analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin

Full analysis: https://app.any.run/tasks/d93d2866-db63-45b4-b79f-5aa1c0bd1f84
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: May 14, 2019, 21:34:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
phorpiex
nemucod
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

068BABFD35552F8CB25059CB27053549

SHA1:

B89B7B212888133E24F6973788CC4833CD73BB51

SHA256:

197DDEBCD96AC7D50C3EB2B3086E352B71B5E5956E2BF815D0DA2A71692F3406

SSDEEP:

1536:UZPBjOElmAL7q7ZPnKRfCzrlU8NC5IGRcB21rHZU3WtF2:K5qEO78RfUH1GRcBqCWtF2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Disables Windows Defender Real-time monitoring

      • winljjn.exe (PID: 2596)
      • winjnbr.exe (PID: 3472)
    • Changes the autorun value in the registry

      • 197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin.exe (PID: 2916)
      • 1869823818.exe (PID: 2244)
      • 1769417287.exe (PID: 3812)
    • Changes Security Center notification settings

      • winljjn.exe (PID: 2596)
      • winjnbr.exe (PID: 3472)
    • Disables Windows System Restore

      • winljjn.exe (PID: 2596)
      • winjnbr.exe (PID: 3472)
    • PHORPIEX was detected

      • winljjn.exe (PID: 2596)
    • Application was dropped or rewritten from another process

      • 1769417287.exe (PID: 3812)
      • winjnbr.exe (PID: 3472)
      • 1869823818.exe (PID: 2244)
      • winzixz.exe (PID: 1740)
      • 1465120583.exe (PID: 2560)
      • 2215816553.exe (PID: 852)
    • Connects to CnC server

      • winljjn.exe (PID: 2596)
    • NEMUCOD was detected

      • winjnbr.exe (PID: 3472)
    • Downloads executable files from the Internet

      • winljjn.exe (PID: 2596)
    • Downloads executable files from IP

      • winljjn.exe (PID: 2596)
  • SUSPICIOUS

    • Starts itself from another location

      • 197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin.exe (PID: 2916)
      • 1769417287.exe (PID: 3812)
      • 1869823818.exe (PID: 2244)
      • winjnbr.exe (PID: 3472)
    • Executable content was dropped or overwritten

      • 197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin.exe (PID: 2916)
      • winljjn.exe (PID: 2596)
      • 1769417287.exe (PID: 3812)
      • 1869823818.exe (PID: 2244)
      • winjnbr.exe (PID: 3472)
    • Creates files in the user directory

      • winljjn.exe (PID: 2596)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductVersion: 1.0.0.11
LegalCopyright: Copyright (C) 2019, fygdcjgj
InternalName: ghwk.uxu
FileVersion: 1.0.0.11
CharacterSet: Unknown (684B0)
LanguageCode: Unknown (5685)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Unknown (0x40444)
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x13fe
UninitializedDataSize: -
InitializedDataSize: 637440
CodeSize: 51200
LinkerVersion: 9
PEType: PE32
TimeStamp: 2018:06:15 21:20:28+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Jun-2018 19:20:28
FileVersion: 1.0.0.11
InternalName: ghwk.uxu
LegalCopyright: Copyright (C) 2019, fygdcjgj
ProductVersion: 1.0.0.11

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 15-Jun-2018 19:20:28
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000C6A8
0x0000C800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.02127
.rdata
0x0000E000
0x00001D68
0x00001E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.47647
.data
0x00010000
0x00091C1C
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.46521
.rsrc
0x000A2000
0x00007768
0x00007800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.65705
.reloc
0x000AA000
0x000013C0
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
3.52264

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.321
480
UNKNOWN
UNKNOWN
RT_VERSION
2
4.79724
2216
UNKNOWN
UNKNOWN
RT_ICON
3
3.94153
1736
UNKNOWN
UNKNOWN
RT_ICON
4
5.08432
1384
UNKNOWN
UNKNOWN
RT_ICON
5
5.33264
9640
UNKNOWN
UNKNOWN
RT_ICON
6
5.46609
4264
UNKNOWN
UNKNOWN
RT_ICON
7
6.09487
2440
UNKNOWN
UNKNOWN
RT_ICON
8
5.59129
1128
UNKNOWN
UNKNOWN
RT_ICON
12
3.28997
1568
UNKNOWN
UNKNOWN
RT_STRING
14
3.27377
1152
UNKNOWN
UNKNOWN
RT_STRING

Imports

KERNEL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
8
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start 197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin.exe #PHORPIEX winljjn.exe 1769417287.exe 1869823818.exe #NEMUCOD winjnbr.exe winzixz.exe 2215816553.exe no specs 1465120583.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2916"C:\Users\admin\AppData\Local\Temp\197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin.exe" C:\Users\admin\AppData\Local\Temp\197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2596C:\Users\admin\9338775214695042\winljjn.exeC:\Users\admin\9338775214695042\winljjn.exe
197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin.exe
User:
admin
Integrity Level:
MEDIUM
3812C:\Users\admin\AppData\Local\Temp\1769417287.exeC:\Users\admin\AppData\Local\Temp\1769417287.exe
winljjn.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2244C:\Users\admin\AppData\Local\Temp\1869823818.exeC:\Users\admin\AppData\Local\Temp\1869823818.exe
winljjn.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3472C:\Users\admin\9532990816502726\winjnbr.exeC:\Users\admin\9532990816502726\winjnbr.exe
1769417287.exe
User:
admin
Integrity Level:
MEDIUM
1740C:\Users\admin\7925687410435281\winzixz.exeC:\Users\admin\7925687410435281\winzixz.exe
1869823818.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
852C:\Users\admin\AppData\Local\Temp\2215816553.exeC:\Users\admin\AppData\Local\Temp\2215816553.exewinjnbr.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2560C:\Users\admin\AppData\Local\Temp\1465120583.exeC:\Users\admin\AppData\Local\Temp\1465120583.exewinjnbr.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
113
Read events
47
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
22441869823818.exeC:\Users\admin\7925687410435281\winzixz.exeexecutable
MD5:A8C8C0D61EEDC74792222AA787B6F074
SHA256:7E0B43B7F4FDF7E1BFB01CAA8AB9245C5CA0B80A2744A8E780354693AC28043F
2596winljjn.exeC:\Users\admin\AppData\Local\Temp\1869823818.exeexecutable
MD5:A8C8C0D61EEDC74792222AA787B6F074
SHA256:7E0B43B7F4FDF7E1BFB01CAA8AB9245C5CA0B80A2744A8E780354693AC28043F
2596winljjn.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\22[1].exeexecutable
MD5:A8C8C0D61EEDC74792222AA787B6F074
SHA256:7E0B43B7F4FDF7E1BFB01CAA8AB9245C5CA0B80A2744A8E780354693AC28043F
2596winljjn.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\11[1].exeexecutable
MD5:051356BEE1541F592D66969AF46FEB95
SHA256:A2BAAB92A8197C4A668EEC7D1C1333D1D8970EFCCBD169FE97D86D9309F2A610
3472winjnbr.exeC:\Users\admin\AppData\Local\Temp\1465120583.exeexecutable
MD5:A8C8C0D61EEDC74792222AA787B6F074
SHA256:7E0B43B7F4FDF7E1BFB01CAA8AB9245C5CA0B80A2744A8E780354693AC28043F
2596winljjn.exeC:\Users\admin\AppData\Local\Temp\1769417287.exeexecutable
MD5:051356BEE1541F592D66969AF46FEB95
SHA256:A2BAAB92A8197C4A668EEC7D1C1333D1D8970EFCCBD169FE97D86D9309F2A610
3472winjnbr.exeC:\Users\admin\AppData\Local\Temp\2215816553.exeexecutable
MD5:051356BEE1541F592D66969AF46FEB95
SHA256:A2BAAB92A8197C4A668EEC7D1C1333D1D8970EFCCBD169FE97D86D9309F2A610
2916197ddebcd96ac7d50c3eb2b3086e352b71b5e5956e2bf815d0da2a71692f3406.vrs.bin.exeC:\Users\admin\9338775214695042\winljjn.exeexecutable
MD5:068BABFD35552F8CB25059CB27053549
SHA256:197DDEBCD96AC7D50C3EB2B3086E352B71B5E5956E2BF815D0DA2A71692F3406
38121769417287.exeC:\Users\admin\9532990816502726\winjnbr.exeexecutable
MD5:051356BEE1541F592D66969AF46FEB95
SHA256:A2BAAB92A8197C4A668EEC7D1C1333D1D8970EFCCBD169FE97D86D9309F2A610
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
15
DNS requests
42
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2596
winljjn.exe
GET
92.63.197.153:80
http://92.63.197.153/tldr.php?new=1
RU
malicious
2596
winljjn.exe
GET
92.63.197.59:80
http://92.63.197.59/tldr.php?new=1
RU
malicious
2596
winljjn.exe
GET
92.63.197.59:80
http://92.63.197.59/tldr.php?on=1
RU
malicious
2596
winljjn.exe
GET
92.63.197.60:80
http://92.63.197.60/tldr.php?on=1
RU
malicious
2596
winljjn.exe
GET
94.156.133.65:80
http://94.156.133.65/22.exe
BG
malicious
2596
winljjn.exe
GET
94.156.133.65:80
http://94.156.133.65/11.exe
BG
malicious
2596
winljjn.exe
GET
92.63.197.153:80
http://92.63.197.153/tldr.php?on=1
RU
malicious
2596
winljjn.exe
GET
92.63.197.60:80
http://92.63.197.60/tldr.php?new=1
RU
malicious
2596
winljjn.exe
GET
200
94.156.133.65:80
http://94.156.133.65/22.exe
BG
executable
382 Kb
malicious
3472
winjnbr.exe
GET
92.63.197.153:80
http://92.63.197.153/tldr.php?on=1
RU
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2596
winljjn.exe
94.156.133.65:80
Spred Ltd
BG
malicious
2596
winljjn.exe
92.63.197.59:80
RU
malicious
2596
winljjn.exe
92.63.197.153:80
RU
malicious
2596
winljjn.exe
92.63.197.60:80
RU
malicious
3472
winjnbr.exe
94.156.133.65:80
Spred Ltd
BG
malicious
3472
winjnbr.exe
92.63.197.59:80
RU
malicious
1740
winzixz.exe
98.137.159.25:25
mta6.am0.yahoodns.net
Yahoo
US
unknown
92.63.197.153:80
RU
malicious
92.63.197.60:80
RU
malicious

DNS requests

Domain
IP
Reputation
ofhhusrugsrhgurhf.su
unknown
usifusurfbbuguruf.su
unknown
ohsufsiuesiuhuhgf.su
unknown
bafaejidjaiehfgsf.su
unknown
gaeuhaiuhfihehfsf.su
unknown
gaeifiuheiuhauhdf.su
unknown
gnnaneieaojoagisf.su
unknown
iaefiazefgizagdgf.su
unknown
agnediuaeuidhegsf.su
unknown
aehfiaheifuedhgsf.su
unknown

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2596
winljjn.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Phorpiex Bot Checkin (HTTP)
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
4 ETPRO signatures available at the full report
No debug info