Exes_c17fd5cbf52bb6d7c9b5222fbb13d263_exe_2019-08-11_09_30.txt

* MalFamily: "TrojanDropper"

* MalScore: 10.0

* File Name: "Exes_c17fd5cbf52bb6d7c9b5222fbb13d263.exe"
* File Size: 803641
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "2dfca1267b5cea0b739c91d9b7fb5dd4b4d1599d695b2dc3419b2ca45d70d2ec"
* MD5: "c17fd5cbf52bb6d7c9b5222fbb13d263"
* SHA1: "a67bb8b0e0b11218e53cc31a2ee461fe7251a2ab"
* SHA512: "a92d1415129392810f40237419fe02cd6d84df2114a122aa7d44baf8f88c4403021d65b45e2a67da294cee7451408571b5f435cdce25f5c3398a8414f4fbc742"
* CRC32: "018E5204"
* SSDEEP: "12288:7CKf7+or/FAnS+litDziBFMpMh4RtEncXrNWcEN/srHHAgYGkvicOzIt8+hKo3:tfyor/eStY5hu9XQcE+jpHcl8iP3"

* Process Execution:
    "Exes_c17fd5cbf52bb6d7c9b5222fbb13d263.exe",
    "svchost.exe",
    "regsvr32.exe",
    "cmd.exe",
    "PING.EXE"


* Executed Commands:
    "C:\\Windows\\syswow64\\svchost.exe -k NetTimeSvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2235.bat ",
    "\"C:\\Windows\\system32\\regsvr32.exe\" /s \"C:\\Windows\\system32\\bzpgtjan.dll\"",
    "C:\\Windows\\system32\\PING.EXE ping  1.0.0.1 -n"


* Signatures Detected:

        "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
        "Details":

                "IP": "134.175.107.117:80"




        "Description": "Creates RWX memory",
        "Details":


        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "Exes_c17fd5cbf52bb6d7c9b5222fbb13d263.exe, PID 1088"




        "Description": "Network anomalies occured during the analysis.",
        "Details":

                "Anomaly": "'1.0.0.1' getaddrinfo with no actual connection to the IP."




        "Description": "Starts servers listening on 127.0.0.1:54323",
        "Details":


        "Description": "A process created a hidden window",
        "Details":

                "Process": "Exes_c17fd5cbf52bb6d7c9b5222fbb13d263.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\2235.bat"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "post_no_referer": "HTTP traffic contains a POST request with no referer header"


                "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"


                "suspicious_request": "http://aol.vready.cn/terminal/start-up"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://aol.vready.cn/terminal/start-up"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .rsrc, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x000c4139, virtual_size: 0x000cc000"




        "Description": "Deletes its original binary from disk",
        "Details":


        "Description": "File has been identified by 45 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Gen:Win32.ExplorerHijack.XiGeamphwtai"


                "FireEye": "Generic.mg.c17fd5cbf52bb6d7"


                "McAfee": "Artemis!C17FD5CBF52B"


                "Cylance": "Unsafe"


                "K7AntiVirus": "Trojan ( 005329b91 )"


                "Alibaba": "TrojanDropper:Win32/dropper.ali1003001"


                "K7GW": "Trojan ( 005329b91 )"


                "Cybereason": "malicious.bf52bb"


                "NANO-Antivirus": "Trojan.Win32.OnLineGames.futzkt"


                "Symantec": "ML.Attribute.HighConfidence"


                "APEX": "Malicious"


                "Avast": "Win32:Evo-gen Susp"


                "BitDefender": "Gen:Win32.ExplorerHijack.XiGeamphwtai"


                "Paloalto": "generic.ml"


                "Tencent": "Win32.Trojan-gamethief.Onlinegames.Swkt"


                "Endgame": "malicious (high confidence)"


                "Emsisoft": "Gen:Win32.ExplorerHijack.XiGeamphwtai (B)"


                "Comodo": "Packed.Win32.Klone.~KMG@1knj1d"


                "DrWeb": "Trojan.DownLoader27.44803"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "GenericRXHR-ZA!8C77E900CDA6"


                "Trapmine": "malicious.high.ml.score"


                "Sophos": "Mal/EncPk-BW"


                "SentinelOne": "DFI - Malicious PE"


                "Jiangmin": "Trojan.PSW.Coins.ccb"


                "Avira": "TR/Downloader.Gen"


                "eGambit": "Unsafe.AI_Score_99%"


                "Microsoft": "Trojan:Win32/Occamy.C"


                "AegisLab": "Trojan.Win32.Generic.4!c"


                "GData": "Gen:Win32.ExplorerHijack.XiGeamphwtai"


                "AhnLab-V3": "Packed/Upack"


                "Acronis": "suspicious"


                "VBA32": "BScope.Trojan.Downloader"


                "ALYac": "Gen:Win32.ExplorerHijack.XiGeamphwtai"


                "MAX": "malware (ai score=100)"


                "Ad-Aware": "Gen:Win32.ExplorerHijack.XiGeamphwtai"


                "ESET-NOD32": "a variant of Win32/PSW.OnLineGames.QZO"


                "TrendMicro-HouseCall": "Cryp_Xed-12"


                "Rising": "Malware.Undefined!8.C (TFE:2:PyWlzNaR3gS)"


                "Yandex": "Packed/Upack"


                "Ikarus": "Trojan-PSW.OnlineGames"


                "Fortinet": "W32/Onlinegames.QZO!tr"


                "AVG": "Win32:Evo-gen Susp"


                "CrowdStrike": "win/malicious_confidence_90% (W)"


                "Qihoo-360": "Win32/Trojan.abe"





* Started Service:

* Mutexes:
    "Guid(\"0A5D06B2-E8F1-42D1-B3AA-37D7C7174633\")",
    "B8592103-AE8C-4D37-807F-F1CB76E62B7C",
    "Guid(\"7583B8C3-2691-4F51-A989-D622AAC8508A\")",
    "DBWinMutex"


* Modified Files:
    "C:\\Windows\\System32\\ejxve32.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2235.bat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\uueobl.dll",
    "\\Device\\KsecDD",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cwmgqkex.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RCX7B9A.tmp",
    "C:\\Windows\\sysnative\\bzpgtjan.dll",
    "\\??\\nul",
    "\\Device\\NamedPipe\\Winsock2\\CatalogChangeListener-2cc-0",
    "\\Device\\NamedPipe\\Winsock2\\CatalogChangeListener-190-0",
    "\\Device\\NamedPipe\\Winsock2\\CatalogChangeListener-314-0",
    "\\Device\\NamedPipe\\Winsock2\\CatalogChangeListener-378-0",
    "\\Device\\NamedPipe\\Winsock2\\CatalogChangeListener-1f4-0",
    "\\Device\\NamedPipe\\Winsock2\\CatalogChangeListener-204-0"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\cwmgqkex.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RCX7B9A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_c17fd5cbf52bb6d7c9b5222fbb13d263.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\2235.bat"


* Modified Registry Keys:
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\00000028",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001\\LibraryPath",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001\\DisplayString",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001\\ProviderId",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001\\SupportedNameSpace",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001\\Enabled",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001\\Version",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001\\StoresServiceClassInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000001\\ProviderInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002\\LibraryPath",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002\\DisplayString",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002\\ProviderId",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002\\SupportedNameSpace",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002\\Enabled",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002\\Version",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002\\StoresServiceClassInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000002\\ProviderInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003\\LibraryPath",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003\\DisplayString",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003\\ProviderId",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003\\SupportedNameSpace",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003\\Enabled",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003\\Version",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003\\StoresServiceClassInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000003\\ProviderInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004\\LibraryPath",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004\\DisplayString",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004\\ProviderId",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004\\SupportedNameSpace",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004\\Enabled",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004\\Version",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004\\StoresServiceClassInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000004\\ProviderInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005\\LibraryPath",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005\\DisplayString",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005\\ProviderId",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005\\SupportedNameSpace",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005\\Enabled",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005\\Version",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005\\StoresServiceClassInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000005\\ProviderInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006\\LibraryPath",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006\\DisplayString",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006\\ProviderId",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006\\SupportedNameSpace",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006\\Enabled",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006\\Version",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006\\StoresServiceClassInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000006\\ProviderInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007\\LibraryPath",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007\\DisplayString",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007\\ProviderId",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007\\SupportedNameSpace",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007\\Enabled",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007\\Version",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007\\StoresServiceClassInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Catalog_Entries64\\000000000007\\ProviderInfo",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Num_Catalog_Entries64",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\Serial_Access_Num",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\00000029",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\\0000002A"


* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "aol.vready.cn",
        "answers":

                "data": "134.175.107.117",
                "type": "A"





* Domains:

        "ip": "134.175.107.117",
        "domain": "aol.vready.cn"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "channel_id=ttzxj14&mac=18-C0-86-CD-47-33&ip=169.254.255.254
        "uri": "http://aol.vready.cn/terminal/start-up",
        "user-agent": "",
        "method": "POST",
        "host": "aol.vready.cn",
        "version": "1.1",
        "path": "/terminal/start-up",
        "data": "POST /terminal/start-up HTTP/1.1\r\nHost: aol.vready.cn\r\nAccept: */*\r\nContent-Length: 58\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nchannel_id=ttzxj14&mac=18-C0-86-CD-47-33&ip=169.254.255.254
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: