analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

unpacked.mem

Full analysis: https://app.any.run/tasks/a5445593-564f-4a2a-bfc3-673ce89fe61e
Verdict: Malicious activity
Analysis date: October 04, 2022, 23:54:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

108756F41D114EB93E136BA2FEB838D0

SHA1:

8C6B51923EE7DA2F4642C7717DB95FBB77D96164

SHA256:

B38B4C1DCF6D6ECD1BBFC236B43C37C18044C2F42F11E5088384F4BD0751929C

SSDEEP:

768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • unpacked.mem.exe (PID: 1208)

    • Drops executable file immediately after starts

      • unpacked.mem.exe (PID: 1208)

    • Deletes shadow copies

      • rde.exe (PID: 1648)

  • SUSPICIOUS

    • Reads the computer name

      • unpacked.mem.exe (PID: 1208)
      • rde.exe (PID: 1648)

    • Checks supported languages

      • unpacked.mem.exe (PID: 1208)
      • rde.exe (PID: 1648)

    • Executable content was dropped or overwritten

      • unpacked.mem.exe (PID: 1208)

    • Drops a file with a compile date too recent

      • unpacked.mem.exe (PID: 1208)

    • Starts itself from another location

      • unpacked.mem.exe (PID: 1208)

    • Executed as Windows Service

      • vssvc.exe (PID: 2820)

    • Creates files in the program directory

      • rde.exe (PID: 1648)

  • INFO

    • Checks supported languages

      • VSSADMIN.EXE (PID: 2444)
      • vssvc.exe (PID: 2820)

    • Reads the computer name

      • VSSADMIN.EXE (PID: 2444)
      • vssvc.exe (PID: 2820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2016-Jun-25 09:56:46

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 232

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 4
TimeDateStamp: 2016-Jun-25 09:56:46
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
22342
22528
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.50048
.data
28672
72256
8704
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.98346
.tls
102400
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.reloc
106496
2352
2560
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.48686

Imports

ADVAPI32.dll
KERNEL32.dll
MPR.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
ntdll.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start unpacked.mem.exe rde.exe vssadmin.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1208"C:\Users\admin\AppData\Local\Temp\unpacked.mem.exe" C:\Users\admin\AppData\Local\Temp\unpacked.mem.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1648"C:\Users\admin\AppData\Local\Temp\rde.exe" {e29ac6c0-7037-11de-816d-806e6f6e6963} "C:\Users\admin\AppData\Local\Temp\UNPACK~1.EXE"C:\Users\admin\AppData\Local\Temp\rde.exe
unpacked.mem.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
2444"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /QuietC:\Windows\system32\VSSADMIN.EXE—rde.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2820C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 205
Read events
1 186
Write events
19
Delete events
0

Modification events

(PID) Process:(1208) unpacked.mem.exeKey:HKEY_CURRENT_USER\14C580F9981F625C738B49834E448A14
Operation:writeName:E-mail
(PID) Process:(1208) unpacked.mem.exeKey:HKEY_CURRENT_USER\14C580F9981F625C738B49834E448A14
Operation:writeName:BTC
Value:
XtumpYQZE3THSx5fG3P9uFTocAbU6DCdwQ
(PID) Process:(1208) unpacked.mem.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:iuld
Value:
C:\Users\admin\AppData\Local\Temp\!satana!.txt
(PID) Process:(1208) unpacked.mem.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1208) unpacked.mem.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1208) unpacked.mem.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1208) unpacked.mem.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1648) rde.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1648) rde.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1648) rde.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
1
Suspicious files
517
Text files
380
Unknown types
1

Dropped files

PID
Process
Filename
Type
1648rde.exeC:\Users\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
1208unpacked.mem.exeC:\Users\admin\AppData\Local\Temp\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
1648rde.exeC:\$Recycle.Bin\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
1648rde.exeC:\MSOCache\All Users\{90140000-0015-0412-0000-0000000FF1CE}-C\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
1648rde.exeC:\MSOCache\All Users\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
1648rde.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
1648rde.exeC:\MSOCache\All Users\{90140000-0015-0410-0000-0000000FF1CE}-C\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
1648rde.exeC:\MSOCache\All Users\{90140000-0015-0410-0000-0000000FF1CE}-C\[email protected]___AccessMUI.xmlbinary
MD5:5EC5F6AE976F49D42FA0F2F3BCC95365
SHA256:83A32139B88C85900677C510AA9C3A1E5D1DCDADE754120193EBDA0FD6725FE7
1648rde.exeC:\MSOCache\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
1648rde.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-500\!satana!.txttext
MD5:13FC77F573A9A8F0865CE3A5E8236201
SHA256:30B0B74DA4830EDFFC299AEC99F9C7D39442BE2A763EE64FAC1176776B572692
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1648
rde.exe
POST
—
185.127.26.186:80
http://185.127.26.186/add.php
RU
—
—
malicious
1208
unpacked.mem.exe
POST
—
185.127.26.186:80
http://185.127.26.186/add.php
RU
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1648
rde.exe
185.127.26.186:80
—
Kontel LLC
RU
malicious
1208
unpacked.mem.exe
185.127.26.186:80
—
Kontel LLC
RU
malicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
Process
Message
unpacked.mem.exe
"C:\Users\admin\AppData\Local\Temp\unpacked.mem.exe"
unpacked.mem.exe
HWID: 7EA61278DFBAD65AE31E707FFE019711
unpacked.mem.exe
hHeap = 0x270000 nSize = 8
unpacked.mem.exe
Locale: English
unpacked.mem.exe
Size: 0x1CE7 key:0x34
unpacked.mem.exe
Try Decrypt: uc_size = 1559, c_size = 999
unpacked.mem.exe
DeCompressor: Ok: 1559
unpacked.mem.exe
dwSzLending = 1559
unpacked.mem.exe
Try Decrypt: uc_size = 540, c_size = 589
unpacked.mem.exe
DeCompressor: Ok: 540
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
unpacked.mem