qckocvscrpgmsoq_exe_2019-07-09_09_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "qckocvscrpgmsoq.exe"
* File Size: 545793
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
* SHA256: "ed07f0a1a2d85bbbcb9a22089fc51f9471f6d5397e4de6d674ff8d40bdda26a9"
* MD5: "ff5edb49d656aedd9e2d32f93e98f439"
* SHA1: "049ad64a402d60ade680ea4be621f19b3708c30e"
* SHA512: "0135db176411e083544ac9983dfe817c15a8de79cca252e71818d35c4eff7effc2ba523980d7179ab90e98df74187540291d47044aab51995e86a16797f51703"
* CRC32: "ABD890DB"
* SSDEEP: "12288:sCLCOIrBVgD5VXOghFvbjGsF4wcN1xpBc6rea2T:sCWOCBKD5FBbvXt6LNDnBP2"

* Process Execution:
    "qckocvscrpgmsoq.exe"


* Executed Commands:
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe \"C:\\Users\\user\\AppData\\Local\\Temp\\qckocvscrpgmsoq.exe\""


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
        "Details":


        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: qckocvscrpgmsoq.exe, pid: 2292, offset: 0x00000000, length: 0x00085401"




        "Description": "A process created a hidden window",
        "Details":

                "Process": "qckocvscrpgmsoq.exe -> C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: UPX1, entropy: 7.92, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0005ca00, virtual_size: 0x0005d000"


                "section": "name: .rsrc, entropy: 7.20, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00028600, virtual_size: 0x00029000"




        "Description": "The executable is compressed using UPX",
        "Details":

                "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x0006d000"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qckocvscrpgmsoq.eu.url"


                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qckocvscrpgmsoq.eu.url"




        "Description": "Likely virus infection of existing system binary",
        "Details":

                "file": "c:\\users\\user\\appdata\\local\\temp\\qckocvscrpgmsoq.exe"




        "Description": "Creates a slightly modified copy of itself",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Roaming\\uqewlnruje\\qckocvscrpgmsoq.exe"


                "percent_match": 100





* Started Service:

* Mutexes:
    "DBWinMutex"


* Modified Files:
    "C:\\Users\\user\\AppData\\Roaming\\uqewlnruje\\qckocvscrpgmsoq.exe",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qckocvscrpgmsoq.eu.url"


* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: