Program did not start
MALICIOUS | SUSPICIOUS | INFO |
---|---|---|
Changes the autorun value in the registry
|
Executable content was dropped or overwritten
|
No info indicators. |
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000068ED | 0x00006A00 | IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ | 7.049 |
.call | 0x00008000 | 0x00002900 | 0x00002A00 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 7.18342 |
.fame | 0x0000B000 | 0x00005180 | 0x00005200 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 7.22061 |
.port | 0x00011000 | 0x00000080 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 1.27345 |
.wpe | 0x00012000 | 0x000042FC | 0x00004400 | IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ | 7.51735 |
.data | 0x00017000 | 0x0000368F | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE | 4.25089 |
.same | 0x0001B000 | 0x000028C0 | 0x00002A00 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 7.17196 |
.reloc | 0x0001E000 | 0x000009B8 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ | 6.59741 |
.rsrc | 0x0001F000 | 0x0000167A | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ | 1.0721 |
Click at the process to see the details.
Image |
---|
c:\users\admin\appdata\local\temp\snkb00pt.exe |
c:\systemroot\system32\ntdll.dll |
c:\windows\system32\kernel32.dll |
c:\windows\system32\kernelbase.dll |
c:\windows\system32\shlwapi.dll |
c:\windows\system32\gdi32.dll |
c:\windows\system32\user32.dll |
c:\windows\system32\lpk.dll |
c:\windows\system32\usp10.dll |
c:\windows\system32\msvcrt.dll |
c:\windows\system32\imm32.dll |
c:\windows\system32\msctf.dll |
c:\windows\system32\ws2_32.dll |
c:\windows\system32\rpcrt4.dll |
c:\windows\system32\nsi.dll |
c:\windows\system32\wininet.dll |
c:\windows\system32\advapi32.dll |
c:\windows\system32\sechost.dll |
c:\windows\system32\urlmon.dll |
c:\windows\system32\ole32.dll |
c:\windows\system32\oleaut32.dll |
c:\windows\system32\crypt32.dll |
c:\windows\system32\msasn1.dll |
c:\windows\system32\iertutil.dll |
c:\windows\system32\psapi.dll |
c:\windows\system32\shell32.dll |
c:\windows\system32\dnsapi.dll |
c:\windows\system32\ntdll.dll |
c:\windows\system32\profapi.dll |
c:\windows\system32\apphelp.dll |
c:\users\admin\appdata\roaming\kemxpdghnqtukcq |
Image |
---|
c:\users\admin\appdata\roaming\kemxpdghnqtukcqf.exe |
c:\systemroot\system32\ntdll.dll |
c:\windows\system32\kernel32.dll |
c:\windows\system32\kernelbase.dll |
c:\windows\system32\shlwapi.dll |
c:\windows\system32\gdi32.dll |
c:\windows\system32\user32.dll |
c:\windows\system32\lpk.dll |
c:\windows\system32\usp10.dll |
c:\windows\system32\msvcrt.dll |
c:\windows\system32\imm32.dll |
c:\windows\system32\msctf.dll |
c:\windows\system32\ws2_32.dll |
c:\windows\system32\rpcrt4.dll |
c:\windows\system32\nsi.dll |
c:\windows\system32\wininet.dll |
c:\windows\system32\advapi32.dll |
c:\windows\system32\sechost.dll |
c:\windows\system32\urlmon.dll |
c:\windows\system32\ole32.dll |
c:\windows\system32\oleaut32.dll |
c:\windows\system32\crypt32.dll |
c:\windows\system32\msasn1.dll |
c:\windows\system32\iertutil.dll |
c:\windows\system32\shell32.dll |
c:\windows\system32\psapi.dll |
c:\windows\system32\dnsapi.dll |
c:\windows\system32\ntdll.dll |
c:\windows\system32\profapi.dll |
c:\windows\system32\nlaapi.dll |
c:\windows\system32\napinsp.dll |
c:\windows\system32\cfgmgr32.dll |
c:\windows\system32\pnrpnsp.dll |
c:\windows\system32\mswsock.dll |
c:\windows\system32\winrnr.dll |
c:\windows\system32\iphlpapi.dll |
c:\windows\system32\winnsi.dll |
c:\windows\system32\fwpuclnt.dll |
c:\windows\system32\rasadhlp.dll |
c:\windows\system32\wshtcpip.dll |
PID | Process | IP | ASN | CN | Reputation |
---|---|---|---|---|---|
284 | Kemxpdghnqtukcqf.exe | 148.81.111.66:9000 | Naukowa I Akademicka Siec Komputerowa Instytut Badawczy | PL | malicious |
284 | Kemxpdghnqtukcqf.exe | 148.81.111.67:9000 | Naukowa I Akademicka Siec Komputerowa Instytut Badawczy | PL | unknown |
284 | Kemxpdghnqtukcqf.exe | 208.100.26.242:9000 | Steadfast | US | malicious |
Domain | IP | Reputation |
---|---|---|
e.eastmoon.pl | 148.81.111.66
|
malicious |
s.richlab.pl | 148.81.111.67
|
unknown |
gigasbh.org | 208.100.26.242
|
malicious |
PID | Process | Class | Message |
---|---|---|---|
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN IRC Nick change on non-standard port |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN Likely Bot Nick in IRC (USA +..) |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-3 |
284 | Kemxpdghnqtukcqf.exe | Potentially Bad Traffic | ET CURRENT_EVENTS SUSPICIOUS IRC - NICK and Possible Windows XP/7 |
284 | Kemxpdghnqtukcqf.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN Likely Bot Nick in IRC (USA +..) |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-3 |
284 | Kemxpdghnqtukcqf.exe | Potentially Bad Traffic | ET CURRENT_EVENTS SUSPICIOUS IRC - NICK and Possible Windows XP/7 |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN IRC Nick change on non-standard port |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN Likely Bot Nick in IRC (USA +..) |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-3 |
284 | Kemxpdghnqtukcqf.exe | Potentially Bad Traffic | ET CURRENT_EVENTS SUSPICIOUS IRC - NICK and Possible Windows XP/7 |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN Likely Bot Nick in IRC (USA +..) |
284 | Kemxpdghnqtukcqf.exe | A Network Trojan was detected | ET TROJAN Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-3 |
284 | Kemxpdghnqtukcqf.exe | Potentially Bad Traffic | ET CURRENT_EVENTS SUSPICIOUS IRC - NICK and Possible Windows XP/7 |
No debug info.