| File name: | 字节跳动火山引擎平台开发JD.exe |
| Full analysis: | https://app.any.run/tasks/b3926d20-a792-401f-9c6c-48c09605df31 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | August 02, 2022, 02:13:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 331B7CBC7501349F8C233B5DFA05C679 |
| SHA1: | 5A7217DB3378B5A458D3CFC1B943C159A360A5CD |
| SHA256: | 8D2471173D893E3E98AB789FE1506305AB3EACB10785E3C8043B3D72E44DF5F2 |
| SSDEEP: | 3072:zQUilno5iOSvf8FGUjbFjHS6pGR/PUAP+5B:M8SvZwv8R/P5P+/ |
MALICIOUS
Application was dropped or rewritten from another process
- GoogleReportHandler.exe (PID: 3968)
Loads dropped or rewritten executable
- GoogleReportHandler.exe (PID: 3968)
Drops executable file immediately after starts
- 字节跳动火山引擎平台开发JD.exe (PID: 2272)
COBALT detected by memory dumps
- GoogleReportHandler.exe (PID: 3968)
SUSPICIOUS
Creates files in the program directory
- 字节跳动火山引擎平台开发JD.exe (PID: 2272)
Checks supported languages
- 字节跳动火山引擎平台开发JD.exe (PID: 2272)
- GoogleReportHandler.exe (PID: 3968)
Reads the computer name
- 字节跳动火山引擎平台开发JD.exe (PID: 2272)
- GoogleReportHandler.exe (PID: 3968)
Executable content was dropped or overwritten
- 字节跳动火山引擎平台开发JD.exe (PID: 2272)
Drops a file with a compile date too recent
- 字节跳动火山引擎平台开发JD.exe (PID: 2272)
INFO
Manual execution by user
- taskmgr.exe (PID: 4048)
Checks supported languages
- taskmgr.exe (PID: 4048)
Reads the computer name
- taskmgr.exe (PID: 4048)
Reads settings of System Certificates
- GoogleReportHandler.exe (PID: 3968)
Checks Windows Trust Settings
- GoogleReportHandler.exe (PID: 3968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| ProductVersion: | 1.0.0.1 |
|---|---|
| ProductName: | QQ升级模块 |
| OriginalFileName: | QQliveUp.exe |
| LegalCopyright: | Copyright (C) 2022 Tencent. |
| InternalName: | QQliveUp.exe |
| FileVersion: | 1.0.0.1 |
| FileDescription: | QQ升级模块 |
| CompanyName: | Tencent |
| CharacterSet: | Unicode |
| LanguageCode: | Chinese (Simplified) |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Windows NT 32-bit |
| FileFlags: | (none) |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 1.0.0.1 |
| FileVersionNumber: | 1.0.0.1 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 6 |
| ImageVersion: | - |
| OSVersion: | 6 |
| EntryPoint: | 0x15f6 |
| UninitializedDataSize: | - |
| InitializedDataSize: | 197632 |
| CodeSize: | 46592 |
| LinkerVersion: | 14 |
| PEType: | PE32 |
| TimeStamp: | 2022:07:26 18:05:53+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 26-Jul-2022 16:05:53 |
| Detected languages: |
|
| CompanyName: | Tencent |
| FileDescription: | QQ升级模块 |
| FileVersion: | 1.0.0.1 |
| InternalName: | QQliveUp.exe |
| LegalCopyright: | Copyright (C) 2022 Tencent. |
| OriginalFilename: | QQliveUp.exe |
| ProductName: | QQ升级模块 |
| ProductVersion: | 1.0.0.1 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0078 |
| Pages in file: | 0x0001 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0x0000 |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x0000 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000078 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 7 |
| Time date stamp: | 26-Jul-2022 16:05:53 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0000B4D1 | 0x0000B600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.59369 |
.rdata | 0x0000D000 | 0x00005874 | 0x00005A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.82535 |
.data | 0x00013000 | 0x0000129C | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.81407 |
.00cfg | 0x00015000 | 0x00000004 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0611629 |
.voltbl | 0x00016000 | 0x00000048 | 0x00000200 | 1.35029 | |
.rsrc | 0x00017000 | 0x00028C40 | 0x00028E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.31723 |
.reloc | 0x00040000 | 0x00000E14 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.15552 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.71208 | 323 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 2.88265 | 296 | UNKNOWN | Chinese - PRC | RT_ICON |
3 | 2.41366 | 11432 | UNKNOWN | Chinese - PRC | RT_ICON |
4 | 2.59146 | 7112 | UNKNOWN | Chinese - PRC | RT_ICON |
5 | 2.67402 | 5672 | UNKNOWN | Chinese - PRC | RT_ICON |
6 | 2.73616 | 5144 | UNKNOWN | Chinese - PRC | RT_ICON |
7 | 2.64589 | 3752 | UNKNOWN | Chinese - PRC | RT_ICON |
8 | 2.58835 | 2984 | UNKNOWN | Chinese - PRC | RT_ICON |
9 | 2.57484 | 2216 | UNKNOWN | Chinese - PRC | RT_ICON |
10 | 2.54228 | 1736 | UNKNOWN | Chinese - PRC | RT_ICON |
Imports
KERNEL32.dll |
urlmon.dll |
Total processes
37
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2272 | "C:\Users\admin\AppData\Local\Temp\字节跳动火山引擎平台开发JD.exe" | C:\Users\admin\AppData\Local\Temp\字节跳动火山引擎平台开发JD.exe | Explorer.EXE | ||||||||||||
User: admin Company: Tencent Integrity Level: MEDIUM Description: QQ升级模块 Exit code: 0 Version: 1.0.0.1 Modules
| |||||||||||||||
| 3968 | "c:\programdata\GoogleReportHandler.exe" | c:\programdata\GoogleReportHandler.exe | 字节跳动火山引擎平台开发JD.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4048 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
3 509
Read events
3 435
Write events
73
Delete events
1
Modification events
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2272) 字节跳动火山引擎平台开发JD.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8} |
| Operation: | write | Name: | WpadDecisionReason |
Value: 1 | |||
Executable files
5
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2272 | 字节跳动火山引擎平台开发JD.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\config[1].ini | binary | |
MD5:— | SHA256:— | |||
| 2272 | 字节跳动火山引擎平台开发JD.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\cloudmusic_reporter[1].zip | executable | |
MD5:— | SHA256:— | |||
| 2272 | 字节跳动火山引擎平台开发JD.exe | C:\programdata\GoogleReportHandler.zip | executable | |
MD5:— | SHA256:— | |||
| 2272 | 字节跳动火山引擎平台开发JD.exe | C:\programdata\config.ini | binary | |
MD5:— | SHA256:— | |||
| 2272 | 字节跳动火山引擎平台开发JD.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\libcurl[1].dll | executable | |
MD5:— | SHA256:— | |||
| 2272 | 字节跳动火山引擎平台开发JD.exe | C:\programdata\libcurl.dll | executable | |
MD5:— | SHA256:— | |||
| 2272 | 字节跳动火山引擎平台开发JD.exe | C:\ProgramData\GoogleReportHandler.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
0
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2272 | 字节跳动火山引擎平台开发JD.exe | GET | 200 | 39.107.225.204:80 | http://39.107.225.204/biden/joe/cloudmusic_reporter.zip | CN | executable | 836 Kb | suspicious |
2272 | 字节跳动火山引擎平台开发JD.exe | GET | 200 | 39.107.225.204:80 | http://39.107.225.204/biden/joe/libcurl.dll | CN | executable | 84.0 Kb | suspicious |
2272 | 字节跳动火山引擎平台开发JD.exe | GET | 200 | 39.107.225.204:80 | http://39.107.225.204/biden/joe/config.ini | CN | binary | 208 Kb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2272 | 字节跳动火山引擎平台开发JD.exe | 39.107.225.204:80 | — | Hangzhou Alibaba Advertising Co.,Ltd. | CN | suspicious |
3968 | GoogleReportHandler.exe | 117.25.133.178:443 | — | Xiamen | CN | suspicious |
DNS requests
Threats
PID | Process | Class | Message |
|---|---|---|---|
2272 | 字节跳动火山引擎平台开发JD.exe | Potentially Bad Traffic | ET INFO Dotted Quad Host ZIP Request |
2272 | 字节跳动火山引擎平台开发JD.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 |
2272 | 字节跳动火山引擎平台开发JD.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2272 | 字节跳动火山引擎平台开发JD.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 |
2272 | 字节跳动火山引擎平台开发JD.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
2272 | 字节跳动火山引擎平台开发JD.exe | Potentially Bad Traffic | ET INFO Dotted Quad Host DLL Request |
2272 | 字节跳动火山引擎平台开发JD.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 |
2272 | 字节跳动火山引擎平台开发JD.exe | Misc activity | ET INFO Packed Executable Download |
2272 | 字节跳动火山引擎平台开发JD.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 |
2272 | 字节跳动火山引擎平台开发JD.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
1 ETPRO signatures available at the full report