Exes_26a84232904de9d74f5f5a31e47ba264_exe_2019-07-11_20_30.txt

* MalFamily: ""

* MalScore: 7.8999999999999995

* File Name: "Exes_26a84232904de9d74f5f5a31e47ba264.exe"
* File Size: 1257441
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "a8d3b68c1e43f6ab3aa011b3a4ac96a6e1596d9a5e7c480e14e71fbc23e94794"
* MD5: "26a84232904de9d74f5f5a31e47ba264"
* SHA1: "545edc22d93c9c9139ecc6fddb170edcf0013020"
* SHA512: "26dfcb09f8a93efb674c4727d81695a4c8b66495b60cfb3f92313e699a0faa57ed61153a566d46384c7c06424ad92cd6abb85ad12229ddc2029d883120ac8fed"
* CRC32: "BC0F4573"
* SSDEEP: "24576:ZHweKjzGnwz7xb63NYkPMDHKK5HAw4JCIw0hJyvb:ZHQgwz7xASKYKCssj"

* Process Execution:
    "Exes_26a84232904de9d74f5f5a31e47ba264.exe",
    "svchost.exe",
    "cmd.exe",
    "PING.EXE"


* Executed Commands:
    "C:\\Windows\\syswow64\\svchost.exe -k NetTimeSvc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\4094.bat ",
    "C:\\Windows\\system32\\PING.EXE ping  1.0.0.1 -n"


* Signatures Detected:

        "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
        "Details":

                "IP": "134.175.107.117:80"


                "IP": "118.25.165.228:443"




        "Description": "Creates RWX memory",
        "Details":


        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "Exes_26a84232904de9d74f5f5a31e47ba264.exe, PID 1840"




        "Description": "Network anomalies occured during the analysis.",
        "Details":

                "Anomaly": "'1.0.0.1' getaddrinfo with no actual connection to the IP."




        "Description": "Starts servers listening on 127.0.0.1:54323",
        "Details":


        "Description": "A process created a hidden window",
        "Details":

                "Process": "Exes_26a84232904de9d74f5f5a31e47ba264.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\4094.bat"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "post_no_referer": "HTTP traffic contains a POST request with no referer header"


                "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"


                "suspicious_request": "http://aol.vready.cn/terminal/start-up"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://aol.vready.cn/terminal/start-up"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .rsrc, entropy: 8.00, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00132de1, virtual_size: 0x0013a000"




        "Description": "Deletes its original binary from disk",
        "Details":



* Started Service:

* Mutexes:
    "Guid(\"0A5D06B2-E8F1-42D1-B3AA-37D7C7174633\")",
    "B8592103-AE8C-4D37-807F-F1CB76E62B7C",
    "Guid(\"7583B8C3-2691-4F51-A989-D622AAC8508A\")",
    "DBWinMutex"


* Modified Files:
    "C:\\Windows\\System32\\ejxve32.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\4094.bat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\axnxhr.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\jhxoeulb.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RCXD79F.tmp",
    "\\??\\nul"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\jhxoeulb.dll",
    "C:\\Users\\user\\AppData\\Local\\Temp\\RCXD79F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_26a84232904de9d74f5f5a31e47ba264.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\4094.bat"


* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "v2api.v6.cn",
        "answers":

                "data": "118.25.165.228",
                "type": "A"




        "type": "A",
        "request": "aol.vready.cn",
        "answers":

                "data": "134.175.107.117",
                "type": "A"





* Domains:

        "ip": "118.25.165.228",
        "domain": "v2api.v6.cn"


        "ip": "134.175.107.117",
        "domain": "aol.vready.cn"



* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "channel_id=ttzxj15&mac=18-C0-86-CD-47-32&ip=169.254.255.254
        "uri": "http://aol.vready.cn/terminal/start-up",
        "user-agent": "",
        "method": "POST",
        "host": "aol.vready.cn",
        "version": "1.1",
        "path": "/terminal/start-up",
        "data": "POST /terminal/start-up HTTP/1.1\r\nHost: aol.vready.cn\r\nAccept: */*\r\nContent-Length: 58\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nchannel_id=ttzxj15&mac=18-C0-86-CD-47-32&ip=169.254.255.254
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: