analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

sickm.exe

Full analysis: https://app.any.run/tasks/f5a58a1a-82e8-43ba-bffb-781aba4e1d65
Verdict: Malicious activity
Analysis date: August 13, 2019, 13:31:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

BC194BA5EF094DAF39A5CD866A1E47CF

SHA1:

E6CC90297A6174815F4FCD708A7C9715F4905AFB

SHA256:

6FEE62956E80651C3EBAE50BEF7AC8F7093FBA22730DDCA8BBA47B0432DECFB5

SSDEEP:

12288:LBHF5N1o9fN7Q61wKgCn+Gog8P5B0jPRnSqV517byb:LB89BQ61wKgCn+Gog8P5B6PNS0H7by

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • jusched.exe (PID: 3652)
      • jusched.exe (PID: 3084)
    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3668)
      • cmd.exe (PID: 2084)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 628)
    • Changes the autorun value in the registry

      • jusched.exe (PID: 3084)
  • SUSPICIOUS

    • Creates files in the program directory

      • sickm.exe (PID: 2952)
      • kCiw1LJzuY.exe (PID: 2268)
      • jusched.exe (PID: 3084)
    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 4092)
      • cmd.exe (PID: 2540)
    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 576)
      • cmd.exe (PID: 3992)
    • Application launched itself

      • kCiw1LJzuY.exe (PID: 4000)
      • jusched.exe (PID: 3652)
    • Starts CMD.EXE for commands execution

      • kCiw1LJzuY.exe (PID: 2268)
      • sickm.exe (PID: 2952)
      • jusched.exe (PID: 3084)
    • Executable content was dropped or overwritten

      • sickm.exe (PID: 2952)
      • kCiw1LJzuY.exe (PID: 2268)
    • Starts itself from another location

      • sickm.exe (PID: 2952)
    • Uses ICACLS.EXE to modify access control list

      • cmd.exe (PID: 796)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2492)
    • Creates files in the user directory

      • jusched.exe (PID: 3084)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.1)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows command line
SubsystemVersion: 4
ImageVersion: 1
OSVersion: 4
EntryPoint: 0x14e0
UninitializedDataSize: 6656
InitializedDataSize: 474624
CodeSize: 346112
LinkerVersion: 2.25
PEType: PE32
TimeStamp: 2019:08:13 11:29:16+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 13-Aug-2019 09:29:16
TLS Callbacks: 2 callback(s) detected.

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 13-Aug-2019 09:29:16
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000547F4
0x00054800
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.40847
.data
0x00056000
0x00012690
0x00012800
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.32481
.rdata
0x00069000
0x0000B7D0
0x0000B800
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.37059
.bss
0x00075000
0x000019C0
0x00000000
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00077000
0x00001028
0x00001200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.86985
.CRT
0x00079000
0x00000034
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.280401
.tls
0x0007A000
0x00000020
0x00000200
IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.204488

Imports

KERNEL32.dll
msvcrt.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
32
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start sickm.exe kciw1ljzuy.exe no specs cmd.exe no specs ping.exe no specs kciw1ljzuy.exe cmd.exe no specs ping.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs icacls.exe no specs jusched.exe no specs cmd.exe no specs ping.exe no specs jusched.exe cmd.exe no specs ping.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs tskill.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2952"C:\Users\admin\AppData\Local\Temp\sickm.exe" C:\Users\admin\AppData\Local\Temp\sickm.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4000"C:\ProgramData\kCiw1LJzuY.exe"C:\ProgramData\kCiw1LJzuY.exesickm.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2084cmd /c ""C:\Users\admin\AppData\Local\Temp\4UOU3uXfXc6p4umCaU1E2Y7zJFF4p.bat" "C:\Windows\system32\cmd.exesickm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1044ping -n 2 127.0.0.1C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2268"C:\ProgramData\kCiw1LJzuY.exe" 129Mb8QH7A7tp9Ebc6UbC:\ProgramData\kCiw1LJzuY.exe
kCiw1LJzuY.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3668cmd /c ""C:\Users\admin\AppData\Local\Temp\52l0Uik5Dy80c73M5ngcW.bat" "C:\Windows\system32\cmd.exekCiw1LJzuY.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
404ping -n 3 127.0.0.1 C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4092cmd /c ""C:\Users\admin\AppData\Local\Temp\d559J2r43yi5OG2le81xRVPLVsP5ok.bat" "C:\Windows\system32\cmd.exekCiw1LJzuY.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3724tasklist C:\Windows\system32\tasklist.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
576cmd /c ""C:\Users\admin\AppData\Local\Temp\uiinFeVcV8hXebzb2S9j4.bat" "C:\Windows\system32\cmd.exekCiw1LJzuY.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
126
Read events
125
Write events
1
Delete events
0

Modification events

(PID) Process:(3084) jusched.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:imon
Value:
wscript.exe "C:\Users\admin\AppData\Roaming\Microsoft\Windows NT\imon.js"
Executable files
2
Suspicious files
1
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
2268kCiw1LJzuY.exeC:\Users\admin\AppData\Local\Temp\uiinFeVcV8hXebzb2S9j4.bat
MD5:
SHA256:
2268kCiw1LJzuY.exeC:\Users\admin\AppData\Local\Temp\uaMoOQCo5HAb7xlTSOB3s2nVaL.bat
MD5:
SHA256:
2268kCiw1LJzuY.exeC:\Users\admin\AppData\Local\Temp\j6rt6Lvs6BD2w85WZRDY1YZV.bat
MD5:
SHA256:
2268kCiw1LJzuY.exeC:\Users\admin\AppData\Local\Temp\T45GYvJ7Xp5t0pM14Zs02J8.bat
MD5:
SHA256:
3084jusched.exeC:\Users\admin\AppData\Local\Temp\Cp1o6d7KR70vwovQ6a5KIn.bat
MD5:
SHA256:
2268kCiw1LJzuY.exeC:\Users\admin\AppData\Local\Temp\52l0Uik5Dy80c73M5ngcW.battext
MD5:ED53075C1E596452DE3EB8095D426881
SHA256:12F2D0BA465E9C16F9C1DF363C892DD6EADE1B48CA40237F61630DFF55A343E1
3668cmd.exeC:\Users\admin\AppData\Local\Temp\JZ5S9g0vhSx66ft41u959Fx1g9.txttext
MD5:63A3D026F6E4381585F5AEFACE172263
SHA256:4C31393CE8AE5EA969A049B3FF5DD0EA18E6C29E0E59841BEC1D7AFB7C64DE4C
2952sickm.exeC:\Users\admin\AppData\Local\Temp\4UOU3uXfXc6p4umCaU1E2Y7zJFF4p.battext
MD5:C64C24765CA61548FCFF1A10EFB0F59E
SHA256:C3EA9112E962512C28E0A0DD123116188F7CA882FB31CFB4B3905D27C231CE4B
3652jusched.exeC:\Users\admin\AppData\Local\Temp\rCnAa853ndN1lj1OSg1s1iBq175Ybtext
MD5:83EDC9EB3766E3415DD8DB784F490C5E
SHA256:E6DAA78F9DBF3D65DAC026C050D5FB0A80283AF08C1E36E34B27C14A77E096EF
576cmd.exeC:\Users\admin\AppData\Local\Temp\5PFUL1wd02ATTSVs2630txxjtUIwB2.txttext
MD5:951D160263B56FFC4BFBE7ED3D5F70E2
SHA256:13867A58608102DAC1DA012409F3EBB776F0895DC816849A306AE6FCA036FC6D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2268
kCiw1LJzuY.exe
193.242.211.184:12858
sebains.kozow.com
easystores GmbH
NL
unknown
3084
jusched.exe
185.100.85.198:52051
lightoutlotway.dynu.net
Flokinet Ltd
RO
unknown

DNS requests

Domain
IP
Reputation
sebains.kozow.com
  • 193.242.211.184
unknown
lightoutlotway.dynu.net
  • 185.100.85.198
unknown

Threats

No threats detected
No debug info