rundll32_bat_2019-07-19_22_30.txt

* MalFamily: "TrojanSpy"

* MalScore: 10.0

* File Name: "Exes_9314eab61fc58ca9cc21ec5c0b51493c.exe"
* File Size: 633856
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "255ed2fbf44756f106461fd7d26351abc60dbe855c81ff088f370094b7f284e3"
* MD5: "9314eab61fc58ca9cc21ec5c0b51493c"
* SHA1: "2cc5ff27ac080b4d65350fa090ef8c8ec41c9ed2"
* SHA512: "6adab17415575fb5b94fe0f1c74e386bfb782c9fb87762b33879e768771dd9ee9dca6059a56b59341540398aee594cf6dbabf0a9be7dbeb1f65ef3dcbc5b006e"
* CRC32: "2D0E42E8"
* SSDEEP: "12288:Xbxv/5ArXTeCoQP2m6Al/xFb6zo8g/+JqoVc/Ja49523K:LN/oXiC+mh/xpguW/VibCK"

* Process Execution:
    "Exes_9314eab61fc58ca9cc21ec5c0b51493c.exe",
    "Exes_9314eab61fc58ca9cc21ec5c0b51493c.exe",
    "images.exe",
    "images.exe"


* Executed Commands:
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_9314eab61fc58ca9cc21ec5c0b51493c.exe\"",
    "\"C:\\ProgramData\\images.exe\""


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\ProgramData\\images.exe"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .rsrc, entropy: 6.97, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x00025800, virtual_size: 0x00025628"




        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details":

                "Injection": "Exes_9314eab61fc58ca9cc21ec5c0b51493c.exe(1908) -> Exes_9314eab61fc58ca9cc21ec5c0b51493c.exe(2508)"




        "Description": "Attempts to remove evidence of file being downloaded from the Internet",
        "Details":

                "file": "C:\\ProgramData\\images.exe:Zone.Identifier"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\Images"


                "data": "C:\\ProgramData\\images.exe"




        "Description": "File has been identified by 49 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Gen:Variant.Strictor.200312"


                "FireEye": "Generic.mg.9314eab61fc58ca9"


                "CAT-QuickHeal": "Trojanpws.Coins"


                "McAfee": "RDN/Generic.grp"


                "Cylance": "Unsafe"


                "BitDefender": "Gen:Variant.Strictor.200312"


                "K7GW": "Trojan ( 00551e8a1 )"


                "K7AntiVirus": "Trojan ( 00551e8a1 )"


                "Invincea": "heuristic"


                "Symantec": "Trojan.Gen.2"


                "APEX": "Malicious"


                "Paloalto": "generic.ml"


                "Kaspersky": "HEUR:Trojan-PSW.Win32.Coins.gen"


                "Alibaba": "TrojanPSW:Win32/Injector.53850ee4"


                "NANO-Antivirus": "Trojan.Win32.Coins.fsrqyx"


                "AegisLab": "Trojan.Win32.Coins.4!c"


                "Rising": "Trojan.Injector!1.AFE3 (CLASSIC)"


                "Ad-Aware": "Gen:Variant.Strictor.200312"


                "Sophos": "Mal/Fareit-V"


                "F-Secure": "Trojan.TR/Injector.yvlpn"


                "DrWeb": "Trojan.DownLoader29.33728"


                "TrendMicro": "TrojanSpy.Win32.LOKI.SMDD.hp"


                "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.jh"


                "Trapmine": "malicious.high.ml.score"


                "Emsisoft": "Gen:Variant.Strictor.200312 (B)"


                "SentinelOne": "DFI - Suspicious PE"


                "Cyren": "W32/Trojan.KFJV-5058"


                "Avira": "TR/Injector.yvlpn"


                "Fortinet": "W32/Injector.EGKJ!tr"


                "Antiy-AVL": "Trojan/Win32.Wacatac"


                "Endgame": "malicious (high confidence)"


                "Arcabit": "Trojan.Strictor.D30E78"


                "ZoneAlarm": "HEUR:Trojan-PSW.Win32.Coins.gen"


                "Microsoft": "Trojan:Win32/Wacatac.B!ml"


                "AhnLab-V3": "Win-Trojan/Delphiless.Exp"


                "Acronis": "suspicious"


                "ALYac": "Gen:Variant.Strictor.200312"


                "VBA32": "TScope.Trojan.Delf"


                "Malwarebytes": "Trojan.MalPack.DLF"


                "Panda": "Trj/Agent.YS"


                "ESET-NOD32": "a variant of Win32/Injector.EGLQ"


                "TrendMicro-HouseCall": "TrojanSpy.Win32.LOKI.SMDD.hp"


                "Ikarus": "Trojan.Win32.Injector"


                "GData": "Gen:Variant.Strictor.200312"


                "AVG": "Win32:Malware-gen"


                "Cybereason": "malicious.7ac080"


                "Avast": "Win32:Malware-gen"


                "CrowdStrike": "win/malicious_confidence_100% (W)"


                "Qihoo-360": "Win32/Trojan.PSW.3f3"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\ProgramData\\images.exe"




        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"





* Started Service:

* Mutexes:

* Modified Files:
    "C:\\ProgramData\\images.exe"


* Deleted Files:
    "C:\\ProgramData\\images.exe:Zone.Identifier"


* Modified Registry Keys:
    "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\YLL82X7GJ0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\YLL82X7GJ0\\inst",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\Images"


* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "cyka.blyad.org",
        "answers":

                "data": "185.206.147.133",
                "type": "A"





* Domains:

        "ip": "185.206.147.133",
        "domain": "cyka.blyad.org"



* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: