File name: | nProjectV4.exe |
Full analysis: | https://app.any.run/tasks/cdbcea0c-5551-41a6-92a5-e7b1eeee75de |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 17:54:46 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (console) Intel 80386, for MS Windows |
MD5: | A453E063EC259B6429FD73ED70308D8E |
SHA1: | 6BBC2317CF7F6E08BA14BC12370E27D6BBD6F786 |
SHA256: | 3632C73738F73C6623543B6F97FE1C80B929D3C63FB15FB8CB3EABB0BC7D4736 |
SSDEEP: | 98304:IzIgQfwnF+pbZlkLkxMc7Hk71xdnkomKi:IzIfIn8pbPz2xxkoG |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
Compilation Date: | 2022-Oct-25 19:07:56 |
Detected languages: |
|
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 280 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 12 |
TimeDateStamp: | 2022-Oct-25 19:07:56 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
4096 | 1808350 | 946417 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.98788 | |
(#2) | 1814528 | 513806 | 247674 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.97055 |
(#3) | 2330624 | 44460 | 5898 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.84924 |
(#4) | 2375680 | 488 | 275 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.25982 |
(#5) | 2379776 | 79092 | 48287 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 7.97533 |
.imports | 2461696 | 4096 | 1536 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.43151 |
.tls | 2465792 | 4096 | 512 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.181202 |
.rsrc | 2469888 | 4096 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.77204 |
.themida | 2473984 | 4300800 | 0 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.boot | 6774784 | 2683904 | 2683904 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.9478 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.89623 | 392 | UNKNOWN | English - United States | RT_MANIFEST |
ADVAPI32.dll |
CRYPT32.dll |
MSVCP140.dll |
RPCRT4.dll |
SHELL32.dll |
USER32.dll |
USERENV.dll |
VCRUNTIME140.dll |
WS2_32.dll |
api-ms-win-crt-convert-l1-1-0.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
344 | "C:\Users\admin\AppData\Local\Temp\nProjectV4.exe" | C:\Users\admin\AppData\Local\Temp\nProjectV4.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
4016 | "C:\Users\admin\AppData\Local\Temp\nProjectV4.exe" | C:\Users\admin\AppData\Local\Temp\nProjectV4.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
2740 | C:\Windows\system32\cmd.exe /c cls | C:\Windows\system32\cmd.exe | — | nProjectV4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2248 | C:\Windows\system32\cmd.exe /c cls | C:\Windows\system32\cmd.exe | — | nProjectV4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1168 | C:\Windows\system32\cmd.exe /c cls | C:\Windows\system32\cmd.exe | — | nProjectV4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2224 | C:\Windows\system32\cmd.exe /c mode con: cols=80 lines=19 | C:\Windows\system32\cmd.exe | — | nProjectV4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3356 | mode con: cols=80 lines=19 | C:\Windows\system32\mode.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: DOS Device MODE Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1164 | C:\Windows\system32\cmd.exe /c cls | C:\Windows\system32\cmd.exe | — | nProjectV4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2532 | C:\Windows\system32\cmd.exe /c cls | C:\Windows\system32\cmd.exe | — | nProjectV4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2924 | C:\Windows\system32\cmd.exe /c color 09 | C:\Windows\system32\cmd.exe | — | nProjectV4.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
4016 | nProjectV4.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_5524823BD00A413DFC52CF245D9BF052 | der | |
MD5:CB7C08553C7FEDB3FB14EE3E3805AC17 | SHA256:3B3709FB7A122F12BB6C370DF6F25A2FA30C35C8575737D71F8C49E16806A30C | |||
4016 | nProjectV4.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\8K4H1G10.txt | text | |
MD5:9FD9A65872A99197E09C30AD4F7AC5DF | SHA256:C9185F88F4B5E0C06E0C2456FA86BFCDDDB166F530263143F63AFDBFD1C93A36 | |||
4016 | nProjectV4.exe | C:\Windows\Temp\Perm.exe | executable | |
MD5:657D9E3C8BF3CF72620EDDEBD1B0928C | SHA256:5ABA3AA1EFDCEC3B27364DD00FED800B7BAA68E89D138C2CA4F6A9B322F14B15 | |||
4016 | nProjectV4.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\CLOSE_.EXE[1].exe | executable | |
MD5:657D9E3C8BF3CF72620EDDEBD1B0928C | SHA256:5ABA3AA1EFDCEC3B27364DD00FED800B7BAA68E89D138C2CA4F6A9B322F14B15 | |||
4016 | nProjectV4.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_5524823BD00A413DFC52CF245D9BF052 | binary | |
MD5:35E1D3150EB628DC27385352E7299719 | SHA256:4502E228A4947A88431E4F1C3A23614EC41F68C9AF89F2BB2135CCF18BB1A884 | |||
4016 | nProjectV4.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:D5D82C08E6FD869FBAAAAF1765526E41 | SHA256:FEB7A9E2A2E668C38CA21A509C6F235AFB74F9576B24F69942F6EFD3261DB142 | |||
4016 | nProjectV4.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | binary | |
MD5:564BDB66FD1D659FA7EA7A3653CD50B6 | SHA256:BC6C18E82A64478076A3EB59E83C9BA3D42A327B1D6FA5010EE37D4D6A33E469 | |||
4016 | nProjectV4.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:3F40210E083DFC510F1B4EB2071685F2 | SHA256:7C80EEA6479A101EF2A3B791E5D7A23B7135112E9D0DCD8111B99622509360BA | |||
4016 | nProjectV4.exe | C:\ProgramData\BOSSCLEANER.bat | text | |
MD5:01DC2EAD2949FA29452C93B55523C974 | SHA256:C3F75F097175911348A9312329DCABE63FA981CB8D2A0224895A100C11E9927B | |||
4016 | nProjectV4.exe | C:\ProgramData\FiveM_Cleaner.exe | executable | |
MD5:C4C27642B041BC79E25FE5E644036FBA | SHA256:7286678F12AEB16D2EFA0D2131012C0395425C997DEBCB4528C67A1AEC3FD9CD |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4016 | nProjectV4.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
4016 | nProjectV4.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA4ZFS%2FPJgg7ME3dUpREkGs%3D | US | der | 279 b | whitelisted |
4016 | nProjectV4.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d02a935be103eb44 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4016 | nProjectV4.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
4016 | nProjectV4.exe | 188.114.97.3:443 | keyauth.win | CLOUDFLARENET | NL | malicious |
4016 | nProjectV4.exe | 162.159.129.233:443 | cdn.discordapp.com | CLOUDFLARENET | — | shared |
4016 | nProjectV4.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
keyauth.win |
| malicious |
cdn.discordapp.com |
| shared |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discordapp .com) |
4016 | nProjectV4.exe | Misc activity | ET INFO Observed Discord Domain (discordapp .com in TLS SNI) |
4016 | nProjectV4.exe | Misc activity | ET INFO Observed Discord Domain (discordapp .com in TLS SNI) |
4016 | nProjectV4.exe | Misc activity | ET INFO Observed Discord Domain (discordapp .com in TLS SNI) |