analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

36.bin

Full analysis: https://app.any.run/tasks/b3d90042-24fd-4967-8ca0-a1761369f69e
Verdict: Malicious activity
Threats:

Gootkit is an advanced banking trojan. It is extremely good at evading detection and has an incredibly effective persistence mechanism, making it a dangerous malware that researchers and organizations should be aware of.

Analysis date: December 14, 2018, 05:46:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
gootkit
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

293BDF934CC81FAE77B3514D52F651D8

SHA1:

CBFD7014C07AB7D2E5FE8CB99C1011D88ADA1C71

SHA256:

3632E7FE21C014D3F5F00BF0AFB2C387E29654DFD9A3B7131A765E2A47E14E09

SSDEEP:

12288:fVTH2Xv+XbF5GOzwe9lZgt/7uB7+pxlo6Ds2Zd5n:fV6v+Z4O/lZUu+pxlo6g2Zjn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes settings of System certificates

      • 36.bin.exe (PID: 4024)
    • Detected GootKit

      • 36.bin.exe (PID: 3088)
    • Changes internet zones settings

      • 36.bin.exe (PID: 3088)
  • SUSPICIOUS

    • Application launched itself

      • 36.bin.exe (PID: 3088)
    • Reads CPU info

      • 36.bin.exe (PID: 4024)
    • Creates files in the user directory

      • 36.bin.exe (PID: 4024)
    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 2364)
    • Starts CMD.EXE for commands execution

      • 36.bin.exe (PID: 4024)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:12:11 17:08:55+01:00
PEType: PE32
LinkerVersion: 12
CodeSize: 393728
InitializedDataSize: 908288
UninitializedDataSize: -
EntryPoint: 0x404d
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 9.5.32.72
ProductVersionNumber: 9.5.32.72
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Redtail Technology Draw
ProductVersion: 9.5.32.72
ProductName: Onesupply
LegalCopyright: Copyright © 2007 Redtail Technology Draw. All rights reserved
FileDescription: Onesupply
OriginalFileName: currentpound.exe
InternalName: Onesupply

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Dec-2014 16:08:55
Detected languages:
  • English - United States
Debug artifacts:
  • c:\ran\parent\During\MapTeeth.pdb
CompanyName: Redtail Technology Draw
ProductVersion: 9.5.32.72
ProductName: Onesupply
LegalCopyright: Copyright © 2007 Redtail Technology Draw. All rights reserved
FileDescription: Onesupply
OriginalFilename: currentpound.exe
InternalName: Onesupply

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 11-Dec-2014 16:08:55
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0006001F
0x00060200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.67366
.rdata
0x00062000
0x000073A8
0x00007400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.82634
.data
0x0006A000
0x00015CC0
0x0000CA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.8068
.rsrc
0x00080000
0x000BF378
0x000BF400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.83226
.reloc
0x00140000
0x000015BC
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.59522

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.79597
346
UNKNOWN
English - United States
RT_MANIFEST
2
5.1446
51240
UNKNOWN
English - United States
RT_ICON
3
4.25937
270376
UNKNOWN
English - United States
RT_ICON
4
4.42784
67624
UNKNOWN
English - United States
RT_ICON
5
4.30052
38056
UNKNOWN
English - United States
RT_ICON
6
4.55699
21640
UNKNOWN
English - United States
RT_ICON
7
4.61121
16936
UNKNOWN
English - United States
RT_ICON
8
4.57445
9640
UNKNOWN
English - United States
RT_ICON
9
4.85713
4264
UNKNOWN
English - United States
RT_ICON
10
4.95179
2440
UNKNOWN
English - United States
RT_ICON

Imports

GDI32.dll
KERNEL32.dll
TAPI32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #GOOTKIT 36.bin.exe taskmgr.exe no specs 36.bin.exe cmd.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3088"C:\Users\admin\AppData\Local\Temp\36.bin.exe" C:\Users\admin\AppData\Local\Temp\36.bin.exe
explorer.exe
User:
admin
Company:
Redtail Technology Draw
Integrity Level:
MEDIUM
Description:
Onesupply
3628"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4024C:\Users\admin\AppData\Local\Temp\36.bin.exe --vwxyzC:\Users\admin\AppData\Local\Temp\36.bin.exe
36.bin.exe
User:
admin
Company:
Redtail Technology Draw
Integrity Level:
MEDIUM
Description:
Onesupply
2364C:\Windows\system32\cmd.exe /c WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,productState /format:listC:\Windows\system32\cmd.exe36.bin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2932WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,productState /format:listC:\Windows\System32\Wbem\WMIC.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
872
Read events
93
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
402436.bin.exeC:\Users\admin\AppData\Local\Temp\Cab1C00.tmp
MD5:
SHA256:
402436.bin.exeC:\Users\admin\AppData\Local\Temp\Tar1C01.tmp
MD5:
SHA256:
402436.bin.exeC:\Users\admin\AppData\Local\Temp\Cab1C11.tmp
MD5:
SHA256:
402436.bin.exeC:\Users\admin\AppData\Local\Temp\Tar1C12.tmp
MD5:
SHA256:
402436.bin.exeC:\Users\admin\AppData\Local\Temp\Cab1D0D.tmp
MD5:
SHA256:
402436.bin.exeC:\Users\admin\AppData\Local\Temp\Tar1D1E.tmp
MD5:
SHA256:
402436.bin.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015compressed
MD5:A902CF373E02F7DC34F456ED7449279C
SHA256:EA0C12AEDEA644678014991A96534145E85AA12CD8955396DFDC98A4FC96F0D5
402436.bin.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015binary
MD5:C2CA3EE11062D670C6496AD1E641E78C
SHA256:ECCF878472C21C7D811DAF50464C4DAC5A6AB45906202FD3B6E7ACC64709616E
308836.bin.exeC:\Users\admin\AppData\Local\Temp\36.bin.infini
MD5:426D5D52F7453240FAF1365DD9A44EC9
SHA256:AF562EBE40B211535C11ACD938D488BB7FA04E363B2E0ED3FD5072AB77DF1EA6
402436.bin.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\578c3c4f2234dc4bd77dc4898cd130e8_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:55EFBB3ED79E97BDFD5834D0DFF84C17
SHA256:AEDC045E889AC3AD5E69108515B7CA3CEA14C3965F19626442C0444E76641B9A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4024
36.bin.exe
GET
200
2.16.186.81:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
55.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4024
36.bin.exe
2.16.186.81:80
www.download.windowsupdate.com
Akamai International B.V.
whitelisted
4024
36.bin.exe
163.172.91.34:443
dc.ct-scout.com
Online S.a.s.
FR
unknown

DNS requests

Domain
IP
Reputation
dc.ct-scout.com
  • 163.172.91.34
  • 163.172.90.208
  • 103.214.108.154
unknown
www.download.windowsupdate.com
  • 2.16.186.81
  • 2.16.186.56
whitelisted

Threats

PID
Process
Class
Message
4024
36.bin.exe
Generic Protocol Command Decode
SURICATA STREAM reassembly overlap with different data
4024
36.bin.exe
Generic Protocol Command Decode
SURICATA STREAM reassembly overlap with different data
Process
Message
36.bin.exe
MP3 file corrupted
36.bin.exe
WMA 0
36.bin.exe
WMA 3
36.bin.exe
4024:C:\Users\admin\AppData\Local\Temp\36.bin.exe --vwxyz Ignition....
36.bin.exe
JS : RUN : 36.bin.exe, ver : 20.11.18.1204
36.bin.exe
JS : WDE3:: GetAV processing...
36.bin.exe
JS : WDE3:: GetAV records: NOAV
36.bin.exe
OGG 0