analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

blackpeoplesuck.exe

Full analysis: https://app.any.run/tasks/8899eeb3-f0de-455d-8a19-0351d77e517a
Verdict: Malicious activity
Analysis date: August 17, 2019, 13:30:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

713FFDBB6699585A4B117D0A910AE76D

SHA1:

2C735EE64C05BE52FB2B1E647317DE0041248BEF

SHA256:

F4CDBDB7F4862832AEFF1736BDB22EA9CD66282F5E7252291C94CB3E7649612D

SSDEEP:

384:0hVeamihWPx4KyfJk+gT7H2muCzGAbXaXL3vyfcpxmXAQSa+BUzAXWIu:08vRT7H25WGl37bQShBAAXk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • hexkhasautism.exe (PID: 2568)
      • dev8816.exe (PID: 2992)

    • Changes settings of System certificates

      • blackpeoplesuck.exe (PID: 3564)

    • Loads dropped or rewritten executable

      • hexkhasautism.exe (PID: 2568)
      • dev8816.exe (PID: 2992)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • blackpeoplesuck.exe (PID: 3564)
      • hexkhasautism.exe (PID: 2568)

    • Executable content was dropped or overwritten

      • blackpeoplesuck.exe (PID: 3564)
      • hexkhasautism.exe (PID: 2568)
      • dev8816.exe (PID: 2992)

    • Adds / modifies Windows certificates

      • blackpeoplesuck.exe (PID: 3564)

    • Loads DLL from Mozilla Firefox

      • dev8816.exe (PID: 2992)

  • INFO

    • Reads settings of System Certificates

      • blackpeoplesuck.exe (PID: 3564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:08:15 07:10:58+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 22016
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0x75c2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: glock_launcher_buy_cucklord
FileVersion: 1.0.0.0
InternalName: blackpeoplesuck.exe
LegalCopyright: Copyright © 2019
LegalTrademarks: -
OriginalFileName: blackpeoplesuck.exe
ProductName: glock_launcher_buy_cucklord
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Aug-2019 05:10:58
Comments: -
CompanyName: -
FileDescription: glock_launcher_buy_cucklord
FileVersion: 1.0.0.0
InternalName: blackpeoplesuck.exe
LegalCopyright: Copyright © 2019
LegalTrademarks: -
OriginalFilename: blackpeoplesuck.exe
ProductName: glock_launcher_buy_cucklord
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 15-Aug-2019 05:10:58
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x000055C8
0x00005600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.15353
.reloc
0x00008000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.0815394
.rsrc
0x0000A000
0x0000062C
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.6378

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.92871
527
Latin 1 / Western European
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start blackpeoplesuck.exe no specs blackpeoplesuck.exe cmd.exe no specs cmd.exe no specs hexkhasautism.exe dev8816.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3004"C:\Users\admin\AppData\Local\Temp\blackpeoplesuck.exe" C:\Users\admin\AppData\Local\Temp\blackpeoplesuck.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
glock_launcher_buy_cucklord
Exit code:
3221226540
Version:
1.0.0.0
3564"C:\Users\admin\AppData\Local\Temp\blackpeoplesuck.exe" C:\Users\admin\AppData\Local\Temp\blackpeoplesuck.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
glock_launcher_buy_cucklord
Exit code:
0
Version:
1.0.0.0
4064"cmd.exe" /c rmdir /s /q "C:\T64kKqF0TVVIsvme"C:\Windows\system32\cmd.exe—blackpeoplesuck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
364"cmd.exe" /c rmdir /s /q "C:\hexkhasautism.zip"C:\Windows\system32\cmd.exe—blackpeoplesuck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2568"C:\T64kKqF0TVVIsvme\hexkhasautism.exe" C:\T64kKqF0TVVIsvme\hexkhasautism.exe
blackpeoplesuck.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Version:
1.0.0.0
2992"C:\Users\admin\AppData\Local\Temp\dev8816.exe" C:\Users\admin\AppData\Local\Temp\dev8816.exe
hexkhasautism.exe
User:
admin
Integrity Level:
HIGH
Description:
App
Exit code:
0
Version:
1.0.0.0
3512"C:\Windows\System32\cmd.exe" /c cd "C:\Users\admin\AppData\Local\Temp\" & del /f /q dev8816.exe & rmdir /q /s x86C:\Windows\System32\cmd.exe—hexkhasautism.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2720"cmd.exe" /c rmdir /s /q "C:\T64kKqF0TVVIsvme"C:\Windows\system32\cmd.exe—blackpeoplesuck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2820"cmd.exe" /c rmdir /s /q "C:\hexkhasautism.zip"C:\Windows\system32\cmd.exe—blackpeoplesuck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
562
Read events
529
Write events
33
Delete events
0

Modification events

(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3564) blackpeoplesuck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\blackpeoplesuck_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
10
Suspicious files
1
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
3564blackpeoplesuck.exeC:\T64kKqF0TVVIsvme\Bunifu.UI.WinForms.BunifuToolTip.dllexecutable
MD5:BDF5EC072DE5D856BF6E8052A7FDD8AA
SHA256:39BD0E7D58E65C28827BF5DF6C11E3B61B385531FF1FA0C43380A53BEE4F6C96
2568hexkhasautism.exeC:\Users\admin\AppData\Local\Temp\dev8816.exeexecutable
MD5:950EA9D01B1323F83BF1A4F5B7844BD2
SHA256:13D1DBDB573479E4DFF289AC110EC7A8171717C08C5611D13DCB1B467D06D9CA
3564blackpeoplesuck.exeC:\T64kKqF0TVVIsvme\Bunifu.Core.dllexecutable
MD5:47EAF356CBFE43A1A790C94558AA7A3C
SHA256:3B6AB3A2777F61C08BED443E3075CA3337D7BD9B083602B8EC3FB417FD111565
3564blackpeoplesuck.exeC:\T64kKqF0TVVIsvme\Bunifu.UI.WinForms.BunifuCheckBox.dllexecutable
MD5:FB61419F8A3A896CAE0576E7109E4312
SHA256:F2A4E6BBB68DB04E126D5DBAB542450FDC543453FEF45923F1E8B069B2535A6C
3564blackpeoplesuck.exeC:\hexkhasautism.zipcompressed
MD5:FAAD612F9C64AEBD8E85B91427AAC98E
SHA256:5B222AAD52012E9978429A3C4E95A466E92D2D9D4688047A1C445DE706458FC3
3564blackpeoplesuck.exeC:\T64kKqF0TVVIsvme\hexkhasautism.exeexecutable
MD5:B329F596C0C96922AE894F28E319DFA9
SHA256:90C28ABB1A3F700CBDDE14C38DF9B60D7FE1530E584FE1FC0D486DF9AF873E87
3564blackpeoplesuck.exeC:\T64kKqF0TVVIsvme\Bunifu.UI.WinForms.BunifuButton.dllexecutable
MD5:C3D066EF8A28B1CBEC7F05F964262832
SHA256:D86883DC92F59B1897CD86F326884B6B9DD88B6A7ED6E7BC87A85C0E39607A98
3564blackpeoplesuck.exeC:\T64kKqF0TVVIsvme\Bunifu.UI.WinForms.BunifuLabel.dllexecutable
MD5:B002C536CD84EBF841D68F6541FF9FA3
SHA256:CDFA0AC9EE0653F40F13480058D0D6D55CE1DE6EA5643B2FD789425AFD1B7994
3564blackpeoplesuck.exeC:\T64kKqF0TVVIsvme\Bunifu_UI_v1.5.3.dllexecutable
MD5:F0817D0CB3C4730C61FE2BD2E6C3A2E5
SHA256:782F4E45B2E804D6B4741CC0989D9CD9FA78A8D13F0CF51C5053F6C90F8ECF92
3564blackpeoplesuck.exeC:\T64kKqF0TVVIsvme\DotNetAobScanMemory.dllexecutable
MD5:0F18D4F8323041B82363D2F4EC020957
SHA256:2DA7C186708FF1FCF363A35A8D776E0CD3FFE4EFE07F203D1A874D1EC4DF8BEA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3564
blackpeoplesuck.exe
GET
404
149.56.233.9:80
http://zeloverification.freeshells.org/glock/hexkhasautism.zip
CA
html
318 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3564
blackpeoplesuck.exe
149.56.233.9:80
zeloverification.freeshells.org
OVH SAS
CA
unknown
3564
blackpeoplesuck.exe
47.88.102.103:443
www.cutercounter.com
Alibaba (China) Technology Co., Ltd.
US
unknown
3564
blackpeoplesuck.exe
104.24.99.207:443
levensles.club
Cloudflare Inc
US
shared
2568
hexkhasautism.exe
68.183.70.207:50000
—
DSL Extreme
US
unknown
2992
dev8816.exe
68.183.70.207:50000
—
DSL Extreme
US
unknown

DNS requests

Domain
IP
Reputation
www.cutercounter.com
  • 47.88.102.103
unknown
zeloverification.freeshells.org
  • 149.56.233.9
unknown
levensles.club
  • 104.24.99.207
  • 104.24.98.207
malicious

Threats

PID
Process
Class
Message
2568
hexkhasautism.exe
Generic Protocol Command Decode
SURICATA Applayer Protocol detection skipped
Process
Message
dev8816.exe
Native library pre-loader is trying to load native SQLite library "C:\Users\admin\AppData\Local\Temp\x86\SQLite.Interop.dll"...
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
blackpeoplesuck.exe