2.7
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.58
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Crypt-QBY [Trj] | 20191009 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Spy.Zbot.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191009 | 2013.8.14.323 |
| McAfee | PWSZbot-FEV!1C80A02E38ED | 20191009 | 6.0.6.653 |
| Tencent | None | 20191009 | 1.0.0.1 |
静态指标
文件包含未知的 PE 资源名称，可能指示打包器
(1 个事件)
| resource name | PNG |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在 PE 资源中识别到外语
(2 个事件)
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x00004aac | size | 0x00000ea8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x00005954 | size | 0x00000014 | ||||||||||||||||||
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 212.32.237.91:443 |
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Trojan.GenericKD.1360396 |
| APEX | Malicious |
| AVG | Win32:Crypt-QBY [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1360396 |
| AhnLab-V3 | HEUR/Fakon.mow |
| Antiy-AVL | Trojan/Win32.Tgenic |
| Arcabit | Trojan.Generic.D14C20C |
| Avast | Win32:Crypt-QBY [Trj] |
| Avira | TR/Rogue.AI.10241 |
| Baidu | Win32.Trojan-Spy.Zbot.a |
| BitDefender | Trojan.GenericKD.1360396 |
| CAT-QuickHeal | TrojanDownloader.Upatre.A2 |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.Spy.Zbot.XBX@53jt9z |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.e38ed8 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.CDNX-7295 |
| DrWeb | Trojan.Packed.24839 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Emsisoft | Trojan.GenericKD.1360396 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan2.NXPS |
| F-Secure | Trojan.TR/Rogue.AI.10241 |
| FireEye | Generic.mg.1c80a02e38ed80f0 |
| Fortinet | W32/Kryptik.BNKP!tr |
| GData | Trojan.GenericKD.1360396 |
| Ikarus | Trojan-Spy.Zbot |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.dwuq |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | Trojan-Spy.Win32.Zbot.qmme |
| MAX | malware (ai score=87) |
| Malwarebytes | Trojan.Downloader |
| McAfee | PWSZbot-FEV!1C80A02E38ED |
| McAfee-GW-Edition | BehavesLike.Win32.Virut.mm |
| MicroWorld-eScan | Trojan.GenericKD.1360396 |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.clmqzc |
| Panda | Trj/Ransom.AY |
| Qihoo-360 | HEUR/QVM19.1.6F95.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Zbot-GSF |
| Symantec | Trojan.Gen |
| TotalDefense | Win32/Tnega.IIJKLcD |
| TrendMicro | TROJ_DLOAD.AGD |
| TrendMicro-HouseCall | TROJ_DLOAD.AGD |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-24 19:40:48
PE Imphash
2a71d4f31a0049abe53363fda443e30e
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00002a62 | 0x00002c00 | 5.808312604032413 |
| .rsrc | 0x00004000 | 0x00001ac4 | 0x00001c00 | 6.395999419501541 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| PNG | 0x00004138 | 0x00000971 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_ICON | 0x00004aac | 0x00000ea8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_GROUP_ICON | 0x00005954 | 0x00000014 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_MANIFEST | 0x00005968 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library gdiplus.dll:
• 0x301090 GdipCloneImage
• 0x301094 GdiplusStartup
• 0x301098 GdiplusShutdown
• 0x30109c GdipBitmapGetPixel
• 0x3010a0 GdipCreateBitmapFromStreamICM
• 0x3010a4 GdipCreateBitmapFromStream
• 0x3010a8 GdipGetImageHeight
• 0x3010ac GdipGetImageWidth
• 0x3010b0 GdipDisposeImage
• 0x3010b4 GdipFree
• 0x3010b8 GdipAlloc
Library KERNEL32.dll:
• 0x301000 HeapFree
• 0x301004 FindResourceA
• 0x301008 LoadResource
• 0x30100c SizeofResource
• 0x301010 LockResource
• 0x301014 GetProcessHeap
• 0x301018 HeapAlloc
• 0x30101c CreateFileW
• 0x301020 WriteFile
• 0x301024 CloseHandle
• 0x301028 lstrcatW
• 0x30102c OutputDebugStringW
• 0x301030 FreeLibrary
• 0x301034 GetCurrentProcess
• 0x301038 GetProcAddress
• 0x30103c LoadLibraryW
• 0x301040 LoadLibraryA
Library USER32.dll:
• 0x301048 UpdateWindow
• 0x30104c ShowWindow
• 0x301050 CreateWindowExW
• 0x301054 RegisterClassExW
• 0x301058 LoadCursorW
• 0x30105c LoadIconW
• 0x301060 DefWindowProcW
• 0x301064 InvalidateRect
• 0x301068 PostQuitMessage
• 0x30106c SendMessageW
• 0x301070 GetMessageW
• 0x301074 wvsprintfW
• 0x301078 EndPaint
• 0x30107c FillRect
• 0x301080 GetClientRect
• 0x301084 BeginPaint
• 0x301088 DispatchMessageW
L!This program cannot be run in DOS mode.
I6JI6JI6JI7JI6J1JI6J?JI6J?JI6J?JI6JRichI6J
PB"BBBBBBBBUBBBBBBBJBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBXBBB
BcfUbfOo,FL
BBBBBBB]^
E474E4
e4E48M4E48M4E4
E4BBBBBBBBBBBBBBBBBBBBBBBBHBBbB'
BBBBBBBB^B
BBBBBBF@BBB@BBBFBBBBJBB@BBB
BBBbBBBBBBbBBBBBBNBBBBB,ZBB
BJBB@BB@BBBB@BB@BBBBBB@BBBBBBBBBBBfBBBBBBJBBbBBBBBBBBBBBBBBBBBBBHBBNBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBFBBBBBBBBBBBBBBBBBBBBBBBBBBBBBMBBBS"BBB@BBBBBBBBBBBBBBBBBBBBFBBN
nnBBBBBFBBBBBBCBBBBBBBBBBBBBBJBBJnnBBBBBBBDBBBBBBBBBBBBBBBBBBBBBBJBBZ
.BBBbBBBJBBB
BBBBBBBBBBBBBBBBBJBBJ
.BBBBBBHBBB
BBB@BBBBBBBBBBBBBBJBB
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB$Ze
C3S@J%
B3rCBB($FFJB2]C
bFJBBFBBGFJB3FJB
DFJBOB@BBBFJBOFJBOPFJB
KFJB2@ORBBB
bOBBBR
FJBs]2]C$ZJ){:HFJB3EFJBs_3_jH
h_H]FJB
AFJBZ0BBB
H3\":H_ORBBB
FJBs2]
FJB]3@FJB
OB@BBBFJB
OFJBJFJB
]"zK/{GbXBBB3M"M@"\@FJBs]?
]r]FBB#FJBZ
OWFJBFJBs_%t3OFJB
"O5bBBOXFJBH?
"O5bBBOXFJB_s]%3FJB[FJBFJBsX?bOBDRR[HOAfJB]s%
IFJBrBbBBH
YH^HOBBFsYs^NFJB^
%^b\?YORBBB
OBBBJEfJBFJB3YH
\(FJB(@FJB
HOBBBCFJB
HOIfJBHKFJB2@
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
&BBI&BB
&BB&BB&BB
&BB&BB
&BBA&BB&BB
&BB&BBBBBB\&BBBBBBY&BBBBBB
BBBBBBOBOB.B
BBnBBBBBMBBBBB,BB,BBBBBBLBBBBBBBBLBBnBBB,BFBBBBBBBnBBB
BBBBB/BoBBBBBB,BB.BBBBBBBBBMBBB
BBBBBnBLBLBBoB.BnBBoBBBB
BBBBOBBBBBBBBLBeBBBMBBBBOBOBBB
BBBBBMBBBBB,BBB,BBBA
BBBBBBBBBB
BBHFBB[fBBBBBBBBBB
&BBBFBB@
BBBBBBBBBB&BBKFBBC
BBBBBBBBBBBBBJFBBBBBBBBBBBBBBBBBBBBBB
&BBI&BB
&BB&BB&BB
&BB&BB
&BBA&BB&BB
&BB&BBBBBB\&BBBBBBY&BBBBBB
BBBBBB
BBIBKLL
mLoBBBk
LoBBBKL(
mkBBBk
KnBBabMoH
LHnOBBB*
,KnBBoBb*
BB$",L
b(OM.B(K$
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBbBABBBABBRBBBBBBBBBBBBBbBbBBBDBBRBBBBBBBBBBBBBbBcBBKBBBIJBB
bBBBBBBBBn,,
,.On,o.
,.On,o.
FFFF,.
FFFFFF
FFFFFFFF
l,M.oF
Foj..,,
FFFFFF
mHjHjkIIHjkHjkIIHjkHjkIIHjkHjkIIHjkHjkIIHjB@BBNBBBdDDD
DDDQDDDDd
dddd0dVdddd
$d$$$$/$
$BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
NtQueryInformationProcess
3+t8Ht
@Nu^[]
@f;4Bt33_
^UQSVWE
_^[]UQSVWE
_^[]U Vh
tKSWh"0
_[^]UE
:++;sV$
r_^3[]
WQRP_^]
WM33toS$
;r^_3[]
Oy^[_]
@;r[_^U,SVMWM\h0#0
F<|0x\0xMQ
WSVMEVirtEualAEllocE
URWSVMEEVirtEualFEree
j@E@8h
(MuMEt%X
^(MuURVMy}WVM
VU_^[]U
SVW|PVu
3u9uva39]vKMEPQMS?
;]rE@E;Er]
_^[]U060
WMQUR`
URWWWEP
_^]UVu
PE^]UQVN
P}E^]UE
VWs_^_3^UU
MRQp^]3^]%
GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipBitmapGetPixel
GdiplusShutdown
GdiplusStartup
GdipCloneImage
gdiplus.dll
FreeLibrary
GetCurrentProcess
GetProcAddress
LoadLibraryW
LoadLibraryA
OutputDebugStringW
lstrcatW
CloseHandle
WriteFile
CreateFileW
HeapAlloc
GetProcessHeap
HeapFree
LockResource
SizeofResource
LoadResource
FindResourceA
KERNEL32.dll
wvsprintfW
EndPaint
FillRect
GetClientRect
BeginPaint
DispatchMessageW
GetMessageW
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
DefWindowProcW
InvalidateRect
PostQuitMessage
SendMessageW
USER32.dll
IDATXG
m`s8Ji
5?ZUU?iGUm,ABu(@U
h,QE~+Z4
DXr8OjdrW
N&qAoj
.z=SvIcOou[
Ne=rF=z /!-
gl:m0k1IL3E(
<m"SR6"m%=XF
]=D$O}y &2u}w<|#qw$7
&7"y7]/wVx9
=9(v*(}
xo5&%=
Yj7:H2l>F
u4?,tQaK
mT:"%<
=[HqHp
(38.yT
wJ aGm>rgv4
/Nw2&}
I fWyk
j9=8CY
dV<G!e
|{JioH`)
i`${WY"*
DyBxq W)VBs(
||(6E8.?
v^b5\X_
37LL{z#RtE7KD}yZ2C0"~FwnN+pO
qKpVnQ
)Z*BDf8
.bsusqE$r[b@
]|E9ar
qi5f@N7
a"I"-+
XiGsS&eR
Z SOjFRu
]Ff2m6;&
bx']p*
IENDB`PAD(
\\\\\\mmm\
\\\\\\onmnmmmmm\
\\\\\ooooooonnmmmmmm\
\\\\\\qqqppqoqoooonnmmmmmm\
\\\\\\sqqqqqpqmqopoooooonnmmmmmm\
CCCCCCCCC\\\sssssssqsssqoqqqqoqoqnoonnmmmmmm\
Cssssssssssssssssssqqqssqoqmqooqnooonnmmmmmm\
!"+578Xsssssssssssqqspqqqoqoooooonnmmmmmm\
"#-78Ksssssssssqqssqppqpqpoqn_VF?
Wmmmm\
!++57DsssssssssqsqsqsfZPF>)
Pnmmmm\
!"+578ssssssssdaMH<0
Qmmmmm\
!!++57issssR00))'
1?HTfmmmmm\
!"#-6XssssR0)*'$
'0>FPZdooooommmmmmmm\
!#+-NssssT0>BHMU_iqqpqqpooqnoooZQ_nmmmm\
!!"+AsssssqssqqqqsqpqpmZQFB$
mmmmm\
!"-ssssssssseaRLB4$
mmmmm\
!pssssFE0)'
1mmmmm\
assssF0)*$
))BFQVdnnnmmmmmm\
LssssM0)4?BMLXZhppoqoooqnoonmmmmmm\
AsssqmpqsqqqqqqppqppoqTV??$
_nmmm\
0qssssssssqsqsqpqpppoq
Pnmmm\
pssssdXsqsq>
Lqppppoq
Vnmmm\
(%$mqsss00Tsqs>
dpppqnoUVVooonnmmmm\
%%'_ssssB00oqsL
'mpppqqooooonnnnmmm\
Cs &%%&((QssssE0*>qqM
FqppnohVP??
Hnmmm\
Cs% %%&&((,(FssssE0*)PsL
ZpqpoB
Cs%%&&%,,,..:ssssE0*0'eM
1mmmm\
Cs,,,,,,....1ssssR0)N$4H
4poomVUVoomnmmmmm\
Cs1,1,1111111hsssT00aL''
Vqoqnoooonnmmmmm\
Cs33133133434_qssT0)am0
fooWUF?>
mmmmm\
CsF<:99<94:93VsssT/*RsZ
_mmmm\
FqL<:::::::::HqssZ0.HdqB
Ummmm\
Li_>=========Bsss400'0so$
4qh,.?FmQUVZommommmm\
LXsBBBBBBBBBBBqssaRRPZoqmqqqpqqpoooqnoomnnmmmm\
FqVFFFFFFFFFFmqssssspsqqsqpqpppqpooqnonnnmmmm\
Q`pHFFFFGFGCG_sssssssqsqssqpqppoqoooooonnmnmm\
FqbFHIIIIHIHZqsssssssqsqqspqpqpoqoqnoonnnmmm
TqZLILLLLLLVssssssssqsqsqpqppqooqonnX
LdqVOOMMOMOOqsssssssimhi__Z_MMMMMMMqF
Hiq^QQQQQOQZZZZQQRPQRPPQPQQQQQMQQQsF
FesfTTTTTQVQQTTTTTTTTTTTTTTTTVQTTsH
HXqqcQVVXVXUUUUUUUUUUUUUUUUUVVXUqC
XHcqsnc^ZZZZZZZZZZZZZZZZZZZZZZZqF
THapqsqqqqqqqqqqqqqqqqqqqqqqssF
LLCFFFFFFFFFFFFFFFFFFFFFFFFFF
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADC
n t d l l . d l l
K E R N E L 3 2 . d l l
Z _ c f i n k p
C : \ D O C U M E ~ 1 \ v r a s e l l i \ C O N F I G ~ 1 \ T e m p \ R a r $ E X 0 0 . 4 0 6 \ R e s u m e _ L i n k e d I n . e x e
C : \ 3 B r c q 6 3 9 . e x e
C : \ Z S p 4 f w 6 0 . e x e
C : \ y h a B i 0 3 A . e x e
C : \ U I D l x B d e . e x e
C : \ 3 U I A d m 0 w . e x e
C : \ v Q l B Z R 0 S . e x e
C : \ Z s x 8 n C o _ . e x e
C : \ y U J I 9 e r d . e x e
C : \ v 0 E Y h 5 j n . e x e
C : \ z 6 p N a b C 6 . e x e
C : \ a p J j a 7 4 C . e x e
C : \ N H a g j V s H . e x e
C : \ e p p d d 2 e g . e x e
C : \ i j 0 G e g e 3 . e x e
C : \ J h K A N V Y Q . e x e
C : \ e b V f z m M B . e x e
C : \ D v I u v Y 3 g . e x e
C : \ f n O 7 0 6 K u . e x e
C : \ l T J a C _ W T . e x e
C : \ M o 2 j e I y Z . e x e
C : \ G b N V E H u 1 . e x e
C : \ c y D J K b M _ . e x e
C : \ O T c C w l u g . e x e
C : \ A A N Q w u T _ . e x e
C : \ s 2 7 c q X p Z . e x e
C : \ R k K c O S N w . e x e
C : \ T P N I D Y 6 6 . e x e
C : \ _ 8 2 f a x v n . e x e
C : \ 9 8 0 5 d e 7 1 4 c 8 5 1 3 b a 3 f 8 3 d f 3 5 d e 7 0 0 6 3 6 9 3 7 0 5 6 3 f a 0 f a e f 8 b 8 e c 2 d 8 b f e 7 9 5 b c e f
C : \ v B p x d B x H . e x e
C : \ 6 8 2 6 a 8 1 4 c 4 8 8 c 5 c 7 d d 8 a 1 d c 3 8 f 4 b 6 5 4 5 7 8 0 d 5 0 c 7 0 6 9 f 7 f 1 9 8 a 4 9 9 5 a c b c 5 b e 8 0 5
C : \ s 3 b v U 7 t m . e x e
C : \ 6 a c e a b 7 d 2 a f 3 7 7 e 2 5 7 c 6 4 f b 9 1 2 f 6 4 0 3 2 2 1 f d e 5 7 6 9 0 c f f 9 7 5 3 9 8 2 e a f 7 0 f 8 2 4 f 3 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 9 1 5 b e 2 d 7 a f 8 0 a 4 6 d 9 f 1 2 3 0 5 7 9 b a 1 5 a 7 9 c 2 7 e 4 0 6 8 c 4 d 5 3 9 2 d 7 7 2 1 b 6 d 3 f 3 f 9 1 5 8 d
C : \ 4 4 2 3 f 0 c a a e 1 5 f e c 3 8 2 1 9 e a 1 6 6 8 6 a 4 5 4 5 5 5 9 f 0 3 e 9 a 4 2 e 5 7 7 d a 2 5 b 5 c 0 b 4 a a f b 4 9 4
C : \ f 3 5 f 8 1 2 4 1 3 6 4 a 0 1 b 1 b e 8 8 3 d a c 8 9 4 7 a a c c 7 1 2 f 1 a 4 9 d b 4 c a f 6 a 1 3 5 7 8 a 8 2 9 0 5 6 b 6 d
C : \ f 2 b 2 3 1 5 2 5 3 c 2 c e 5 8 b a 4 e c a 1 1 7 3 3 2 2 8 e 2 e 9 f 3 7 2 9 6 2 a 3 b 6 a 0 d 7 d 7 c 2 c 3 1 d 5 f f 0 f c 5
C : \ q a u x Y d c m . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ b 2 b 9 6 3 5 6 b 4 d 1 7 5 d f 2 d 6 4 2 a 3 0 2 9 c c e b 8 e f 5 d 3 3 c c c 1 a 1 2 8 e 1 a 8 a a f 8 3 7 5 b 7 4 e 5 4 7 c
C : \ 0 c f d 3 b e 2 7 1 6 f 7 9 9 0 6 e 6 f 2 0 3 b 3 a 9 a 7 7 5 2 6 3 f a 4 9 a 8 d e c 1 f d d 4 a 9 d 6 a 3 5 1 b f 2 5 7 0 1 a
C : \ N O k e k 1 k r . e x e
C : \ 3 2 d d 9 e b 4 6 6 9 b d f 4 f 8 4 e 2 1 4 6 8 7 9 9 6 6 e 7 c f 0 f b 7 7 6 1 f f 2 7 9 c c 6 2 e 8 4 c 6 a 3 6 2 c b 8 a d e
C : \ 8 5 l c c k J f . e x e
C : \ 9 4 8 9 f a 7 5 e e 5 2 d b e 0 c a f 7 5 f c 7 2 2 5 1 b 8 e 9 d 3 f 0 0 1 d 7 a 7 b 5 6 3 6 a c e d 5 7 b a 6 d 3 6 b 9 5 8 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 8 2 9 c e 8 9 7 0 1 7 8 a 1 a f 9 1 1 5 6 e 1 8 1 5 4 8 1 5 5 6 c 4 6 d d 3 b b 0 0 e f d 0 c 8 f 5 5 9 1 c 3 d b 9 d 6 3 4 e f
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ c 9 5 b 2 4 0 7 c 7 b 0 e 5 e 2 a 2 8 d e 2 6 5 2 8 e 0 e d 4 5 2 7 2 8 8 8 7 3 7 e e 1 f 6 8 d a 8 5 b e e 0 b 7 e 2 6 4 0 3 7 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ a 3 3 f f 7 8 7 3 0 4 e d f b 2 4 e d b b 2 c a c 7 d 0 9 b 6 b b c d 3 e 0 6 3 1 e f 8 3 a f 0 6 3 2 f d 4 8 3 1 9 b 0 9 9 4 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 3 6 1 8 c 3 f 5 e 4 8 e b 2 8 5 7 9 c a 4 5 0 f 5 0 b 1 8 1 7 7 7 3 d 7 a 8 3 0 4 3 3 6 9 4 0 6 7 4 f f 5 9 d 4 7 4 f 1 7 a c d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 3 4 7 5 8 2 c 9 f c 1 f 9 2 4 3 b e e b 4 9 4 2 6 6 a e a c e d c c 0 4 e f 5 b e 9 6 e 3 e c e 1 7 8 0 4 5 7 6 5 c f d 4 e 2 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 9 8 4 1 8 4 6 1 9 8 5 4 4 c 1 f c 7 f c 6 3 7 f 8 b 4 4 4 7 4 4 a c 9 c a 3 5 a 2 6 2 4 4 2 a a d 5 b f 9 7 2 1 0 4 0 6 6 7 9 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 0 0 9 7 c b a 1 9 9 f 8 0 a e 6 4 e b 4 9 6 4 0 4 f 1 8 5 a 3 4 5 f a c d f d 8 2 f 0 8 2 b 7 7 9 9 0 4 e 6 5 0 d 4 1 1 0 c e 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 7 6 d 9 3 2 2 8 4 9 0 b d f 1 9 2 7 a 4 9 9 2 e e 0 b 0 6 7 4 9 9 6 1 c 8 f 9 7 7 5 6 5 f 6 6 0 a 1 5 f 3 3 7 3 d 8 2 6 0 3 0 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 5 b 3 d 7 2 6 e 2 7 c c 4 a b 3 e c 6 7 f 7 c f c c 3 3 a 0 0 e 9 5 a a 7 a b 5 3 f 1 a b a c 8 8 8 6 6 9 2 3 a 4 6 4 c 5 f a b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 2 9 9 d 3 a c b d d b 8 b d 9 4 6 8 5 0 8 8 3 8 6 4 d 6 e c d c a 4 6 8 5 e a 3 c 0 3 6 d b 6 8 0 d 3 b 7 f e 6 d 3 4 6 3 0 f 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 7 4 8 0 e 3 0 1 9 6 0 4 8 0 0 7 9 0 7 9 8 7 b d a 3 8 0 e e 1 e f 0 2 5 d 4 e f 9 9 f 7 9 5 7 1 9 9 1 c f 3 9 8 5 7 a 4 b e a 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ f d c 2 f d f 9 2 f e 4 8 d e 1 4 7 3 5 e d f 2 1 d d a 5 3 2 5 4 d 5 3 0 b 2 e f a 2 3 b b 7 a 7 7 7 8 d d 1 e 0 4 0 5 f b e 1
C : \ b 9 e 4 3 1 1 1 9 8 6 4 6 3 3 c d 8 5 1 f 5 5 3 4 6 4 6 b 9 9 8 4 8 4 0 4 7 2 c 0 5 6 9 d b 3 a 1 c e f 4 1 0 1 4 9 c 1 9 4 1 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ c 9 e 4 b 6 4 f 3 3 8 e 3 1 c f 7 c c 5 3 3 d 2 c a f 2 2 2 9 a b f 7 6 b d f 6 1 a 8 b 9 7 7 a d 2 c d 2 9 1 a b c 8 5 c 9 1 2
C : \ a 1 5 8 7 4 b 9 1 c 4 8 0 5 f 7 1 2 7 0 9 9 e 1 f a 5 d e 1 4 6 f 4 4 3 6 7 c 9 3 a 0 8 a d 3 a f 5 4 3 c 8 d 2 f c 3 3 c 8 6 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ a a 7 1 e b 2 f e e 3 6 1 d a 5 0 a 5 8 6 c 1 d d 5 5 8 b 7 1 a 9 f c 6 b 5 a 6 5 0 4 6 e 5 a 6 2 f f 0 4 8 b f d 0 2 b 1 5 1 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 4 6 0 1 c f 4 4 3 c e c 1 6 b d 4 3 2 1 0 8 f e 2 f 7 3 5 c f 7 d 2 8 a 7 a a c 2 e a 1 b 7 7 a 0 8 5 b c 2 a d 4 6 c 5 6 2 5 b
C : \ 0 9 0 6 e d d 3 e 9 d f 1 2 2 8 0 9 6 f c 8 0 9 3 9 1 1 1 9 3 b d 0 f 8 0 d 3 d 5 a a 7 4 b 3 8 b 9 b d 9 2 4 e 7 5 3 f 7 9 5 5
C : \ 0 1 c e 5 4 2 c d 7 6 2 2 a 7 5 1 0 4 c 4 4 c 4 3 1 6 a 4 5 9 9 a 2 6 3 c b 7 3 e 9 f 2 a f 3 0 3 5 5 5 9 3 9 9 0 a c 6 9 9 e c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ a c 2 2 5 3 1 0 d 4 5 6 6 1 d 0 7 2 3 1 d 7 b 7 b 6 c 6 6 5 8 8 e 6 4 b 7 4 6 c 6 9 2 5 5 b 2 5 f c d a 6 3 a b 8 8 0 b 2 7 1 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 3 a c 5 5 b f 1 c d 7 f d 6 9 9 f 6 e 3 2 b b c c 4 d c b 3 d 4 b c 5 f 0 2 8 f d 8 e b a c d 0 5 f 8 b 5 0 2 e 4 5 b 2 c 0 2 5
C : \ 1 d f 6 e c 0 1 2 f 9 b 9 0 4 1 5 6 3 d 4 e 8 f 7 9 3 b 7 2 a a 8 8 e b 3 8 3 1 d 9 d a 2 1 8 f 8 f 1 f 5 1 a 4 3 9 a c 8 5 f d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 6 9 9 9 c 1 c b 3 6 d 3 d 1 7 4 d 4 5 0 5 d 8 0 4 8 8 0 3 9 9 2 3 5 f f 8 4 b 7 2 b d d 8 5 2 b 6 7 5 2 f 0 f 8 c 1 0 3 b c 4 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 7 6 5 3 7 3 6 0 1 0 2 6 c f 5 b 8 7 f 8 4 8 0 f 8 9 0 6 c f 5 5 9 b e 5 1 8 c 4 d 2 a 8 a 1 5 a b f 4 8 e b 0 7 0 3 e 5 d c f 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 9 5 c f 3 3 9 4 c f 9 1 6 5 a 0 2 5 c 1 b f f e 0 a 7 7 c d 7 6 9 e 4 7 0 4 d d 2 0 7 c 1 2 8 3 5 2 6 a 8 6 1 a 4 3 1 6 4 a 3 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h h c b r n a f f . e x e
C : \ 6 b 4 d 2 3 7 a f c d e b c e 2 0 c a 1 2 7 5 0 6 5 1 2 2 a 0 6 b 9 c 4 6 7 1 0 f b b f 9 3 1 d c 1 0 1 7 c 5 7 9 7 f 1 c 1 2 0
Process Tree
-
050c545c461e57a74b72daa7b7cb6ddd5131f5f7d965fb63c2237a7ebc21c6ed.exe (1848)
"C:\Users\Administrator\AppData\Local\Temp\050c545c461e57a74b72daa7b7cb6ddd5131f5f7d965fb63c2237a7ebc21c6ed.exe"
- hhcbrnaff.exe (2064) "C:\Users\ADMINI~1\AppData\Local\Temp\hhcbrnaff.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 212.32.237.91 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | ||
| homevisitor.co.uk | A 212.32.237.91 | 212.32.237.91 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 212.32.237.91 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49165 | 212.32.237.91 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49166 | 212.32.237.91 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49168 | 212.32.237.91 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49169 | 212.32.237.91 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49170 | 212.32.237.91 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49173 | 212.32.237.91 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49174 | 212.32.237.91 homevisitor.co.uk | 443 |
| 192.168.56.101 | 49175 | 212.32.237.91 homevisitor.co.uk | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 756da58049edd9d6_hhcbrnaff.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\hhcbrnaff.exe |
| Size | 27.2KB |
| Processes | 1848 (050c545c461e57a74b72daa7b7cb6ddd5131f5f7d965fb63c2237a7ebc21c6ed.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 03459bb34ccce589bda9dacaa2e39cab |
| SHA1 | aae4970008da55ce66469adff4870d0c6f2893e4 |
| SHA256 | 756da58049edd9d65c61799154547bf3058d6c84175a2a7af3066431a56d8bef |
| CRC32 | FB59642A |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.