File name: | Iostream.exe |
Full analysis: | https://app.any.run/tasks/c18f8762-91df-45c9-b238-60319e0898aa |
Verdict: | Malicious activity |
Analysis date: | April 25, 2019, 13:43:17 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 8A23F732481FA4D1AB3322B0AB6D1CD3 |
SHA1: | 57431747E37DA8EB687F82B0FC32511FB83220AB |
SHA256: | AEED751E77E3A58D908638BBAF2DF2E2D39F05103DA12F982D9400C67BD78583 |
SSDEEP: | 24576:U+gLjOb5a6y887m6opvv/qOj4L741psF36yg8xYZ:vUyPy88mfP7j0zZ |
.dll | | | Win32 Dynamic Link Library (generic) (43.5) |
---|---|---|
.exe | | | Win32 Executable (generic) (29.8) |
.exe | | | Generic Win/DOS Executable (13.2) |
.exe | | | DOS Executable Generic (13.2) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2018:04:06 14:21:50+02:00 |
PEType: | PE32 |
LinkerVersion: | 14 |
CodeSize: | 160768 |
InitializedDataSize: | 678912 |
UninitializedDataSize: | - |
EntryPoint: | 0x286000 |
OSVersion: | 6 |
ImageVersion: | - |
SubsystemVersion: | 6 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 06-Apr-2018 12:21:50 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 6 |
Time date stamp: | 06-Apr-2018 12:21:50 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
0x00001000 | 0x000CC000 | 0x0005B800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.98822 | |
.rsrc | 0x000CD000 | 0x000001E0 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.49012 |
.idata | 0x000CE000 | 0x00001000 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.30872 |
0x000CF000 | 0x00103000 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.260771 | |
vpxwflbh | 0x001D2000 | 0x000B4000 | 0x000B3C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.9233 |
dqbhgykr | 0x00286000 | 0x00001000 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.52206 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.91161 | 381 | UNKNOWN | English - United States | RT_MANIFEST |
comctl32.dll |
kernel32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1080 | "C:\Users\admin\AppData\Local\Temp\Iostream.exe" | C:\Users\admin\AppData\Local\Temp\Iostream.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM | ||||
2456 | schtasks /create /tn WindowsRecoveryCleaner /tr "C:\ProgramData\Iostream.exe" /st 00:00 /sc daily /du 9999:59 /ri 1 /f | C:\Windows\system32\schtasks.exe | — | Iostream.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3668 | "C:\Windows\System32\attrib.exe" | C:\Windows\System32\attrib.exe | Iostream.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3520 | C:\ProgramData\Iostream.exe | C:\ProgramData\Iostream.exe | taskeng.exe | |
User: admin Integrity Level: MEDIUM Exit code: 9 | ||||
2268 | schtasks /create /tn WindowsRecoveryCleaner /tr "C:\ProgramData\Iostream.exe" /st 00:00 /sc daily /du 9999:59 /ri 1 /f | C:\Windows\system32\schtasks.exe | — | Iostream.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
912 | C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3388 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\buswith.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3388 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR116C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3388 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{485E50D0-BA79-4B03-B8BA-082F010035BB}.tmp | — | |
MD5:— | SHA256:— | |||
3388 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{32EB6166-9CDE-4BA0-9BD4-3224EB5FDF22}.tmp | — | |
MD5:— | SHA256:— | |||
3388 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:165B0A21BCF6E2512BD4B45B7AE0B7CF | SHA256:EE2149094A33510DAAC9C2E4D6ECC27A10F036D0F3ED87EC4223F6B4252EE957 | |||
3388 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\buswith.rtf.LNK | lnk | |
MD5:F41DEB68C78F21CDE7EF353160A5B989 | SHA256:466475F452BCBBFDD61B2D768BA7840EB56641CC243AD68DCA32DAC9CB6ADC4B | |||
1080 | Iostream.exe | C:\ProgramData\Iostream.exe | executable | |
MD5:8A23F732481FA4D1AB3322B0AB6D1CD3 | SHA256:AEED751E77E3A58D908638BBAF2DF2E2D39F05103DA12F982D9400C67BD78583 | |||
3388 | WINWORD.EXE | C:\Users\admin\Desktop\~$uswith.rtf | pgc | |
MD5:255BA01113666265198DFBCF0183169D | SHA256:B02DD38C8DD1388203A3F87DF8F2DB6A6A8B2439E3F9F893F277BE342A17A46D | |||
3520 | Iostream.exe | C:\ProgramData\Iostream.exe | executable | |
MD5:8A23F732481FA4D1AB3322B0AB6D1CD3 | SHA256:AEED751E77E3A58D908638BBAF2DF2E2D39F05103DA12F982D9400C67BD78583 | |||
3388 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:7D820E15348D26F389F2DD3C9C33630A | SHA256:ECCA0AAA6E3BA1A72A3D56F810CDAD3CDC74B3DE5FA94927B94B97A2D37B94B2 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3668 | attrib.exe | 78.155.199.111:3333 | — | HLL LLC | RU | unknown |
Process | Message |
---|---|
Iostream.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
Iostream.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|