analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

75

Full analysis: https://app.any.run/tasks/442e9b7a-96d9-4f49-b4e4-06581c622936
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 18, 2020, 11:51:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
stop
loader
stealer
vidar
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

74A9A644307645D1D527D7D39A87861C

SHA1:

C01EAB7AE134BBD4241CB5094B1D1A2609475B58

SHA256:

75E63CE7361FAE86BCD7B45B0F7A518D742827241383899463229F1ADD7410FC

SSDEEP:

12288:p7SQXagqF230NP0oAj9khqv1+CQD7Qw7xuWflbgtkxBW78T/8:YQXagA5t0oOeqv1+Co0wVuWfF8kiK/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 75.exe (PID: 892)

    • Loads the Task Scheduler COM API

      • 75.exe (PID: 892)
      • 75.exe (PID: 1816)

    • STOP was detected

      • 75.exe (PID: 1816)

    • Application was dropped or rewritten from another process

      • updatewin1.exe (PID: 3840)
      • updatewin1.exe (PID: 2896)
      • updatewin2.exe (PID: 3864)
      • updatewin.exe (PID: 600)
      • 5.exe (PID: 1244)

    • Writes to the hosts file

      • updatewin2.exe (PID: 3864)

    • Modifies hosts file to block updates

      • updatewin2.exe (PID: 3864)

    • Disables Windows Defender

      • updatewin1.exe (PID: 3840)

    • Task Manager has been disabled (taskmgr)

      • updatewin1.exe (PID: 3840)

    • Downloads executable files from the Internet

      • 75.exe (PID: 1816)
      • 5.exe (PID: 1244)

    • VIDAR was detected

      • 5.exe (PID: 1244)

    • Loads dropped or rewritten executable

      • 5.exe (PID: 1244)

    • Actions looks like stealing of personal data

      • 5.exe (PID: 1244)

    • Stealing of credential data

      • 5.exe (PID: 1244)

  • SUSPICIOUS

    • Uses ICACLS.EXE to modify access control list

      • 75.exe (PID: 892)

    • Executable content was dropped or overwritten

      • 75.exe (PID: 892)
      • 75.exe (PID: 1816)
      • 5.exe (PID: 1244)

    • Creates files in the user directory

      • 75.exe (PID: 892)
      • powershell.exe (PID: 2584)
      • powershell.exe (PID: 3392)
      • powershell.exe (PID: 2952)
      • 5.exe (PID: 1244)

    • Application launched itself

      • 75.exe (PID: 892)
      • updatewin1.exe (PID: 2896)
      • powershell.exe (PID: 3392)

    • Executes PowerShell scripts

      • updatewin1.exe (PID: 3840)
      • powershell.exe (PID: 3392)

    • Starts CMD.EXE for commands execution

      • updatewin1.exe (PID: 3840)
      • 5.exe (PID: 1244)

    • Reads the cookies of Mozilla Firefox

      • 5.exe (PID: 1244)

    • Creates files in the program directory

      • 5.exe (PID: 1244)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3848)

    • Checks for external IP

      • 5.exe (PID: 1244)

    • Reads the cookies of Google Chrome

      • 5.exe (PID: 1244)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • 75.exe (PID: 1816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:15 11:36:49+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 68096
InitializedDataSize: 792064
UninitializedDataSize: -
EntryPoint: 0x12ab
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Jun-2018 09:36:49
Debug artifacts:
  • C:\gac.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 15-Jun-2018 09:36:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00010969
0x00010A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.71171
.rdata
0x00012000
0x000970A8
0x00097200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.97342
.data
0x000AA000
0x0002745C
0x00002200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.664567
.gfids
0x000D2000
0x000010AC
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.79304
.rsrc
0x000D4000
0x000618A0
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.46442
.reloc
0x00136000
0x00000F60
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.44584

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.42877
4264
UNKNOWN
UNKNOWN
RT_ICON
20
3.24738
894
UNKNOWN
UNKNOWN
RT_STRING
21
3.25837
830
UNKNOWN
UNKNOWN
RT_STRING
216
1.7815
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

KERNEL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
15
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start 75.exe icacls.exe no specs #STOP 75.exe updatewin1.exe no specs updatewin1.exe no specs updatewin2.exe no specs powershell.exe no specs updatewin.exe no specs powershell.exe no specs #VIDAR 5.exe powershell.exe no specs mpcmdrun.exe no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
892"C:\Users\admin\AppData\Local\Temp\75.exe" C:\Users\admin\AppData\Local\Temp\75.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\75.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
960icacls "C:\Users\admin\AppData\Local\29f53c52-67cf-4c6d-8bca-e3d2b648df65" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\system32\icacls.exe—75.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
1816"C:\Users\admin\AppData\Local\Temp\75.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\75.exe
75.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\75.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2896"C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin1.exe" C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin1.exe—75.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
3840"C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin1.exe" --AdminC:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin1.exe—updatewin1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3864"C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin2.exe" C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin2.exe—75.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2584powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSignedC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—updatewin1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
600"C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin.exe" C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin.exe—75.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\9b8312f9-660b-4424-9e80-d4ccc931b603\updatewin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3392powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\admin\AppData\Local\script.ps1""' -Verb RunAs}"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—updatewin1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1244"C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\5.exe" C:\Users\admin\AppData\Local\9b8312f9-660b-4424-9e80-d4ccc931b603\5.exe
75.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\9b8312f9-660b-4424-9e80-d4ccc931b603\5.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\gdi32.dll
Total events
1 936
Read events
1 691
Write events
0
Delete events
0

Modification events

No data
Executable files
17
Suspicious files
7
Text files
15
Unknown types
6

Dropped files

PID
Process
Filename
Type
89275.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\geo[1].json —
MD5:—
SHA256:—
181675.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\geo[1].json —
MD5:—
SHA256:—
181675.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\get[1].php —
MD5:—
SHA256:—
181675.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\updatewin1[1].exe —
MD5:—
SHA256:—
181675.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\updatewin2[1].exe —
MD5:—
SHA256:—
181675.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\updatewin[1].exe —
MD5:—
SHA256:—
2584powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XF17AH3IWCP81TWMGQN8.temp —
MD5:—
SHA256:—
3392powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\975JF6XFQIDCE064DQR3.temp —
MD5:—
SHA256:—
181675.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\5[1].exe —
MD5:—
SHA256:—
3840updatewin1.exeC:\Users\admin\AppData\Local\Temp\delself.bat —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
11
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1816
75.exe
GET
—
188.246.229.213:80
http://ring2.ug/Asjdi435784ihjk65pen2/get.php?pid=2485E9F082250E269EA0EF635E0D382D&first=true
RU
—
—
malicious
1816
75.exe
GET
200
188.246.229.213:80
http://ring2.ug/files/penelop/updatewin.exe
RU
executable
277 Kb
malicious
1816
75.exe
GET
200
188.246.229.213:80
http://ring2.ug/files/penelop/updatewin2.exe
RU
executable
274 Kb
malicious
1816
75.exe
GET
404
188.246.229.213:80
http://ring2.ug/files/penelop/3.exe
RU
html
217 b
malicious
1816
75.exe
GET
200
188.246.229.213:80
http://ring2.ug/files/penelop/updatewin1.exe
RU
executable
272 Kb
malicious
1816
75.exe
GET
404
188.246.229.213:80
http://ring2.ug/files/penelop/4.exe
RU
html
217 b
malicious
1816
75.exe
GET
200
188.246.229.213:80
http://ring2.ug/files/penelop/5.exe
RU
executable
512 Kb
malicious
1244
5.exe
POST
200
208.95.112.1:80
http://ip-api.com/line/
unknown
text
169 b
shared
1244
5.exe
GET
200
209.141.34.150:80
http://barjamanis.com/freebl3.dll?ddosprotected=1
US
executable
326 Kb
malicious
1244
5.exe
POST
200
209.141.34.150:80
http://barjamanis.com/
US
text
22 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1816
75.exe
188.246.229.213:80
ring2.ug
Kassir, Ltd.
RU
malicious
1244
5.exe
209.141.34.150:80
barjamanis.com
FranTech Solutions
US
malicious
1816
75.exe
77.123.139.189:443
api.2ip.ua
Volia
UA
unknown
1244
5.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
892
75.exe
77.123.139.189:443
api.2ip.ua
Volia
UA
unknown

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 77.123.139.189
shared
ring2.ug
  • 188.246.229.213
malicious
barjamanis.com
  • 209.141.34.150
malicious
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET POLICY External IP Address Lookup DNS Query
1816
75.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
1816
75.exe
A Network Trojan was detected
ET TROJAN Potential Dridex.Maldoc Minimal Executable Request
1816
75.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1816
75.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
1816
75.exe
A Network Trojan was detected
RANSOMWARE [PTsecurity] Stop
1816
75.exe
A Network Trojan was detected
ET TROJAN Potential Dridex.Maldoc Minimal Executable Request
1816
75.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1816
75.exe
A Network Trojan was detected
ET TROJAN Potential Dridex.Maldoc Minimal Executable Request
1816
75.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
75