API tools faq
paste
paladin316

Exes_84aa7388087010843dfb7eedda8aca1a_exe_2019-07-29_21_30.txt

paladin316
Jul 29th, 2019
2,713
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 33.83 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Nanocore"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_84aa7388087010843dfb7eedda8aca1a.exe"
  7. * File Size: 1433859
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "6a3abbff67adf36e3544d06595d44097d4651466575ecb73a161e349ecb15b6a"
  10. * MD5: "84aa7388087010843dfb7eedda8aca1a"
  11. * SHA1: "13d0eaa3cf95e9105d7d6cd9c46f3283e71ccd92"
  12. * SHA512: "1e7d41597cabc643b967dc862123d130da07d9262c72fe03e83318432682343e5808881642285521b97367361c7464e73bacf7e90245c0d5888246256cbcfd68"
  13. * CRC32: "5E3BAFF5"
  14. * SSDEEP: "24576:bNA3R5drXTLPdBLs1+tk1eN9jQ8Qohu6r/JRcVaECeW5BzfceDbeibsRfTKPnTIt:G5PlJe+tk1k9jSar3+1UcUbsOP0aLRw"
  15.  
  16. * Process Execution:
  17. "Exes_84aa7388087010843dfb7eedda8aca1a.exe",
  18. "wscript.exe",
  19. "scw.exe",
  20. "scw.exe",
  21. "RegSvcs.exe",
  22. "schtasks.exe",
  23. "schtasks.exe",
  24. "svchost.exe"
  25.  
  26.  
  27. * Executed Commands:
  28. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\foc.vbs\"",
  29. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\foc.vbs ",
  30. "\"C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\scw.exe\" phk=nds",
  31. "scw.exe phk=nds",
  32. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\scw.exe C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\MBYUV",
  33. "\"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmpD21A.tmp\"",
  34. "\"schtasks.exe\" /create /f /tn \"DSL Subsystem Task\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmpDC3D.tmp\""
  35.  
  36.  
  37. * Signatures Detected:
  38.  
  39. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  40. "Details":
  41.  
  42. "IP": "144.168.239.34:58977"
  43.  
  44.  
  45.  
  46.  
  47. "Description": "Possible date expiration check, exits too soon after checking local time",
  48. "Details":
  49.  
  50. "process": "scw.exe, PID 316"
  51.  
  52.  
  53.  
  54.  
  55. "Description": "Creates RWX memory",
  56. "Details":
  57.  
  58.  
  59. "Description": "Detected script timer window indicative of sleep style evasion",
  60. "Details":
  61.  
  62. "Window": "WSH-Timer"
  63.  
  64.  
  65.  
  66.  
  67. "Description": "A process attempted to delay the analysis task.",
  68. "Details":
  69.  
  70. "Process": "RegSvcs.exe tried to sleep 1068 seconds, actually delayed analysis time by 0 seconds"
  71.  
  72.  
  73. "Process": "svchost.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  74.  
  75.  
  76.  
  77.  
  78. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  79. "Details":
  80.  
  81. "ioc": "v2.0.50727"
  82.  
  83.  
  84.  
  85.  
  86. "Description": "Reads data out of its own binary image",
  87. "Details":
  88.  
  89. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00000000, length: 0x00000007"
  90.  
  91.  
  92. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00000000, length: 0x00002000"
  93.  
  94.  
  95. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00000007, length: 0x0015e0fc"
  96.  
  97.  
  98. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00001ff0, length: 0x00002000"
  99.  
  100.  
  101. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00003fe0, length: 0x00002000"
  102.  
  103.  
  104. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00005fd0, length: 0x00002000"
  105.  
  106.  
  107. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00007fc0, length: 0x00002000"
  108.  
  109.  
  110. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00009fb0, length: 0x00002000"
  111.  
  112.  
  113. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0000bfa0, length: 0x00002000"
  114.  
  115.  
  116. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0000df90, length: 0x00002000"
  117.  
  118.  
  119. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0000ff80, length: 0x00002000"
  120.  
  121.  
  122. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00011f70, length: 0x00002000"
  123.  
  124.  
  125. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00013f60, length: 0x00002000"
  126.  
  127.  
  128. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00015f50, length: 0x00002000"
  129.  
  130.  
  131. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00017f40, length: 0x00002000"
  132.  
  133.  
  134. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00019f30, length: 0x00002000"
  135.  
  136.  
  137. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0001bf20, length: 0x00002000"
  138.  
  139.  
  140. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0001df10, length: 0x00002000"
  141.  
  142.  
  143. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0001ff00, length: 0x00002000"
  144.  
  145.  
  146. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00021ef0, length: 0x00002000"
  147.  
  148.  
  149. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00023ee0, length: 0x00002000"
  150.  
  151.  
  152. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00025ed0, length: 0x00002000"
  153.  
  154.  
  155. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00027ec0, length: 0x00002000"
  156.  
  157.  
  158. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00029eb0, length: 0x00002000"
  159.  
  160.  
  161. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0002bea0, length: 0x00002000"
  162.  
  163.  
  164. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0002de90, length: 0x00002000"
  165.  
  166.  
  167. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0002fe80, length: 0x00002000"
  168.  
  169.  
  170. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00031e70, length: 0x00002000"
  171.  
  172.  
  173. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00033e60, length: 0x00002000"
  174.  
  175.  
  176. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00035e50, length: 0x00002000"
  177.  
  178.  
  179. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00037e40, length: 0x00002000"
  180.  
  181.  
  182. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00039e30, length: 0x00002000"
  183.  
  184.  
  185. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0003be20, length: 0x00002000"
  186.  
  187.  
  188. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0003de10, length: 0x00002000"
  189.  
  190.  
  191. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0003fe00, length: 0x00002000"
  192.  
  193.  
  194. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00041df0, length: 0x00002000"
  195.  
  196.  
  197. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00043de0, length: 0x00002000"
  198.  
  199.  
  200. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00045dd0, length: 0x00002000"
  201.  
  202.  
  203. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00047dc0, length: 0x00002000"
  204.  
  205.  
  206. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00049db0, length: 0x00002000"
  207.  
  208.  
  209. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0004bda0, length: 0x00002000"
  210.  
  211.  
  212. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0004dd90, length: 0x00002000"
  213.  
  214.  
  215. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0004fd80, length: 0x00002000"
  216.  
  217.  
  218. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00050a00, length: 0x00000031"
  219.  
  220.  
  221. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x00050a19, length: 0x00109e64"
  222.  
  223.  
  224. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015aa28, length: 0x00000028"
  225.  
  226.  
  227. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015abf8, length: 0x00000028"
  228.  
  229.  
  230. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015ae0b, length: 0x00000028"
  231.  
  232.  
  233. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015afe8, length: 0x00000028"
  234.  
  235.  
  236. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015b1e9, length: 0x00000028"
  237.  
  238.  
  239. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015b3b4, length: 0x00000028"
  240.  
  241.  
  242. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015b5be, length: 0x00000028"
  243.  
  244.  
  245. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015b787, length: 0x00000027"
  246.  
  247.  
  248. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015b97c, length: 0x00000027"
  249.  
  250.  
  251. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015bb53, length: 0x00000028"
  252.  
  253.  
  254. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015bd6e, length: 0x00000028"
  255.  
  256.  
  257. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015bf60, length: 0x00000028"
  258.  
  259.  
  260. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015c159, length: 0x00000028"
  261.  
  262.  
  263. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015c322, length: 0x00000027"
  264.  
  265.  
  266. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015c516, length: 0x00000029"
  267.  
  268.  
  269. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015c73b, length: 0x00000029"
  270.  
  271.  
  272. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015c928, length: 0x00000027"
  273.  
  274.  
  275. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015caf5, length: 0x00000028"
  276.  
  277.  
  278. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015ccc8, length: 0x00000028"
  279.  
  280.  
  281. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015ce97, length: 0x00000028"
  282.  
  283.  
  284. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015d074, length: 0x00000028"
  285.  
  286.  
  287. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015d24b, length: 0x00000028"
  288.  
  289.  
  290. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015d450, length: 0x00000028"
  291.  
  292.  
  293. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015d68d, length: 0x00000029"
  294.  
  295.  
  296. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015d874, length: 0x00000028"
  297.  
  298.  
  299. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015da6b, length: 0x00000028"
  300.  
  301.  
  302. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015dc67, length: 0x00000028"
  303.  
  304.  
  305. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015de63, length: 0x00000028"
  306.  
  307.  
  308. "self_read": "process: Exes_84aa7388087010843dfb7eedda8aca1a.exe, pid: 580, offset: 0x0015e044, length: 0x0000001b"
  309.  
  310.  
  311. "self_read": "process: wscript.exe, pid: 2544, offset: 0x00000000, length: 0x00000040"
  312.  
  313.  
  314. "self_read": "process: wscript.exe, pid: 2544, offset: 0x000000f0, length: 0x00000018"
  315.  
  316.  
  317. "self_read": "process: wscript.exe, pid: 2544, offset: 0x000001e8, length: 0x00000078"
  318.  
  319.  
  320. "self_read": "process: wscript.exe, pid: 2544, offset: 0x00018000, length: 0x00000020"
  321.  
  322.  
  323. "self_read": "process: wscript.exe, pid: 2544, offset: 0x00018058, length: 0x00000018"
  324.  
  325.  
  326. "self_read": "process: wscript.exe, pid: 2544, offset: 0x000181a8, length: 0x00000018"
  327.  
  328.  
  329. "self_read": "process: wscript.exe, pid: 2544, offset: 0x00018470, length: 0x00000010"
  330.  
  331.  
  332. "self_read": "process: wscript.exe, pid: 2544, offset: 0x00018640, length: 0x00000012"
  333.  
  334.  
  335. "self_read": "process: RegSvcs.exe, pid: 832, offset: 0x00000000, length: 0x00001000"
  336.  
  337.  
  338. "self_read": "process: RegSvcs.exe, pid: 832, offset: 0x00000080, length: 0x00000200"
  339.  
  340.  
  341. "self_read": "process: RegSvcs.exe, pid: 832, offset: 0x00000178, length: 0x00000200"
  342.  
  343.  
  344. "self_read": "process: RegSvcs.exe, pid: 832, offset: 0x00005b20, length: 0x00000200"
  345.  
  346.  
  347. "self_read": "process: RegSvcs.exe, pid: 832, offset: 0x00005b3c, length: 0x00000200"
  348.  
  349.  
  350.  
  351.  
  352. "Description": "A process created a hidden window",
  353. "Details":
  354.  
  355. "Process": "RegSvcs.exe -> \"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmpD21A.tmp\""
  356.  
  357.  
  358. "Process": "RegSvcs.exe -> \"schtasks.exe\" /create /f /tn \"DSL Subsystem Task\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmpDC3D.tmp\""
  359.  
  360.  
  361.  
  362.  
  363. "Description": "Drops a binary and executes it",
  364. "Details":
  365.  
  366. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\scw.exe"
  367.  
  368.  
  369.  
  370.  
  371. "Description": "Executed a process and injected code into it, probably while unpacking",
  372. "Details":
  373.  
  374. "Injection": "scw.exe(1496) -> RegSvcs.exe(832)"
  375.  
  376.  
  377.  
  378.  
  379. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  380. "Details":
  381.  
  382. "file": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  383.  
  384.  
  385.  
  386.  
  387. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  388. "Details":
  389.  
  390. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  391.  
  392.  
  393.  
  394.  
  395. "Description": "Installs itself for autorun at Windows startup",
  396. "Details":
  397.  
  398. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyuiuytrfghj.exe"
  399.  
  400.  
  401. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\scw.exe C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\PHK_ND~1"
  402.  
  403.  
  404. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\DSL Subsystem"
  405.  
  406.  
  407. "data": "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe"
  408.  
  409.  
  410.  
  411.  
  412. "Description": "Exhibits behavior characteristic of Nanocore RAT",
  413. "Details":
  414.  
  415.  
  416. "Description": "Creates a hidden or system file",
  417. "Details":
  418.  
  419. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\scw.exe"
  420.  
  421.  
  422. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\aeg.ppt"
  423.  
  424.  
  425. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\bcv.xl"
  426.  
  427.  
  428. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ble.ico"
  429.  
  430.  
  431. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\clp.dat"
  432.  
  433.  
  434. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\dke.txt"
  435.  
  436.  
  437. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ees.docx"
  438.  
  439.  
  440. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\foc.vbs"
  441.  
  442.  
  443. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\fvk.icm"
  444.  
  445.  
  446. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\fvp.mp3"
  447.  
  448.  
  449. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\gvi.jpg"
  450.  
  451.  
  452. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hdu.bmp"
  453.  
  454.  
  455. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hqt.txt"
  456.  
  457.  
  458. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hur.docx"
  459.  
  460.  
  461. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ica.mp4"
  462.  
  463.  
  464. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ikc.jpg"
  465.  
  466.  
  467. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\iri.ppt"
  468.  
  469.  
  470. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\jak.mp3"
  471.  
  472.  
  473. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\jbg.xl"
  474.  
  475.  
  476. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\kwm.mp3"
  477.  
  478.  
  479. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\luh.mp3"
  480.  
  481.  
  482. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\lwj.mp3"
  483.  
  484.  
  485. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\mkc.dat"
  486.  
  487.  
  488. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\nbn.bmp"
  489.  
  490.  
  491. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ndf.xl"
  492.  
  493.  
  494. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\npb.xl"
  495.  
  496.  
  497. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\oca.mp3"
  498.  
  499.  
  500. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\okh.mp3"
  501.  
  502.  
  503. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\oss.docx"
  504.  
  505.  
  506. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\phk=nds"
  507.  
  508.  
  509. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\poc.txt"
  510.  
  511.  
  512. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\pqv.mp4"
  513.  
  514.  
  515. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qcq.bmp"
  516.  
  517.  
  518. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qdx.mp4"
  519.  
  520.  
  521. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qej.jpg"
  522.  
  523.  
  524. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\rkb.jpg"
  525.  
  526.  
  527. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\sjg.dat"
  528.  
  529.  
  530. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tar.icm"
  531.  
  532.  
  533. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tha.txt"
  534.  
  535.  
  536. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tqd.mp3"
  537.  
  538.  
  539. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tqf.jpg"
  540.  
  541.  
  542. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\trc.mp3"
  543.  
  544.  
  545. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ufn.ppt"
  546.  
  547.  
  548. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vhd.xl"
  549.  
  550.  
  551. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vkm.icm"
  552.  
  553.  
  554. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\voh.pdf"
  555.  
  556.  
  557. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vvu.xl"
  558.  
  559.  
  560. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\wwr.mp4"
  561.  
  562.  
  563. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\xda.bmp"
  564.  
  565.  
  566. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\xwk.icm"
  567.  
  568.  
  569. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016"
  570.  
  571.  
  572.  
  573.  
  574. "Description": "File has been identified by 16 Antiviruses on VirusTotal as malicious",
  575. "Details":
  576.  
  577. "FireEye": "Generic.mg.84aa738808701084"
  578.  
  579.  
  580. "K7GW": "Riskware ( 0040eff71 )"
  581.  
  582.  
  583. "K7AntiVirus": "Riskware ( 0040eff71 )"
  584.  
  585.  
  586. "APEX": "Malicious"
  587.  
  588.  
  589. "ClamAV": "Win.Malware.0040eff-7058212-0"
  590.  
  591.  
  592. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  593.  
  594.  
  595. "Endgame": "malicious (high confidence)"
  596.  
  597.  
  598. "Invincea": "heuristic"
  599.  
  600.  
  601. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  602.  
  603.  
  604. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  605.  
  606.  
  607. "AhnLab-V3": "Trojan/Win32.RL_Agent.R273974"
  608.  
  609.  
  610. "Zoner": "Probably RARAutorun"
  611.  
  612.  
  613. "ESET-NOD32": "Win32/Injector.Autoit.EDZ"
  614.  
  615.  
  616. "Cybereason": "malicious.3cf95e"
  617.  
  618.  
  619. "CrowdStrike": "win/malicious_confidence_100% (D)"
  620.  
  621.  
  622. "Qihoo-360": "HEUR/QVM10.1.D7E1.Malware.Gen"
  623.  
  624.  
  625.  
  626.  
  627. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  628. "Details":
  629.  
  630. "target": "clamav:Win.Malware.0040eff-7058212-0, sha256:6a3abbff67adf36e3544d06595d44097d4651466575ecb73a161e349ecb15b6a, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  631.  
  632.  
  633.  
  634.  
  635. "Description": "Collects information to fingerprint the system",
  636. "Details":
  637.  
  638.  
  639. "Description": "Created network traffic indicative of malicious activity",
  640. "Details":
  641.  
  642. "signature": "ET TROJAN Possible NanoCore C2 60B"
  643.  
  644.  
  645.  
  646.  
  647.  
  648. * Started Service:
  649.  
  650. * Mutexes:
  651. "DefaultTabtip-MainUI",
  652. "CicLoadWinStaWinSta0",
  653. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  654. "Local\\ZoneAttributeCacheCounterMutex",
  655. "Local\\ZonesCacheCounterMutex",
  656. "Local\\ZonesLockedCacheCounterMutex",
  657. "Global\\CLR_CASOFF_MUTEX",
  658. "Global\\370b41bb-1c88-47de-b326-025510516c06",
  659. "Global\\.net clr networking"
  660.  
  661.  
  662. * Modified Files:
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\__tmp_rar_sfx_access_check_32014062",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\trc.mp3",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\phk=nds",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\foc.vbs",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\scw.exe",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\wwr.mp4",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hdu.bmp",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\okh.mp3",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\sjg.dat",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\xwk.icm",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qdx.mp4",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\nbn.bmp",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\dke.txt",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vhd.xl",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\poc.txt",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\oca.mp3",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\mkc.dat",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tar.icm",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\gvi.jpg",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\bcv.xl",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\lwj.mp3",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\iri.ppt",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\xda.bmp",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hqt.txt",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\fvp.mp3",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\pqv.mp4",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vkm.icm",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ica.mp4",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\fvk.icm",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\aeg.ppt",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ndf.xl",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vvu.xl",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tqd.mp3",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tqf.jpg",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tha.txt",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\rkb.jpg",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\jbg.xl",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ees.docx",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hur.docx",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\npb.xl",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ikc.jpg",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\kwm.mp3",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qej.jpg",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\voh.pdf",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\clp.dat",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qcq.bmp",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\oss.docx",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\luh.mp3",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\jak.mp3",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ble.ico",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ufn.ppt",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\MBYUV",
  715. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\run.dat",
  716. "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\tmpD21A.tmp",
  718. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\task.dat",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\tmpDC3D.tmp",
  720. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\catalog.dat",
  721. "C:\\Windows\\sysnative\\Tasks\\DSL Subsystem",
  722. "C:\\Windows\\sysnative\\Tasks\\DSL Subsystem Task"
  723.  
  724.  
  725. * Deleted Files:
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\__tmp_rar_sfx_access_check_32014062",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\MBYUV",
  728. "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe",
  729. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\DSL Subsystem\\dslss.exe",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\tmpD21A.tmp",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\tmpDC3D.tmp",
  732. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier",
  733. "C:\\Windows\\Tasks\\DSL Subsystem.job",
  734. "C:\\Windows\\Tasks\\DSL Subsystem Task.job"
  735.  
  736.  
  737. * Modified Registry Keys:
  738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  740. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  741. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyuiuytrfghj.exe",
  742. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\DSL Subsystem",
  743. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD45961A-5F1B-458B-B481-533498CAD7C6\\Path",
  744. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD45961A-5F1B-458B-B481-533498CAD7C6\\Hash",
  745. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Id",
  746. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Index",
  747. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD45961A-5F1B-458B-B481-533498CAD7C6\\Triggers",
  748. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A11CCB2D-BF83-496D-A097-D7341BC91ADD\\Path",
  749. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A11CCB2D-BF83-496D-A097-D7341BC91ADD\\Hash",
  750. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem Task\\Id",
  751. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem Task\\Index",
  752. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A11CCB2D-BF83-496D-A097-D7341BC91ADD\\Triggers"
  753.  
  754.  
  755. * Deleted Registry Keys:
  756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  757. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  759. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  760. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job",
  761. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job.fp",
  762. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem Task.job",
  763. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem Task.job.fp"
  764.  
  765.  
  766. * DNS Communications:
  767.  
  768. "type": "A",
  769. "request": "cquestt.duckdns.org",
  770. "answers":
  771.  
  772. "data": "144.168.239.34",
  773. "type": "A"
  774.  
  775.  
  776.  
  777.  
  778.  
  779. * Domains:
  780.  
  781. "ip": "144.168.239.34",
  782. "domain": "cquestt.duckdns.org"
  783.  
  784.  
  785.  
  786. * Network Communication - ICMP:
  787.  
  788. * Network Communication - HTTP:
  789.  
  790. * Network Communication - SMTP:
  791.  
  792. * Network Communication - Hosts:
  793.  
  794. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!