Exes_9276be018b796b4de6ceecaa529eed83_exe_2019-07-26_06_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "Exes_9276be018b796b4de6ceecaa529eed83.exe"
* File Size: 849487
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
* SHA256: "af5609dd82c3185bd73e5814b8af3d063daf8d656cebdd814dedbb5cff99acae"
* MD5: "9276be018b796b4de6ceecaa529eed83"
* SHA1: "1e1856d8275e95409b67e1de0b601bbcf5d5f584"
* SHA512: "1421e9781a144e817b507531808e36b182b6c47918b740b9641e370ae9ff1f19916fc3b60195e0515f7f9307472a2da31fd919a86a112c486fa2208ae9cbcac9"
* CRC32: "9C82F002"
* SSDEEP: "24576:0thEVaPqLyTBHJvDUJ68xdEqe9ESP/5muBooL:IEVUcyTBpvy6Od+lP/rRL"

* Process Execution:
    "Exes_9276be018b796b4de6ceecaa529eed83.exe",
    "cmd.exe",
    "schtasks.exe",
    "svchost.exe",
    "svchost.exe",
    "WMIADAP.exe",
    "svchost.exe"


* Executed Commands:
    "C:\\Windows\\system32\\cmd.exe /c schtasks /create /tn GOBEJS.exe /tr C:\\Users\\user\\AppData\\Roaming\\Windata\\WCGLKI.exe /sc minute /mo 1",
    "schtasks  /create /tn GOBEJS.exe /tr C:\\Users\\user\\AppData\\Roaming\\Windata\\WCGLKI.exe /sc minute /mo 1"


* Signatures Detected:

        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "schtasks.exe, PID 1528"




        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x00000000, length: 0x00010000"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x00000000, length: 0x000cf64f"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x0000ffec, length: 0x00010000"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x0001ffd8, length: 0x00010000"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x0002ffc4, length: 0x00010000"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x0003ffb0, length: 0x00010000"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x0004da14, length: 0x00001000"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x0004da28, length: 0x00000200"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x0004dabf, length: 0x00000200"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x0004dadb, length: 0x00081b74"


                "self_read": "process: Exes_9276be018b796b4de6ceecaa529eed83.exe, pid: 2292, offset: 0x000cf647, length: 0x00000008"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: UPX1, entropy: 7.93, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00042200, virtual_size: 0x00043000"




        "Description": "The executable is compressed using UPX",
        "Details":

                "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x0007a000"




        "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
        "Details":

                "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "task": "C:\\Windows\\system32\\cmd.exe /c schtasks /create /tn GOBEJS.exe /tr C:\\Users\\user\\AppData\\Roaming\\Windata\\WCGLKI.exe /sc minute /mo 1"




        "Description": "File has been identified by 33 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "AIT:Trojan.Nymeria.219"


                "FireEye": "Generic.mg.9276be018b796b4d"


                "BitDefender": "AIT:Trojan.Nymeria.219"


                "Invincea": "heuristic"


                "F-Prot": "W32/Kryptik.AIY"


                "APEX": "Malicious"


                "ClamAV": "Win.Packed.LokiBot-6963314-0"


                "Kaspersky": "Trojan-PSW.Win32.Autoit.bab"


                "Endgame": "malicious (moderate confidence)"


                "Emsisoft": "AIT:Trojan.Nymeria.219 (B)"


                "Fortinet": "AutoIt/Agent.DB!tr"


                "Trapmine": "malicious.high.ml.score"


                "Ikarus": "Trojan.Autoit"


                "Cyren": "W32/Kryptik.QUZK-7259"


                "Jiangmin": "Backdoor.Androm.algc"


                "Webroot": "W32.Rogue.Gen"


                "MAX": "malware (ai score=84)"


                "Arcabit": "AIT:Trojan.Nymeria.219"


                "AegisLab": "Trojan.Win32.Fakeoff.tpw9"


                "ZoneAlarm": "Trojan-PSW.Win32.Autoit.bab"


                "Microsoft": "Trojan:Win32/Wacatac.B!ml"


                "AhnLab-V3": "Trojan/Win32.AutoIt.C2019675"


                "VBA32": "Trojan-Downloader.Autoit.gen"


                "ALYac": "AIT:Trojan.Nymeria.219"


                "Ad-Aware": "AIT:Trojan.Nymeria.219"


                "Malwarebytes": "Trojan.Script.AI"


                "ESET-NOD32": "a variant of Win32/Autoit.DB"


                "SentinelOne": "DFI - Suspicious PE"


                "GData": "AIT:Trojan.Nymeria.219 (2x)"


                "AVG": "FileRepMalware"


                "Cybereason": "malicious.18b796"


                "CrowdStrike": "win/malicious_confidence_90% (W)"


                "Qihoo-360": "HEUR/QVM11.1.BE25.Malware.Gen"




        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "target": "clamav:Win.Packed.LokiBot-6963314-0, sha256:af5609dd82c3185bd73e5814b8af3d063daf8d656cebdd814dedbb5cff99acae, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"


                "dropped": "clamav:Win.Packed.LokiBot-6963314-0, sha256:af5609dd82c3185bd73e5814b8af3d063daf8d656cebdd814dedbb5cff99acae , guest_paths:C:\\Users\\user\\AppData\\Roaming\\Windata\\WCGLKI.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\Users\\user\\AppData\\Roaming\\Windata\\WCGLKI.exe"





* Started Service:

* Mutexes:
    "Global\\ADAP_WMI_ENTRY",
    "Global\\RefreshRA_Mutex",
    "Global\\RefreshRA_Mutex_Lib",
    "Global\\RefreshRA_Mutex_Flag"


* Modified Files:
    "C:\\Users\\user\\AppData\\Roaming\\Windata\\WCGLKI.exe",
    "\\??\\PIPE\\samr",
    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "C:\\Windows\\sysnative\\Tasks\\GOBEJS.exe",
    "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
    "\\Device\\LanmanDatagramReceiver",
    "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
    "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
    "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk"


* Deleted Files:
    "C:\\Windows\\Tasks\\GOBEJS.exe.job",
    "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
    "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
    "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log"


* Modified Registry Keys:
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\4EA3E899-A35A-4B2C-8309-21ADF5344ACA\\Path",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\4EA3E899-A35A-4B2C-8309-21ADF5344ACA\\Hash",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\GOBEJS.exe\\Id",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\GOBEJS.exe\\Index",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\4EA3E899-A35A-4B2C-8309-21ADF5344ACA\\Triggers",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\4EA3E899-A35A-4B2C-8309-21ADF5344ACA\\DynamicInfo",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\8DA9C1AE-3ED4-49CB-8B76-D810740300F7\\Path",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\8DA9C1AE-3ED4-49CB-8B76-D810740300F7\\Hash",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\8DA9C1AE-3ED4-49CB-8B76-D810740300F7\\Triggers",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\8DA9C1AE-3ED4-49CB-8B76-D810740300F7\\DynamicInfo"


* Deleted Registry Keys:
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\GOBEJS.exe.job",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\GOBEJS.exe.job.fp"


* DNS Communications:

        "type": "A",
        "request": "worldbest.duckdns.org",
        "answers":

                "data": "45.32.184.40",
                "type": "A"





* Domains:

        "ip": "45.32.184.40",
        "domain": "worldbest.duckdns.org"



* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: