Windows Analysis Report
r.exe

Overview

General Information

Sample name: r.exe
Analysis ID: 1522674
MD5: 08655cc79cdd2054b01b0a70aa554b54
SHA1: a01e018b20ed46ce9b970585b314583a49b24f7e
SHA256: 525d112af142c6f421f997f219cbb23806b5cea4581d1da797f40c8876561f92
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Detected TCP or UDP traffic on non-standard ports
PE file contains sections with non-standard names
Potential time zone aware malware
Program does not show much activity (idle)
Sigma detected: Communication To Uncommon Destination Ports

Classification

Source: r.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.18:49695 -> 77.221.154.30:8080
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.154.30
Source: classification engine Classification label: clean2.winEXE@2/0@0/13
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
Source: C:\Users\user\Desktop\r.exe File opened: C:\Windows\system32\50be44a4de140161403f2c56b756a1843497545ace7df1c0d8b20ffa468d6b2bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Source: r.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\r.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknown Process created: C:\Users\user\Desktop\r.exe "C:\Users\user\Desktop\r.exe"
Source: C:\Users\user\Desktop\r.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\r.exe Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\r.exe Section loaded: winmm.dll
Source: C:\Users\user\Desktop\r.exe Section loaded: powrprof.dll
Source: C:\Users\user\Desktop\r.exe Section loaded: umpdc.dll
Source: C:\Users\user\Desktop\r.exe Section loaded: mswsock.dll
Source: r.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: r.exe Static file information: File size 7361024 > 1048576
Source: r.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x47b400
Source: r.exe Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x24d200
Source: r.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
PE file contains sections with non-standard names
Source: r.exe Static PE information: section name: .xdata
Source: r.exe Static PE information: section name: .symtab
Source: C:\Users\user\Desktop\r.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Potential time zone aware malware
Source: C:\Users\user\Desktop\r.exe System information queried: CurrentTimeZoneInformation
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
77.221.154.30
 unknown Russian Federation
30968 INFOBOX-ASInfoboxruAutonomousSystemRU false