Program did not start
MALICIOUS | SUSPICIOUS | INFO |
---|---|---|
Connects to CnC server
|
Creates files in the user directory
|
No info indicators. |
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0010A44C | 0x0010A600 | IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ | 6.43139 |
.rdata | 0x0010C000 | 0x00032F78 | 0x00033000 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 5.10678 |
.data | 0x0013F000 | 0x0000B00C | 0x00007200 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE | 3.00624 |
.dtd | 0x0014B000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE | 0.0659144 |
.dtc | 0x0014C000 | 0x00001188 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 3.95544 |
.xxx | 0x0014E000 | 0x00000014 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_SHARED,IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x0014F000 | 0x00011C28 | 0x00011E00 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 7.1526 |
.reloc | 0x00161000 | 0x0000EE74 | 0x0000F000 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ | 6.58247 |
No exports.
Click at the process to see the details.
Image |
---|
c:\users\admin\appdata\local\temp\[email protected]_8332.exe |
c:\systemroot\system32\ntdll.dll |
Image |
---|
c:\users\admin\appdata\local\temp\[email protected]_8332.exe |
c:\systemroot\system32\ntdll.dll |
c:\windows\system32\kernel32.dll |
c:\windows\system32\kernelbase.dll |
c:\windows\system32\winhttp.dll |
c:\windows\system32\msvcrt.dll |
c:\windows\system32\webio.dll |
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll |
c:\windows\system32\advapi32.dll |
c:\windows\system32\sechost.dll |
c:\windows\system32\rpcrt4.dll |
c:\windows\system32\gdi32.dll |
c:\windows\system32\user32.dll |
c:\windows\system32\lpk.dll |
c:\windows\system32\usp10.dll |
c:\windows\system32\imm32.dll |
c:\windows\system32\msctf.dll |
c:\windows\system32\ws2_32.dll |
c:\windows\system32\nsi.dll |
c:\windows\system32\urlmon.dll |
c:\windows\system32\wininet.dll |
c:\windows\system32\shlwapi.dll |
c:\windows\system32\iertutil.dll |
c:\windows\system32\ole32.dll |
c:\windows\system32\oleaut32.dll |
c:\windows\system32\crypt32.dll |
c:\windows\system32\msasn1.dll |
c:\windows\system32\shell32.dll |
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll |
c:\windows\system32\msimg32.dll |
c:\windows\system32\iphlpapi.dll |
c:\windows\system32\winnsi.dll |
c:\windows\system32\setupapi.dll |
c:\windows\system32\cfgmgr32.dll |
c:\windows\system32\devobj.dll |
c:\windows\system32\d3d9.dll |
c:\windows\system32\version.dll |
c:\windows\system32\d3d8thk.dll |
c:\windows\system32\dwmapi.dll |
c:\windows\system32\dbghelp.dll |
c:\windows\system32\rasapi32.dll |
c:\windows\system32\rasman.dll |
c:\windows\system32\netapi32.dll |
c:\windows\system32\netutils.dll |
c:\windows\system32\srvcli.dll |
c:\windows\system32\wkscli.dll |
c:\windows\system32\wldap32.dll |
c:\windows\system32\dhcpcsvc.dll |
c:\windows\system32\profapi.dll |
c:\windows\system32\wintrust.dll |
c:\windows\system32\vga.dll |
c:\windows\system32\rtutils.dll |
c:\windows\system32\cryptbase.dll |
c:\windows\system32\secur32.dll |
c:\windows\system32\sspicli.dll |
c:\windows\system32\windowscodecs.dll |
c:\windows\system32\cryptsp.dll |
c:\windows\system32\credssp.dll |
c:\windows\system32\mswsock.dll |
c:\windows\system32\wshqos.dll |
c:\windows\system32\wshtcpip.dll |
c:\windows\system32\wship6.dll |
c:\windows\system32\dnsapi.dll |
c:\windows\system32\clbcatq.dll |
c:\windows\system32\ieframe.dll |
c:\windows\system32\psapi.dll |
c:\windows\system32\oleacc.dll |
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll |
c:\windows\system32\rasadhlp.dll |
c:\windows\system32\fwpuclnt.dll |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2892 | [email protected]_8332.exe | POST | –– | 39.97.130.28:80 | http://x.93ne.com/qy/gl | CN |
text
––
|
––
|
malicious |
2892 | [email protected]_8332.exe | POST | –– | 39.97.130.28:80 | http://x.93ne.com/qy/gl | CN |
text
––
|
––
|
malicious |
2892 | [email protected]_8332.exe | POST | –– | 39.97.130.28:80 | http://x.93ne.com/qy/gl | CN |
text
––
|
––
|
malicious |
2892 | [email protected]_8332.exe | POST | –– | 39.97.130.28:80 | http://x.93ne.com/qy/gl | CN |
text
––
|
––
|
malicious |
2892 | [email protected]_8332.exe | POST | –– | 39.97.130.28:80 | http://x.93ne.com/qy/gl | CN |
text
––
|
––
|
malicious |
2892 | [email protected]_8332.exe | POST | –– | 39.97.130.28:80 | http://x.93ne.com/qy/gl | CN |
text
––
|
––
|
malicious |
PID | Process | IP | ASN | CN | Reputation |
---|---|---|---|---|---|
2892 | [email protected]_8332.exe | 39.97.130.28:80 | Hangzhou Alibaba Advertising Co.,Ltd. | CN | malicious |
PID | Process | Class | Message |
---|---|---|---|
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
2892 | [email protected]_8332.exe | Misc activity | ADWARE [PTsecurity] Qjwmonkey Check-in |
No debug info.