analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | suk.exe |
| Full analysis: | https://app.any.run/tasks/23fed483-c0ca-4cdd-8d18-13cd3ea31caf |
| Verdict: | Malicious activity |
| Analysis date: | September 29, 2022 at 20:56:33 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (console) Intel 80386, for MS Windows |
| MD5: | 29C5707B4F3626606777FB4D66F55FB0 |
| SHA1: | 1B5B269DD23A72C5CB6EC6F80B0D6210F552D87B |
| SHA256: | 983822688D74EF6341F33A8A6B7FF476094678E373E9934D8B749ED3ED61BFBC |
| SSDEEP: | 393216:NbtwR5J3e3/TehYYfkP1UricCyCdN7mUh/CiIi02czJo:r0TeLyYYfE1UricCyCdN7mECiz02Y |
MALICIOUS
Loads dropped or rewritten executable
- suk.exe (PID: 4028)
Drops executable file immediately after starts
- suk.exe (PID: 1844)
SUSPICIOUS
Checks supported languages
- suk.exe (PID: 1844)
- suk.exe (PID: 4028)
Reads the computer name
- suk.exe (PID: 1844)
Application launched itself
- suk.exe (PID: 1844)
Drops a file with a compile date too recent
- suk.exe (PID: 1844)
Executable content was dropped or overwritten
- suk.exe (PID: 1844)
INFO
Dropped object may contain Bitcoin addresses
- suk.exe (PID: 1844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
| Compilation Date: | 2022-Sep-29 18:20:09 |
DOS Header
| e_magic: | MZ |
|---|---|
| e_cblp: | 144 |
| e_cp: | 3 |
| e_crlc: | - |
| e_cparhdr: | 4 |
| e_minalloc: | - |
| e_maxalloc: | 65535 |
| e_ss: | - |
| e_sp: | 184 |
| e_csum: | - |
| e_ip: | - |
| e_cs: | - |
| e_ovno: | - |
| e_oemid: | - |
| e_oeminfo: | - |
| e_lfanew: | 248 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| NumberofSections: | 5 |
| TimeDateStamp: | 2022-Sep-29 18:20:09 |
| PointerToSymbolTable: | - |
| NumberOfSymbols: | - |
| SizeOfOptionalHeader: | 224 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 4096 | 135672 | 135680 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65066 |
.rdata | 143360 | 52240 | 52736 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.97303 |
.data | 196608 | 63596 | 3072 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.67312 |
.rsrc | 262144 | 163840 | 163840 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.41559 |
.reloc | 425984 | 6828 | 7168 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.5413 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
0 | 3.06388 | 118 | Latin 1 / Western European | UNKNOWN | RT_GROUP_ICON |
1 | 2.11443 | 67624 | Latin 1 / Western European | UNKNOWN | RT_ICON |
2 | 2.37569 | 38056 | Latin 1 / Western European | UNKNOWN | RT_ICON |
3 | 2.47663 | 21640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4 | 2.37972 | 16936 | Latin 1 / Western European | UNKNOWN | RT_ICON |
5 | 2.56973 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
6 | 2.7517 | 4264 | Latin 1 / Western European | UNKNOWN | RT_ICON |
7 | 2.99211 | 2440 | Latin 1 / Western European | UNKNOWN | RT_ICON |
8 | 4.37821 | 1128 | Latin 1 / Western European | UNKNOWN | RT_ICON |
1 (#2) | 5.29005 | 1422 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
Imports
ADVAPI32.dll |
KERNEL32.dll |
Total processes
35
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1844 | "C:\Users\admin\AppData\Local\Temp\suk.exe" | C:\Users\admin\AppData\Local\Temp\suk.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
| 4028 | "C:\Users\admin\AppData\Local\Temp\suk.exe" | C:\Users\admin\AppData\Local\Temp\suk.exe | — | suk.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
Total events
15
Read events
15
Write events
0
Delete events
0
Modification events
Executable files
74
Suspicious files
2
Text files
32
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_Salsa20.pyd | executable | |
MD5:E372119201D5E3D9DEE6C0F92C45528C | SHA256:5CF3325E5389E8AE3EF8B5624091FF52681FC19470A8DE46123A13B5911B712B | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_ARC4.pyd | executable | |
MD5:7C67DD717AEAC76E4F815A1815B0E132 | SHA256:99B4AA473EE0B96EAD7E1FD671D56D574D5E68002A0085EE2F417B130AC29FF8 | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_pkcs1_decode.pyd | executable | |
MD5:0F89EB1217F3D4DA4D708C5545F8168F | SHA256:069130594D10F2C701FAE8FE2FA360B92A1A67E54DE001C7874619CE55804ED6 | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_chacha20.pyd | executable | |
MD5:451D863458F6B65B56B1AC7FDC8D5F8D | SHA256:7EECB87578526315BC4C2617802620468907C4A66923DAF08470C490F03AA5DE | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_aes.pyd | executable | |
MD5:7076F974FC82D571348028369E37EC25 | SHA256:D52F50AD7ECB170EA35B508F301F4A4D0F40CF7A6505EC1253F431BAB62A1326 | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_aesni.pyd | executable | |
MD5:C14F3A8A2ABD431A93BF2651F4ED7FE0 | SHA256:8D0EB66C634590EA2DAE7A2815F6731AA45B9AEB8A3FD3AAF0C88C575D1B2685 | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_arc2.pyd | executable | |
MD5:44D2C7A178D403E771D944950374D865 | SHA256:6379C58CC3C7017DB249B14D8708678420872D165040278ACEC947C4713E598F | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_blowfish.pyd | executable | |
MD5:719A46CA7041302B3F8A7CE8CE8DC619 | SHA256:4A4EE02533B1FF51B6F13781D57FB7FF0FA11B2A219AF601EF5BE6B4E01D9F7D | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_cast.pyd | executable | |
MD5:82443D3059B3A1AB168F313C57B88D02 | SHA256:04F3BA50B54066CE0E8CB67D6214020A1A4FD01870F95D1517A23F5C5A31DB70 | |||
| 1844 | suk.exe | C:\Users\admin\AppData\Local\Temp\_MEI18442\Crypto\Cipher\_raw_cbc.pyd | executable | |
MD5:48AD84C24A5C163660054E2F560EACDE | SHA256:6106E21A69E5FD53C1897192DECF771D1B679A6588BC7E1A35E915B47D269F03 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report