Networking
- • System Summary
- • Data Obfuscation
- • Boot Survival
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | Metadefender: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Code function: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||