Malware analysis putty.exe Malicious activity | ANY.RUN

Add for printing

File name:	putty.exe
Full analysis:	https://app.any.run/tasks/7d33a047-caa0-40c4-836a-cc903208962f
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	August 02, 2018, 17:44:26
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	trojan betabot loader
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	EF94BCADB9C2BFBDE2E1C55071D40302
SHA1:	B11A77BB953638FA23512F4142B350A2447F8E19
SHA256:	39968A803CD18596A1D19E8DA0DDE3CF72E93AAABEA2BE29E817DCC7F2FCEE3A
SSDEEP:	24576:OToXeXeNVV34MLaIAvTtozgz2w32ryBeJ+RgDzcmFQUTMKyPceT2gPdqt3BWxWrM:nXe0FKfy1SbURI3O4Rmc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.007.20033)
Adobe Flash Player 27 ActiveX (27.0.0.187)
Adobe Flash Player 27 NPAPI (27.0.0.187)
Adobe Flash Player 27 PPAPI (27.0.0.187)
CCleaner (5.35)
FileZilla Client 3.31.0 (3.31.0)
Google Chrome (61.0.3163.91)
Google Update Helper (1.3.33.5)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Home and Business 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 (12.0.40660.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 (12.0.40660)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 (12.0.40660)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.11.25325 (14.11.25325.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.11.25325 (14.11.25325)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.11.25325 (14.11.25325)
Mozilla Firefox 55.0.3 (x86 en-US) (55.0.3)
Mozilla Maintenance Service (55.0.3)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype™ 7.39 (7.39.102)
Steam (2.10.91.91)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Changes internet zones settings
  - explorer.exe (PID: 948)
- Changes the autorun value in the registry
  - explorer.exe (PID: 948)
- Downloads executable files from the Internet
  - explorer.exe (PID: 948)
- Changes Image File Execution Options
  - explorer.exe (PID: 948)
- Connects to CnC server
  - explorer.exe (PID: 948)
SUSPICIOUS
- Application launched itself
  - putty.exe (PID: 4024)
- Executable content was dropped or overwritten
  - putty.exe (PID: 4024)
  - putty.exe (PID: 3904)
  - explorer.exe (PID: 948)
- Starts Internet Explorer
  - 9c5q5q3u1.exe (PID: 3160)
- Creates files in the program directory
  - explorer.exe (PID: 948)
  - putty.exe (PID: 3904)
INFO
- Dropped object may contain URL's
  - putty.exe (PID: 3904)
  - explorer.exe (PID: 948)
  - iexplore.exe (PID: 2408)
  - iexplore.exe (PID: 3264)
- Changes settings of System certificates
  - iexplore.exe (PID: 3264)
- Reads settings of System Certificates
  - iexplore.exe (PID: 3264)
- Adds / modifies Windows certificates
  - iexplore.exe (PID: 3264)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3264)
- Dropped object may contain Bitcoin addresses
  - iexplore.exe (PID: 3264)
- Creates files in the user directory
  - iexplore.exe (PID: 3264)
- Changes internet zones settings
  - iexplore.exe (PID: 2408)
- Application launched itself
  - iexplore.exe (PID: 2408)
- Reads internet explorer settings
  - iexplore.exe (PID: 3264)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe	\|	Win64 Executable (generic) (23.8)
.dll	\|	Win32 Dynamic Link Library (generic) (5.6)
.exe	\|	Win32 Executable (generic) (3.8)
.exe	\|	Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2018:08:03 01:09:57+02:00
PEType:	PE32
LinkerVersion:	8
CodeSize:	730624
InitializedDataSize:	186368
UninitializedDataSize:	-
EntryPoint:	0xb455e
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	2018.4.28.0
ProductVersionNumber:	2018.4.28.0
FileFlagsMask:	0x0017
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
Comments:	https://www.thegrideon.com/rdtos5.html
CompanyName:	Thegrideon Software
FileDescription:	Remote Desktop to SOCKS5
FileVersion:	2018.04.28
InternalName:	RDPtoS5
LegalCopyright:	Copyright (C) 2018 Thegrideon Software
LegalTrademarks:	Thegrideon Software
OriginalFileName:	RDtoS5.exe
ProductName:	Remote Desktop to SOCKS5
ProductVersion:	2018.04.28

Summary

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	02-Aug-2018 23:09:57
Detected languages:	English - United States French - France
Comments:	https://www.thegrideon.com/rdtos5.html
CompanyName:	Thegrideon Software
FileDescription:	Remote Desktop to SOCKS5
FileVersion:	2018.04.28
InternalName:	RDPtoS5
LegalCopyright:	Copyright (C) 2018 Thegrideon Software
LegalTrademarks:	Thegrideon Software
OriginalFilename:	RDtoS5.exe
ProductName:	Remote Desktop to SOCKS5
ProductVersion:	2018.04.28

DOS Header

Magic number:	MZ
Bytes on last page of file:	0x0090
Pages in file:	0x0003
Relocations:	0x0000
Size of header:	0x0004
Min extra paragraphs:	0x0000
Max extra paragraphs:	0xFFFF
Initial SS value:	0x0000
Initial SP value:	0x00B8
Checksum:	0x0000
Initial IP value:	0x0000
Initial CS value:	0x0000
Overlay number:	0x0000
OEM identifier:	0x0000
OEM information:	0x0000
Address of NE header:	0x00000080

PE Headers

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
Number of sections:	3
Time date stamp:	02-Aug-2018 23:09:57
Pointer to Symbol Table:	0x00000000
Number of symbols:	0
Size of Optional Header:	0x00E0
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00002000	0x000B2564	0x000B2600	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	7.18518
.rsrc	0x000B6000	0x0002D600	0x0002D600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.32695
.reloc	0x000E4000	0x0000000C	0x00000200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.10191

Resources

Title	Entropy	Size	Codepage	Language	Type
1	5.00112	490	Latin 1 / Western European	UNKNOWN	RT_MANIFEST
2	3.2831	67624	Latin 1 / Western European	French - France	RT_ICON
3	3.55986	38056	Latin 1 / Western European	French - France	RT_ICON
4	3.59099	21640	Latin 1 / Western European	French - France	RT_ICON
5	3.56388	16936	Latin 1 / Western European	French - France	RT_ICON
6	3.84765	9640	Latin 1 / Western European	French - France	RT_ICON
7	3.98833	4264	Latin 1 / Western European	French - France	RT_ICON
8	4.30372	2440	Latin 1 / Western European	French - France	RT_ICON
9	4.31669	1128	Latin 1 / Western European	French - France	RT_ICON

Imports


mscoree.dll

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

948

C:\Windows\explorer.exe

putty.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Explorer

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll

1916

/upd

C:\ProgramData\Google Updater 5.0\g5393go3a1cq.exe

—

explorer.exe

User:

admin

Company:

Thegrideon Software

Integrity Level:

MEDIUM

Description:

Remote Desktop to SOCKS5

Exit code:

Version:

2018.04.28

Modules

Images
c:\programdata\google updater 5.0\g5393go3a1cq.exe
c:\systemroot\system32\ntdll.dll

2408

"C:\Program Files\Internet Explorer\iexplore.exe" -nohome

C:\Program Files\Internet Explorer\iexplore.exe

9c5q5q3u1.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Internet Explorer

Exit code:

3489660927

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3160

"C:\ProgramData\Google Updater 5.0\9c5q5q3u1.exe" /uac /ifeo "" "C:\Windows\system32\eudcedit.exe"

C:\ProgramData\Google Updater 5.0\9c5q5q3u1.exe

explorer.exe

User:

admin

Company:

Thegrideon Software

Integrity Level:

HIGH

Description:

Remote Desktop to SOCKS5

Exit code:

2148734720

Version:

2018.04.28

Modules

Images
c:\programdata\google updater 5.0\9c5q5q3u1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll

3264

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2408 CREDAT:79873

C:\Program Files\Internet Explorer\iexplore.exe

iexplore.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Internet Explorer

Exit code:

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3328

C:\Windows\system32\DllHost.exe /Processid:{4D111E08-CBF7-4F12-A926-2C7920AF52FC}

C:\Windows\system32\DllHost.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

COM Surrogate

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

3904

"C:\Users\admin\AppData\Local\Temp\putty.exe"

C:\Users\admin\AppData\Local\Temp\putty.exe

putty.exe

User:

admin

Company:

Thegrideon Software

Integrity Level:

MEDIUM

Description:

Remote Desktop to SOCKS5

Exit code:

Version:

2018.04.28

Modules

Images
c:\users\admin\appdata\local\temp\putty.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

4024

"C:\Users\admin\AppData\Local\Temp\putty.exe"

C:\Users\admin\AppData\Local\Temp\putty.exe

explorer.exe

User:

admin

Company:

Thegrideon Software

Integrity Level:

MEDIUM

Description:

Remote Desktop to SOCKS5

Exit code:

4294967295

Version:

2018.04.28

Modules

Images
c:\users\admin\appdata\local\temp\putty.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll

Add for printing

Total events

659

Read events

501

Write events

158

Delete events

Modification events


(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Google Updater
Operation:	write	Name:	LastUpdate
Value: 3F767659EAF4EF493B1BE01C04AF304E
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	d9466ff34ee91e681c8
Value: 1200080002000800E207080002000800E207
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	adbebf49505d16b9371
Value: 00000000
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	33ea7a2095bf7c
Value: 00000000
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	1ad8dad1e8bd3fda0d8
Value: 00000000
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	a5909b604b
Value: 00000000
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	ebea0c745722d62a6
Value: 00000000
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	5dc861c2d985c3
Value: 00000000
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	687fc81cdaa
Value: BB771AB1FA383695412F5123A250B342198E7F44
(PID) Process:	(3904) putty.exe	Key:	HKEY_CURRENT_USER\Software\AppDataLow\Software\{236A6A45-F6E8-F355-2707-FC0018B32C52}\151E1F8A\a8903795aa392
Operation:	write	Name:	4b19d4786d2
Value: 7D3E043E623E6E3E4C3E513E593E4C3E5F3E533E7A3E5F3E4A3E5F3E623E793E513E513E593E523E5B3E1E3E6B3E4E3E5A3E5F3E4A3E5B3E4C3E1E3E0B3E103E0E3E623E073E5D3E0B3E4F3E0B3E4F3E0D3E4B3E0F3E103E5B3E463E5B3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E3E

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2408	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHUAAB7W\favicon[1].ico		—
		MD5:—	SHA256:—
2408	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3264	iexplore.exe	C:\Users\admin\AppData\Local\Temp\CabBD3A.tmp		—
		MD5:—	SHA256:—
3264	iexplore.exe	C:\Users\admin\AppData\Local\Temp\TarBD3B.tmp		—
		MD5:—	SHA256:—
3264	iexplore.exe	C:\Users\admin\AppData\Local\Temp\CabBD3C.tmp		—
		MD5:—	SHA256:—
3264	iexplore.exe	C:\Users\admin\AppData\Local\Temp\TarBD4D.tmp		—
		MD5:—	SHA256:—
3264	iexplore.exe	C:\Users\admin\AppData\Local\Temp\CabBDBB.tmp		—
		MD5:—	SHA256:—
3264	iexplore.exe	C:\Users\admin\AppData\Local\Temp\TarBDBC.tmp		—
		MD5:—	SHA256:—
3264	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@microsoft[1].txt		—
		MD5:—	SHA256:—
3264	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GUFVP8I9\shim-errors-for-the-net-framework-version-and-platform-support[1].txt		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3264	iexplore.exe	GET	302	104.111.243.236:80	http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9c5q5q3u1.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0	NL	—	—	whitelisted
3264	iexplore.exe	GET	301	2.18.233.31:80	http://support.microsoft.com/kb/2715633	unknown	—	—	malicious
3264	iexplore.exe	GET	304	93.184.221.240:80	http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	US	—	—	whitelisted
948	explorer.exe	GET	200	109.235.71.9:80	http://kanorkanor23.club/keygen.exe	LT	executable	896 Kb	suspicious
948	explorer.exe	POST	200	149.129.214.39:80	http://kikidoyoulabme222.ru/panels_encoded/logout.php	SG	binary	188 b	malicious
3264	iexplore.exe	GET	302	40.124.13.228:80	http://dotnetsocial.cloudapp.net/redir?o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9c5q5q3u1.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0	US	html	156 b	whitelisted
2408	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3264	iexplore.exe	93.184.221.240:80	www.download.windowsupdate.com	MCI Communications Services, Inc. d/b/a Verizon Business	US	whitelisted
3264	iexplore.exe	2.18.233.31:443	support.microsoft.com	Akamai International B.V.	—	whitelisted
3264	iexplore.exe	2.16.186.33:443	statics-uhf-eus.akamaized.net	Akamai International B.V.	—	whitelisted
3264	iexplore.exe	104.111.216.162:443	mem.gfx.ms	Akamai International B.V.	NL	whitelisted
948	explorer.exe	191.239.213.197:80	microsoft.com	Microsoft Corporation	IE	whitelisted
948	explorer.exe	149.129.214.39:80	kikidoyoulabme222.ru	—	SG	malicious
948	explorer.exe	109.235.71.9:80	kanorkanor23.club	UAB Rakrejus	LT	suspicious
3264	iexplore.exe	104.111.243.236:80	go.microsoft.com	Akamai International B.V.	NL	whitelisted
2408	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3264	iexplore.exe	40.124.13.228:80	dotnetsocial.cloudapp.net	Microsoft Corporation	US	whitelisted

DNS requests

Domain	IP	Reputation
microsoft.com	191.239.213.197 104.40.211.35 104.43.195.251 23.100.122.175 23.96.52.53	whitelisted
kikidoyoulabme222.ru	149.129.214.39	malicious
kanorkanor23.club	109.235.71.9	suspicious
go.microsoft.com	104.111.243.236	whitelisted
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
dotnetsocial.cloudapp.net	40.124.13.228	whitelisted
support.microsoft.com	2.18.233.31	malicious
www.download.windowsupdate.com	93.184.221.240	whitelisted
statics-uhf-eus.akamaized.net	2.16.186.33 2.16.186.8	whitelisted
mem.gfx.ms	104.111.216.162	whitelisted

Threats

PID	Process	Class	Message
948	explorer.exe	A Network Trojan was detected	ET TROJAN Win32/Neurevt.A/Betabot Check-in 4
948	explorer.exe	A Network Trojan was detected	ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
948	explorer.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP

Add for printing

No debug info

General Info

putty.exe

EF94BCADB9C2BFBDE2E1C55071D40302

B11A77BB953638FA23512F4142B350A2447F8E19

39968A803CD18596A1D19E8DA0DDE3CF72E93AAABEA2BE29E817DCC7F2FCEE3A

24576:OToXeXeNVV34MLaIAvTtozgz2w32ryBeJ+RgDzcmFQUTMKyPceT2gPdqt3BWxWrM:nXe0FKfy1SbURI3O4Rmc

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes internet zones settings

Changes the autorun value in the registry

Downloads executable files from the Internet

Changes Image File Execution Options

Connects to CnC server

SUSPICIOUS

Application launched itself

Executable content was dropped or overwritten

Starts Internet Explorer

Creates files in the program directory

INFO

Dropped object may contain URL's

Changes settings of System certificates

Reads settings of System Certificates

Adds / modifies Windows certificates

Reads Internet Cache Settings

Dropped object may contain Bitcoin addresses

Creates files in the user directory

Changes internet zones settings

Application launched itself

Reads internet explorer settings

Malware configuration

Static information

TRiD

EXIF

EXE

Summary

DOS Header

PE Headers

Sections

Resources

Imports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings