| File name: | vid.exe |
| Full analysis: | https://app.any.run/tasks/052c78e2-ebeb-411b-a30e-702d1f2abfb1 |
| Verdict: | Malicious activity |
| Analysis date: | December 26, 2018, 19:22:14 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 87F71F1773842113AE06EE38E95FFBD0 |
| SHA1: | C6BADCFEA0A4CAC6D704305BF4DAFFC96B9B0C6C |
| SHA256: | 0265280C92504EF3BED3D5C300B3EE3F5534E6CCAEE3023E00C26CE6433DBF3E |
| SSDEEP: | 49152:QPlz3PzWZYq4q/lMz86JMGj93ajPNXFT81U0sVZ2V4nsFfVA/22F7:QPlLLklMz8FGR3UVZ2ysY |
MALICIOUS
Modifies files in Chrome extension folder
- vid.exe (PID: 3684)
SUSPICIOUS
Starts CMD.EXE for commands execution
- smaters.exe (PID: 3892)
- vid.exe (PID: 3056)
- smaters.exe (PID: 2148)
- vid.exe (PID: 3684)
Reads internet explorer settings
- rundll32.exe (PID: 2196)
- rundll32.exe (PID: 2336)
Creates files in the program directory
- vid.exe (PID: 3684)
Creates a software uninstall entry
- vid.exe (PID: 3684)
- vid.exe (PID: 3056)
Executable content was dropped or overwritten
- vid.exe (PID: 3056)
- smaters.exe (PID: 3892)
- vid.exe (PID: 3684)
Uses RUNDLL32.EXE to load library
- cmd.exe (PID: 3808)
- cmd.exe (PID: 3708)
Starts CHOICE.EXE (used to create a delay)
- cmd.exe (PID: 3548)
- cmd.exe (PID: 3216)
Creates files in the user directory
- vid.exe (PID: 3684)
Creates files in the Windows directory
- smaters.exe (PID: 3892)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:12:24 18:48:44+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 14.16 |
| CodeSize: | 1367040 |
| InitializedDataSize: | 915456 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa2f50 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.9.9.8 |
| ProductVersionNumber: | 3.9.9.8 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Russian |
| CharacterSet: | Unicode |
| Comments: | WebMoney. Confidence Internet Information Service Technology. |
| CompanyName: | CJSC "Computing Forces" |
| FileDescription: | WebMoney Keeper WinPro Runner Module |
| FileVersion: | 3, 9, 9, 8 |
| InternalName: | WebMoney Keeper WinPro |
| LegalCopyright: | Copyright © 1998 by CJSC "Computing Forces" |
| LegalTrademarks: | WebMoney Transfer |
| OriginalFileName: | webmoney.exe |
| ProductName: | WebMoney Keeper WinPro |
| ProductVersion: | 3, 9, 9, 8 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 24-Dec-2018 17:48:44 |
| Detected languages: |
|
| Comments: | WebMoney. Confidence Internet Information Service Technology. |
| CompanyName: | CJSC "Computing Forces" |
| FileDescription: | WebMoney Keeper WinPro Runner Module |
| FileVersion: | 3, 9, 9, 8 |
| InternalName: | WebMoney Keeper WinPro |
| LegalCopyright: | Copyright © 1998 by CJSC "Computing Forces" |
| LegalTrademarks: | WebMoney Transfer |
| OriginalFilename: | webmoney.exe |
| ProductName: | WebMoney Keeper WinPro |
| ProductVersion: | 3, 9, 9, 8 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000120 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 24-Dec-2018 17:48:44 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0014DAFA | 0x0014DC00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.62778 |
.rdata | 0x0014F000 | 0x0005999A | 0x00059A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.56641 |
.data | 0x001A9000 | 0x00008F9C | 0x00006000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.75028 |
.rsrc | 0x001B2000 | 0x0006F914 | 0x0006FA00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.33554 |
.reloc | 0x00222000 | 0x00010298 | 0x00010400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.57235 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.3298 | 822 | Latin 1 / Western European | English - United States | RT_MANIFEST |
9 | 4.85456 | 3752 | Latin 1 / Western European | Process Default Language | RT_ICON |
10 | 5.18908 | 2216 | Latin 1 / Western European | Process Default Language | RT_ICON |
11 | 4.25865 | 1384 | Latin 1 / Western European | Process Default Language | RT_ICON |
12 | 4.67785 | 270376 | Latin 1 / Western European | Process Default Language | RT_ICON |
13 | 3.82103 | 67624 | Latin 1 / Western European | Process Default Language | RT_ICON |
14 | 5.20479 | 9640 | Latin 1 / Western European | Process Default Language | RT_ICON |
15 | 5.59126 | 4264 | Latin 1 / Western European | Process Default Language | RT_ICON |
16 | 5.81612 | 1128 | Latin 1 / Western European | Process Default Language | RT_ICON |
101 | 5.68324 | 17812 | Latin 1 / Western European | English - United States | JS |
Imports
ADVAPI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
USERENV.dll |
WTSAPI32.dll |
ole32.dll |
Total processes
62
Monitored processes
22
Malicious processes
2
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 420 | "C:\Users\admin\Desktop\vid.exe" | C:\Users\admin\Desktop\vid.exe | — | explorer.exe | |||||||||||
User: admin Company: CJSC "Computing Forces" Integrity Level: MEDIUM Description: WebMoney Keeper WinPro Runner Module Exit code: 0 Version: 3, 9, 9, 8 Modules
| |||||||||||||||
| 2148 | "C:\Users\admin\AppData\Local\WServices\smaters.exe" /srv | C:\Users\admin\AppData\Local\WServices\smaters.exe | services.exe | ||||||||||||
User: SYSTEM Company: CJSC "Computing Forces" Integrity Level: SYSTEM Description: WebMoney Keeper WinPro Runner Module Exit code: 0 Version: 3, 9, 9, 8 Modules
| |||||||||||||||
| 2196 | rundll32.exe javascript:"\..\mshtml, RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("\"C:\\Users\\admin\\AppData\\Local\\WServices\\performer.exe\" /work") | C:\Windows\system32\rundll32.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2336 | rundll32.exe javascript:"\..\mshtml, RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("\"C:\\Users\\admin\\AppData\\Local\\WServices\\performer.exe\" /work") | C:\Windows\system32\rundll32.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2512 | "C:\Users\admin\AppData\Local\WServices\smaters.exe" /start | C:\Users\admin\AppData\Local\WServices\smaters.exe | cmd.exe | ||||||||||||
User: admin Company: CJSC "Computing Forces" Integrity Level: HIGH Description: WebMoney Keeper WinPro Runner Module Exit code: 0 Version: 3, 9, 9, 8 Modules
| |||||||||||||||
| 2768 | "C:\Users\admin\AppData\Local\WServices\smaters.exe" /start | C:\Users\admin\AppData\Local\WServices\smaters.exe | cmd.exe | ||||||||||||
User: admin Company: CJSC "Computing Forces" Integrity Level: HIGH Description: WebMoney Keeper WinPro Runner Module Exit code: 0 Version: 3, 9, 9, 8 Modules
| |||||||||||||||
| 2856 | choice /C Y /N /D Y /T 3 | C:\Windows\system32\choice.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Offers the user a choice Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2888 | "C:\Windows\system32\CompMgmtLauncher.exe" | C:\Windows\system32\CompMgmtLauncher.exe | — | vid.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Computer Management Snapin Launcher Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3056 | "C:\Users\admin\Desktop\vid.exe" "C:\Users\admin\Desktop\vid.exe" --did=11 --tag=chrome | C:\Users\admin\Desktop\vid.exe | CompMgmtLauncher.exe | ||||||||||||
User: admin Company: CJSC "Computing Forces" Integrity Level: HIGH Description: WebMoney Keeper WinPro Runner Module Exit code: 0 Version: 3, 9, 9, 8 Modules
| |||||||||||||||
| 3160 | "C:\Windows\system32\CompMgmtLauncher.exe" | C:\Windows\system32\CompMgmtLauncher.exe | vid.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Computer Management Snapin Launcher Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
2 795
Read events
2 563
Write events
232
Delete events
0
Modification events
| (PID) Process: | (3732) vid.exe | Key: | HKEY_CURRENT_USER\Environment |
| Operation: | write | Name: | ProgramData |
Value: C:\Users\admin\AppData\Local\Temp\w7uc\Comet.{20D04FE0-3AEA-1069-A2D8-08002B30309D} | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Performer |
| Operation: | write | Name: | id |
Value: 1545852154179 | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Performer |
| Operation: | write | Name: | it |
Value: 1545852154179 | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Performer |
| Operation: | write | Name: | did |
Value: 11 | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Performer |
| Operation: | write | Name: | tag |
Value: chrome | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\vid_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\vid_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\vid_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\vid_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (3684) vid.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\vid_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
Executable files
3
Suspicious files
5
Text files
48
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3684 | vid.exe | C:\Users\admin\AppData\Local\Temp\chrome28478.tmp | — | |
MD5:— | SHA256:— | |||
| 3684 | vid.exe | C:\Program Files\Google\Chrome\Application\68.0.3440.106\chrome.dll_ | — | |
MD5:— | SHA256:— | |||
| 3684 | vid.exe | C:\Program Files\Google\Chrome\Application\68.0.3440.106\chrome.dll | — | |
MD5:— | SHA256:— | |||
| 3684 | vid.exe | C:\Program Files\Mozilla Firefox\omni.ja.tmp | — | |
MD5:— | SHA256:— | |||
| 3732 | vid.exe | C:\Users\admin\AppData\Local\Temp\w7uc\Comet.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk | lnk | |
MD5:— | SHA256:— | |||
| 3684 | vid.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\6818.528.0.0_0\bgs.js | text | |
MD5:— | SHA256:— | |||
| 3684 | vid.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\6818.528.0.0_0\firebase-messaging.js | text | |
MD5:— | SHA256:— | |||
| 3684 | vid.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\6818.528.0.0_0\firebase-app.js | text | |
MD5:— | SHA256:— | |||
| 3684 | vid.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\6818.528.0.0_0\firebase-messaging-sw.js | text | |
MD5:— | SHA256:— | |||
| 3684 | vid.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions\{ab10d63e-3096-4492-ab0e-5edcf4baf988}\extab.js | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
76
DNS requests
2
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2512 | smaters.exe | 104.24.105.43:443 | androidsoftx.ru | Cloudflare Inc | US | shared |
3684 | vid.exe | 104.24.105.43:443 | androidsoftx.ru | Cloudflare Inc | US | shared |
3892 | smaters.exe | 104.24.105.43:443 | androidsoftx.ru | Cloudflare Inc | US | shared |
3580 | performer.exe | 104.24.105.43:443 | androidsoftx.ru | Cloudflare Inc | US | shared |
2768 | smaters.exe | 104.24.105.43:443 | androidsoftx.ru | Cloudflare Inc | US | shared |
2148 | smaters.exe | 104.24.105.43:443 | androidsoftx.ru | Cloudflare Inc | US | shared |
3616 | performer.exe | 104.24.105.43:443 | androidsoftx.ru | Cloudflare Inc | US | shared |
3056 | vid.exe | 104.24.105.43:443 | androidsoftx.ru | Cloudflare Inc | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
androidsoftx.ru |
| malicious |