| File name: | memz.exe |
| Full analysis: | https://app.any.run/tasks/73eca1ac-d276-44c1-a2d0-375eed4d85ae |
| Verdict: | Malicious activity |
| Analysis date: | May 04, 2024, 06:16:09 |
| OS: | Ubuntu 22.04.2 |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 19DBEC50735B5F2A72D4199C4E184960 |
| SHA1: | 6FED7732F7CB6F59743795B2AB154A3676F4C822 |
| SHA256: | A3D5715A81F2FBEB5F76C88C9C21EEEE87142909716472F911FF6950C790C24D |
| SSDEEP: | 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3rC:sMVSaSEglcIqq3agmLc+6gyWqFCje |
MALICIOUS
No malicious indicators.SUSPICIOUS
Checks DMI information (probably VM detection)
- systemd-hostnamed (PID: 9374)
- systemd-hostnamed (PID: 9284)
- gnome-control-center (PID: 9349)
Executes commands using command-line interpreter
- cron (PID: 9399)
Checks the user who created the process
- cron (PID: 9399)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:07:10 12:59:43+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 3072 |
| InitializedDataSize: | 10752 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x122d |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
Total processes
242
Monitored processes
19
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 9263 | /bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /tmp/memz\.exe " | /bin/sh | — | any-guest-agent |
User: user Integrity Level: UNKNOWN | ||||
| 9264 | sudo -iu user nautilus /tmp/memz.exe | /usr/bin/sudo | — | sh |
User: user Integrity Level: UNKNOWN | ||||
| 9265 | nautilus /tmp/memz.exe | /usr/bin/nautilus | — | sudo |
User: user Integrity Level: UNKNOWN | ||||
| 9266 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | nautilus |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 9284 | /lib/systemd/systemd-hostnamed | /lib/systemd/systemd-hostnamed | — | systemd |
User: root Integrity Level: UNKNOWN Exit code: 9294 | ||||
| 9291 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd |
User: root Integrity Level: UNKNOWN Exit code: 496 | ||||
| 9292 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd |
User: root Integrity Level: UNKNOWN Exit code: 9265 | ||||
| 9293 | nautilus /tmp/memz.exe | /usr/bin/nautilus | — | nautilus |
User: user Integrity Level: UNKNOWN Exit code: 9265 | ||||
| 9294 | file-roller /tmp/memz.exe | /usr/bin/file-roller | — | nautilus |
User: user Integrity Level: UNKNOWN Exit code: 9265 | ||||
| 9309 | /usr/lib/p7zip/7z l -slt -bd -y -- /tmp/memz.exe | /usr/lib/p7zip/7z | — | file-roller |
User: user Integrity Level: UNKNOWN Exit code: 496 | ||||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 9265 | nautilus | /home/user/.local/share/nautilus/tags/meta.db-wal | — | |
MD5:— | SHA256:— | |||
| 9265 | nautilus | /home/user/.local/share/nautilus/tags/meta.db-shm | — | |
MD5:— | SHA256:— | |||
| 9265 | nautilus | /home/user/.local/share/nautilus/tags/.meta.isrunning | — | |
MD5:— | SHA256:— | |||
| 9265 | nautilus | /home/user/.local/share/recently-used.xbel.IFT7M2 | — | |
MD5:— | SHA256:— | |||
| 9294 | file-roller | /dconf/user | — | |
MD5:— | SHA256:— | |||
| 9265 | nautilus | /dconf/user | — | |
MD5:— | SHA256:— | |||
| 9265 | nautilus | /home/user/.config/mimeapps.list.27R3M2 | — | |
MD5:— | SHA256:— | |||
| 9265 | nautilus | /home/user/.local/share/recently-used.xbel.P2LKN2 | — | |
MD5:— | SHA256:— | |||
| 9349 | gnome-control-center | /dconf/user | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
5
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 91.189.91.97:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 91.189.91.97:80 | — | Canonical Group Limited | US | unknown |
— | — | 91.189.91.98:80 | — | Canonical Group Limited | US | unknown |
— | — | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.snapcraft.io |
| unknown |
108.100.168.192.in-addr.arpa |
| unknown |
connectivity-check.ubuntu.com |
| unknown |