File name:

2.bin

Full analysis: https://app.any.run/tasks/7522b63e-d9a0-493f-9035-1b5cdefc1a76
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 24, 2023, 04:21:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
stop
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2E3014C5FF5CADC65FC58EB690622A88

SHA1:

16D5CAFECA7AEC4BEEF3936BCAC95F48907E3FBF

SHA256:

BB8CA51759F8D06CF58AA1091D63A50DA06A50AFC71549DD3718D97F5BC5EA79

SSDEEP:

12288:BkkPxsId5olxoRbMIJkBYYexmli2YFyQKU6KqqT8pYHEcvo76xqTQd:BnTd5QoqIJMeoixZjw76xqE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Renames files like ransomware

      • 2.bin.exe (PID: 3196)

    • Stop is detected

      • 2.bin.exe (PID: 3196)
      • 2.bin.exe (PID: 3036)

    • Connects to the CnC server

      • 2.bin.exe (PID: 3196)

    • Uses Task Scheduler to run other applications

      • build3.exe (PID: 2672)

    • Application was dropped or rewritten from another process

      • build3.exe (PID: 2672)

  • SUSPICIOUS

    • Application launched itself

      • 2.bin.exe (PID: 3488)
      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 1496)
      • 2.bin.exe (PID: 580)

    • Reads the Internet Settings

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)

    • Checks Windows Trust Settings

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)

    • Reads security settings of Internet Explorer

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)

    • Reads settings of System Certificates

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)

    • Adds/modifies Windows certificates

      • 2.bin.exe (PID: 3488)
      • 2.bin.exe (PID: 1496)

    • Executable content was dropped or overwritten

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • build3.exe (PID: 2672)

    • Uses ICACLS.EXE to modify access control lists

      • 2.bin.exe (PID: 2456)

    • The process executes via Task Scheduler

      • 2.bin.exe (PID: 580)

    • Process requests binary or script from the Internet

      • 2.bin.exe (PID: 3036)

  • INFO

    • Checks supported languages

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3488)
      • 2.bin.exe (PID: 1496)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)
      • 2.bin.exe (PID: 580)
      • build3.exe (PID: 2672)

    • Reads the machine GUID from the registry

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)

    • Checks proxy server information

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)

    • Creates files or folders in the user directory

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)
      • build3.exe (PID: 2672)

    • Reads the computer name

      • 2.bin.exe (PID: 2456)
      • 2.bin.exe (PID: 3036)
      • 2.bin.exe (PID: 3196)

    • Manual execution by a user

      • mmc.exe (PID: 2592)
      • mmc.exe (PID: 2928)
      • notepad.exe (PID: 3092)
      • explorer.exe (PID: 2068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

ProductionVersion: 22.85.51.64
ProductName: Banspreads
ProductsVersion: 72.94.14.35
OriginalFileName: betting.exe
LegalCopyright: Copyright (C) 2023, samvel
FileDescription: Juke
CharacterSet: Unknown (31F2)
LanguageCode: Maori
FileSubtype: -
ObjectFileType: Unknown
FileOS: Unknown (0x20761)
FileFlags: (none)
FileFlagsMask: 0x141a
ProductVersionNumber: 80.0.0.0
FileVersionNumber: 34.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x63d1
UninitializedDataSize: -
InitializedDataSize: 33565184
CodeSize: 680448
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2022:05:30 17:09:55+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 30-May-2022 17:09:55
Detected languages:
  • Punjabi - India (Gurmukhi script)
Debug artifacts:
  • C:\lace\guhim\cigovilu\linukigaye pogiwulutezo\luloser.pdb
FileDescription: Juke
LegalCopyright: Copyright (C) 2023, samvel
OriginalFilename: betting.exe
ProductsVersion: 72.94.14.35
ProductName: Banspreads
ProductionVersion: 22.85.51.64

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 30-May-2022 17:09:55
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000A613C
0x000A6200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.94906
.data
0x000A8000
0x01FF0EDC
0x00004800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.20815
.rsrc
0x02099000
0x00007FF0
0x00008000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.60147
.reloc
0x020A1000
0x00009900
0x00009A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.936022

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.65493
3752
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_ICON
2
4.18818
2216
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_ICON
3
3.72435
9640
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_ICON
4
3.75804
4264
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_ICON
5
3.89988
1128
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_ICON
6
3.0058
3752
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_CURSOR
7
3.51803
2216
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_CURSOR
8
3.98873
1384
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_CURSOR
10
3.42506
616
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_VERSION
22
3.0077
244
UNKNOWN
Punjabi - India (Gurmukhi script)
RT_STRING

Imports

ADVAPI32.dll
KERNEL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
13
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start 2.bin.exe no specs 2.bin.exe icacls.exe no specs 2.bin.exe #STOP 2.bin.exe mmc.exe no specs mmc.exe 2.bin.exe no specs #STOP 2.bin.exe explorer.exe no specs build3.exe schtasks.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
580icacls "C:\Users\admin\AppData\Local\d5e18dfd-f595-4c08-b96b-4849dfc8ea63" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\System32\icacls.exe—2.bin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
580C:\Users\admin\AppData\Local\d5e18dfd-f595-4c08-b96b-4849dfc8ea63\2.bin.exe --TaskC:\Users\admin\AppData\Local\d5e18dfd-f595-4c08-b96b-4849dfc8ea63\2.bin.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\d5e18dfd-f595-4c08-b96b-4849dfc8ea63\2.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
1496"C:\Users\admin\Desktop\2.bin.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\Desktop\2.bin.exe
2.bin.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\2.bin.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2068"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
2456"C:\Users\admin\Desktop\2.bin.exe" C:\Users\admin\Desktop\2.bin.exe
2.bin.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
2592"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\System32\mmc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mmc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2672"C:\Users\admin\AppData\Local\e47c7f77-c175-47d6-9cb6-bc419157c39b\build3.exe" C:\Users\admin\AppData\Local\e47c7f77-c175-47d6-9cb6-bc419157c39b\build3.exe
2.bin.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\e47c7f77-c175-47d6-9cb6-bc419157c39b\build3.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
2928"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\System32\mmc.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\mmc.exe
3036"C:\Users\admin\Desktop\2.bin.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\Desktop\2.bin.exe
2.bin.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\desktop\2.bin.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
3092"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\_readme.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
12 039
Read events
11 922
Write events
112
Delete events
5

Modification events

(PID) Process:(2456) 2.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2456) 2.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000004F010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2456) 2.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2456) 2.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2456) 2.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2456) 2.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2456) 2.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2456) 2.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2456) 2.bin.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2456) 2.bin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Operation:writeName:Blob
Value:
53000000010000004300000030413022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0190000000100000010000000EA6089055218053DD01E37E1D806EEDF620000000100000020000000E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD21400000001000000140000005379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB1D0000000100000010000000885010358D29A38F059B028559C95F900B00000001000000100000005300650063007400690067006F0000000300000001000000140000002B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E0F000000010000003000000066B764A96581128168CF208E374DDA479D54E311F32457F4AEE0DBD2A6C8D171D531289E1CD22BFDBBD4CFD979625483090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703082000000001000000E2050000308205DE308203C6A003020102021001FD6D30FCA3CA51A81BBC640E35032D300D06092A864886F70D01010C0500308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F72697479301E170D3130303230313030303030305A170D3338303131383233353935395A308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F7269747930820222300D06092A864886F70D01010105000382020F003082020A028202010080126517360EC3DB08B3D0AC570D76EDCD27D34CAD508361E2AA204D092D6409DCCE899FCC3DA9ECF6CFC1DCF1D3B1D67B3728112B47DA39C6BC3A19B45FA6BD7D9DA36342B676F2A93B2B91F8E26FD0EC162090093EE2E874C918B491D46264DB7FA306F188186A90223CBCFE13F087147BF6E41F8ED4E451C61167460851CB8614543FBC33FE7E6C9CFF169D18BD518E35A6A766C87267DB2166B1D49B7803C0503AE8CCF0DCBC9E4CFEAF0596351F575AB7FFCEF93DB72CB6F654DDC8E7123A4DAE4C8AB75C9AB4B7203DCA7F2234AE7E3B68660144E7014E46539B3360F794BE5337907343F332C353EFDBAAFE744E69C76B8C6093DEC4C70CDFE132AECC933B517895678BEE3D56FE0CD0690F1B0FF325266B336DF76E47FA7343E57E0EA566B1297C3284635589C40DC19354301913ACD37D37A7EB5D3A6C355CDB41D712DAA9490BDFD8808A0993628EB566CF2588CD84B8B13FA4390FD9029EEB124C957CF36B05A95E1683CCB867E2E8139DCC5B82D34CB3ED5BFFDEE573AC233B2D00BF3555740949D849581A7F9236E651920EF3267D1C4D17BCC9EC4326D0BF415F40A94444F499E757879E501F5754A83EFD74632FB1506509E658422E431A4CB4F0254759FA041E93D426464A5081B2DEBE78B7FC6715E1C957841E0F63D6E962BAD65F552EEA5CC62808042539B80E2BA9F24C971C073F0D52F5EDEF2F820F0203010001A3423040301D0603551D0E041604145379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF300D06092A864886F70D01010C050003820201005CD47C0DCFF7017D4199650C73C5529FCBF8CF99067F1BDA43159F9E0255579614F1523C27879428ED1F3A0137A276FC5350C0849BC66B4EBA8C214FA28E556291F36915D8BC88E3C4AA0BFDEFA8E94B552A06206D55782919EE5F305C4B241155FF249A6E5E2A2BEE0B4D9F7FF70138941495430709FB60A9EE1CAB128CA09A5EA7986A596D8B3F08FBC8D145AF18156490120F73282EC5E2244EFC58ECF0F445FE22B3EB2F8ED2D9456105C1976FA876728F8B8C36AFBF0D05CE718DE6A66F1F6CA67162C5D8D083720CF16711890C9C134C7234DFBCD571DFAA71DDE1B96C8C3C125D65DABD5712B6436BFFE5DE4D661151CF99AEEC17B6E871918CDE49FEDD3571A21527941CCF61E326BB6FA36725215DE6DD1D0B2E681B3B82AFEC836785D4985174B1B9998089FF7F78195C794A602E9240AE4C372A2CC9C762C80E5DF7365BCAE0252501B4DD1A079C77003FD0DCD5EC3DD4FABB3FCC85D66F7FA92DDFB902F7F5979AB535DAC367B0874AA9289E238EFF5C276BE1B04FF307EE002ED45987CB524195EAF447D7EE6441557C8D590295DD629DC2B9EE5A287484A59BB790C70C07DFF589367432D628C1B0B00BE09C4CC31CD6FCE369B54746812FA282ABD3634470C48DFF2D33BAAD8F7BB57088AE3E19CF4028D8FCC890BB5D9922F552E658C51F883143EE881DD7C68E3C436A1DA718DE7D3D16F162F9CA90A8FD
Executable files
7
Suspicious files
67
Text files
84
Unknown types
0

Dropped files

PID
Process
Filename
Type
24562.bin.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
24562.bin.exeC:\Users\admin\AppData\Local\d5e18dfd-f595-4c08-b96b-4849dfc8ea63\2.bin.exeexecutable
MD5:2E3014C5FF5CADC65FC58EB690622A88
SHA256:BB8CA51759F8D06CF58AA1091D63A50DA06A50AFC71549DD3718D97F5BC5EA79
24562.bin.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:4849DED5F45CEC7E511D14847C702399
SHA256:2481D98926336D63129E6B28C64FD1BEEE1E411C5DCCB5919027F8A01FE5DD51
24562.bin.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:1EAD0BB6A330777C6508FEC803CC9970
SHA256:8907C58B22C572ED38A1BA588D45AF78910AC4488A5C314B24211FA4549884AF
30362.bin.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:0858648175F5915731C77008A7BC41BC
SHA256:90F5BE9CD8D1AEF32EA63CB8B2962E93F6BCAB9F9468C1FF1C1B7B2C4A6A2D0C
30362.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\geo[1].jsonbinary
MD5:70774EE0718291A5A752C65B1354BB19
SHA256:6E8417BE5E8906657DC718D98C61372485CB1B78D60784E17A90AAA669AD652B
31962.bin.exeC:\Users\admin\AppData\Local\VirtualStore\_readme.txttext
MD5:E1ABE9B6E817A9E7CBF4AF9CED414783
SHA256:B163A9F3B8D0C74044A95AB6B47C517E29525A8240B49AB92DE55612E1F38B81
31962.bin.exeC:\SystemID\PersonalID.txttext
MD5:979DF546F94217E7576F80BDE8E305A7
SHA256:A565285A7C7B44D6A4E12F2BEA40A1CB7619FD3FBF454E7AF3A0A8C4DD615A94
31962.bin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\get[1].htmbinary
MD5:58624070707FF4B0FC771FCC0C69B9E6
SHA256:6670B1F369D0EEBC233F669BC147B20681A22045B729423558350EAD20CB4241
2592mmc.exeC:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschdxml
MD5:43C98B66AD84ED070D65A955D69E0FEF
SHA256:3DD7ADAE57D5DB563CDF96C1D7A2662913C251099F981445C7330D1FBBC3203F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
15
DNS requests
8
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3036
2.bin.exe
GET
—
190.219.109.29:80
http://zexeq.com/raud/get.php?pid=6E3AAB7CB29BC9495DFDE01272C66F39&first=true
PA
—
—
malicious
3036
2.bin.exe
GET
—
168.187.75.100:80
http://colisumy.com/dl/build2.exe
KW
—
—
malicious
1088
svchost.exe
GET
304
67.27.157.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8ec29131d1af17ae
US
—
—
whitelisted
3196
2.bin.exe
GET
200
190.219.109.29:80
http://zexeq.com/raud/get.php?pid=6E3AAB7CB29BC9495DFDE01272C66F39
PA
binary
563 b
malicious
3036
2.bin.exe
GET
200
190.219.109.29:80
http://zexeq.com/files/1/build3.exe
PA
executable
9.50 Kb
malicious
3036
2.bin.exe
GET
200
104.18.14.101:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
2456
2.bin.exe
GET
200
67.27.157.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f354e4196b46e102
US
compressed
4.70 Kb
whitelisted
2456
2.bin.exe
GET
200
104.18.15.101:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
der
2.18 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2456
2.bin.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
67.27.157.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2456
2.bin.exe
67.27.157.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2456
2.bin.exe
104.18.14.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
unknown
2456
2.bin.exe
104.18.15.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
3036
2.bin.exe
162.0.217.254:443
api.2ip.ua
NAMECHEAP-NET
NL
suspicious
3036
2.bin.exe
104.18.14.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
unknown
3036
2.bin.exe
168.187.75.100:80
colisumy.com
Zajil International Telecom Company KSCC
KW
malicious
3036
2.bin.exe
190.219.109.29:80
zexeq.com
Cable Onda
PA
malicious

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 162.0.217.254
shared
ctldl.windowsupdate.com
  • 67.27.157.254
  • 8.253.204.120
  • 67.27.235.254
  • 8.248.149.254
  • 67.27.157.126
whitelisted
ocsp.comodoca.com
  • 104.18.14.101
  • 104.18.15.101
whitelisted
crl.comodoca.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.usertrust.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
colisumy.com
  • 168.187.75.100
  • 190.220.222.145
  • 210.182.29.70
  • 211.53.230.67
  • 190.133.46.4
  • 175.120.254.9
  • 189.156.117.87
  • 190.187.52.42
  • 175.119.10.231
  • 60.246.84.247
malicious
zexeq.com
  • 190.219.109.29
  • 2.180.10.7
  • 109.175.29.39
  • 190.224.203.37
  • 222.236.49.124
  • 211.119.84.112
  • 115.88.24.200
  • 211.119.84.111
  • 211.53.230.67
  • 175.119.10.231
malicious

Threats

PID
Process
Class
Message
1088
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
2456
2.bin.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
3036
2.bin.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
3036
2.bin.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
3036
2.bin.exe
A Network Trojan was detected
ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
3036
2.bin.exe
A Network Trojan was detected
ET MALWARE Win32/Vodkagats Loader Requesting Payload
3036
2.bin.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3196
2.bin.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
3196
2.bin.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
3196
2.bin.exe
A Network Trojan was detected
ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
2 ETPRO signatures available at the full report
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn