Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
Detection
Djvu, ManusCrypt, PrivateLoader, SmokeLoader, Socelars
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Yara detected SmokeLoader
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Yara detected UAC Bypass using CMSTP
Benign windows process drops PE files
Malicious sample detected (through community Yara rule)
Yara detected Djvu Ransomware
Yara detected ManusCrypt
Yara detected Socelars
Multi AV Scanner detection for dropped file
Yara detected PrivateLoader
Maps a DLL or memory area into another process
Creates processes via WMI
Machine Learning detection for sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Contains functionality to inject code into remote processes
Deletes itself after installation
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Checks if the current machine is a virtual machine (disk enumeration)
Sample uses process hollowing technique
Detected VMProtect packer
Drops PE files with a suspicious file extension
Writes to foreign memory regions
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Antivirus or Machine Learning detection for unpacked file
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Registers a DLL
Launches processes in debugging mode, may be used to hinder debugging
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Yara signature match
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Found potential string decryption / allocating functions
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Entry point lies outside standard sections
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
PE file contains an invalid checksum
Enables driver privileges
Connects to several IPs in different countries
Enables security privileges
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Classification
- System is w10x64
- file.exe (PID: 6960 cmdline:
"C:\Users\ user\Deskt op\file.ex e" MD5: 576227815616E27EC0043A1BD3AF5A26) - explorer.exe (PID: 3324 cmdline:
C:\Windows \Explorer. EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D) - 6D2B.exe (PID: 6660 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\6D2B.ex e MD5: 063D932BB78AE11F67A5B1B929B0B16D) - regsvr32.exe (PID: 2064 cmdline:
regsvr32 / s C:\Users \user\AppD ata\Local\ Temp\9602. dll MD5: D78B75FC68247E8A63ACBA846182740E) - regsvr32.exe (PID: 7040 cmdline:
/s C:\Use rs\user\Ap pData\Loca l\Temp\960 2.dll MD5: 426E7499F6A7346F0410DEAD0805586B) - ADFF.exe (PID: 7032 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\ADFF.ex e MD5: AE9E2CE4CF9B092A5BBFD1D5A609166E) - conhost.exe (PID: 4764 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - ADFF.exe (PID: 5068 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\ADFF.e xe" -h MD5: AE9E2CE4CF9B092A5BBFD1D5A609166E) - conhost.exe (PID: 5240 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - D510.exe (PID: 3124 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\D510.ex e MD5: 4DD5B94AF732FDAA38C731E6AB39BFAD) - FC9E.exe (PID: 240 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\FC9E.ex e MD5: 5172CD2EDA6449DD6FE0479D404CF4BE) - 5449.exe (PID: 6352 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\5449.ex e MD5: 4F6E39467946C2D389E2E990DA995094) - WerFault.exe (PID: 2888 cmdline:
WerFault.e xe ////// MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - cmd.exe (PID: 6448 cmdline:
cmd /c cmd < Orti.do tx & ping -n 5 local host MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 1544 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 6828 cmdline:
cmd MD5: F3BDBE3BB6F734E357235F4D5898582D)
- svchost.exe (PID: 7028 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 4676 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 6696 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- viiivdw (PID: 6756 cmdline:
C:\Users\u ser\AppDat a\Roaming\ viiivdw MD5: 576227815616E27EC0043A1BD3AF5A26)
- svchost.exe (PID: 5312 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 6968 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- WmiPrvSE.exe (PID: 4640 cmdline:
C:\Windows \system32\ wbem\wmipr vse.exe -s ecured -Em bedding MD5: A782A4ED336750D10B3CAF776AFE8E70) - rundll32.exe (PID: 6536 cmdline:
rundll32.e xe "C:\Use rs\user\Ap pData\Loca l\Temp\db. dll",open MD5: 73C519F050C20580F8A62C849D49215A) - rundll32.exe (PID: 6120 cmdline:
rundll32.e xe "C:\Use rs\user\Ap pData\Loca l\Temp\db. dll",open MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - svchost.exe (PID: 1020 cmdline:
c:\windows \system32\ svchost.ex e -k netsv cs -p -s g psvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
- FC9E.exe (PID: 5728 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\FC9E.e xe" MD5: 5172CD2EDA6449DD6FE0479D404CF4BE)
- wtiivdw (PID: 4184 cmdline:
C:\Users\u ser\AppDat a\Roaming\ wtiivdw MD5: 4DD5B94AF732FDAA38C731E6AB39BFAD)
- svchost.exe (PID: 1884 cmdline:
C:\Windows \System32\ svchost.ex e -k WerSv cGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)
- cleanup
{"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://acacaca.org/files/1/build3.exe"], "C2 url": "http://acacaca.org/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-USug3rryKI\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0549Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwWZ7difN4\\/w6uP6dgqG6\\\\nvftez3eaEgDMUWG64EFNomZk\\/aGagJUZNATseVKViU3SRhi\\/imDMtG6Kd0LzCs0Q\\\\nAqErh4UFa\\/yCKZqYcwV\\/9ubI\\/9lwSfhXyDiJ7Erz3GXu4uCZ2llrOvQQo3EjLKMd\\\\nfDs3N5nABcM0JOzt2lH3ErNF+I+LbRkCEhevBBMlmLVLGn02ynpSOz3ZMFdPUX+T\\\\nCsF54KacWKK5HKQ7LOZmsO61suDKNhMdGlSbRELZzmlBPrlGeOK1Ve0GQQzGi+ns\\\\nzWUqS1a35FJvwUlL7aLbYmlgIOLkrg2nnq5epbuQC0TZMKetJq\\/OVJHsZ7xbthII\\\\nlwIDAQAB\\\\n-----END PUBLIC KEY-----"}
{"C2 url": "https://hueduy.s3.eu-west-1.amazonaws.com/nbsdg818"}
{"C2 list": ["http://samnutu11nuli.com/", "http://linislominyt11.at/", "http://nikogkojam.org/", "http://luxulixionus.net/", "http://nunuslushau.com/", "http://monsutiur4.com/", "http://nusurionuy5ff.at/", "http://moroitomo4.net/", "http://susuerulianita1.net/", "http://nikogminut88.at/", "http://cucumbetuturel4.com/", "http://lilisjjoer44.com/", "http://mini55tunul.com/", "http://limo00ruling.org/"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Windows_Trojan_Smokeloader_3687686f | unknown | unknown |
| |
Windows_Trojan_RedLineStealer_ed346e4c | unknown | unknown |
| |
Windows_Trojan_RedLineStealer_ed346e4c | unknown | unknown |
| |
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
Windows_Trojan_Smokeloader_4e31426e | unknown | unknown |
| |
Click to see the 66 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
JoeSecurity_PrivateLoader | Yara detected PrivateLoader | Joe Security | ||
Click to see the 48 entries |
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | URL Reputation: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | URL Reputation: | ||
Source: | URL Reputation: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: |
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: |