Find similar analyses in TI Lookup

Analysis date (UTC): 21 January 2019, 08:57Analysis environment: Windows 7 Pro, build 7601, x86

Возврат документов за январь.exe

MD5:22F2BDAA7DBA6037FE1DB7AAD3852759

SHA1:BF7E758A4F2F0685697938FC5AB41C945A125AB9

SHA256:A8954F6A48614141AFAF2B31CDD3962F4D5DF544927D0F16E882BFC21383E1D9

Analysis result

Threat level:Malicious activity

Tags:

trojanredaman

Full analysis:Analysis Возврат документов за январь.exe (MD5: 22F2BDAA7DBA6037FE1DB7AAD3852759) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Loads dropped or rewritten executable

Возврат документов за январь.exe (PID: 3120)
rundll32.exe (PID: 2444)
explorer.exe (PID: 284)

Loads the Task Scheduler COM API

Возврат документов за январь.exe (PID: 3120)

Changes settings of System certificates

rundll32.exe (PID: 2444)

REDAMAN was detected

rundll32.exe (PID: 2444)

Connects to CnC server

rundll32.exe (PID: 2444)

SUSPICIOUS

Executable content was dropped or overwritten

Возврат документов за январь.exe (PID: 3120)

Creates files in the program directory

Возврат документов за январь.exe (PID: 3120)

Adds / modifies Windows certificates

rundll32.exe (PID: 2444)

Connects to server without host name

rundll32.exe (PID: 2444)

INFO

No info indicators.

Threats

PID	Process	Class	Message
2444	rundll32.exe	Potentially Bad Traffic	ET CURRENT_EVENTS DNS Query Domain .bit
1052	svchost.exe	Potentially Bad Traffic	ET CURRENT_EVENTS DNS Query Domain .bit
2444	rundll32.exe	A Network Trojan was detected	MALWARE [PTsecurity] Win32/Spy.RTM.N
2444	rundll32.exe	A Network Trojan was detected	SC WORM Worm Bondat JS