SmartHawk

2.3

中危

该样本未表现出任何异常！

重新分析

下载样本

0df6d010499c4337892cae71bedfc617a4c9a4549c781e9440352da6bf387fe8

0df6d010499c4337892cae71bedfc617a4c9a4549c781e9440352da6bf387fe8.exe

分析耗时

134s

最近分析

380天前

文件大小

73.5KB

静态报毒动态报毒 UNKNOWN

DACN 0.14

FACILE 1.00

IMCLNet 0.66

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.05s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.66	Unknown	0.29s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

未检测暂无反病毒引擎检测结果

查询计算机名称 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727545345.483875 GetComputerNameW	computer_name: TU-PC	success	1	0

使用Windows API生成加密密钥 (3 个事件)

Time & API	Arguments	Status	Return
1727545345.483875 CryptGenKey	provider_handle: 0x00626350 algorithm_identifier: 0x0000a400 (CALG_RSA_KEYX) flags: 134217729 crypto_handle: 0x00629cc0	success	1
1727545345.483875 CryptExportKey	crypto_handle: 0x00629cc0 crypto_export_handle: 0x00000000 blob_type: 6 flags: 0 buffer: ¤RSA1 6Â>¦Ø/wÂf!«ÜLº±s<ºÃ\h)RßúÔà «qéëâµµZ¥ÁÓTæRU(3üm éÆÈg·änäî Å a3ÉèØª6»\|¦:÷Ý!ÉD 5,T(p@G¨ä"ëÀYUg¢]÷â+¾m¶ïÀ>f;Ü¹òW½gLóó@¾"~~ø_Q5&vÍ>}ø·iØ£éÔmêKÅV? )¤¹ÍRÖyÄïÖ{;qÜ+Ç=üW~ýôd¤°¨ª4»@¸WÒ!«TA´#q£zÄ¼]z7fW¼~(;Éíêz(¹	success	1
1727545345.483875 CryptExportKey	crypto_handle: 0x00629cc0 crypto_export_handle: 0x00000000 blob_type: 7 flags: 0 buffer: ¤RSA2 6Â>¦Ø/wÂf!«ÜLº±s<ºÃ\h)RßúÔà «qéëâµµZ¥ÁÓTæRU(3üm éÆÈg·änäî Å a3ÉèØª6»\|¦:÷Ý!ÉD 5,T(p@G¨ä"ëÀYUg¢]÷â+¾m¶ïÀ>f;Ü¹òW½gLóó@¾"~~ø_Q5&vÍ>}ø·iØ£éÔmêKÅV? )¤¹ÍRÖyÄïÖ{;qÜ+Ç=üW~ýôd¤°¨ª4»@¸WÒ!«TA´#q£zÄ¼]z7fW¼~(;Éíêz(¹ó9ß"UrÈ¼zIöñ:àoð.¬ A®~XáÃ¹l>0ÍÅ£5ý¼æ´oU!ßhV$¿Ñ; «¶üjúeBt×ÔÆ©æE¬)³Ý6I`¢×1¹ýïï®)ûHÇmùÎ¼O²×ãÿÏ\|7ü§±¶<`æ?Dèi:K âY°ÒMm?KUÏ.ñ¿ÛSü%j>+ígpÄ¤1ãÎ8{Áæ¦\u Å£I5[ ¤k$8ßåEäcâ<`â5cËWªq±ÜllÊuV0¿Hæ¨tÓj\Úíx Ð!Ø&à3Íþ·fB&µá:ÍÝKÆ¥æ7#ÅÉKìÔ;æ&^ÏÈÂ¸üÎ÷Àð6õ¨0'zq^ôæªTï±«oÿ5¯ÄrïZl=°þÕ8Z^tô§9~õüydÂà'Mºm¿°]_¹úhæ?ÌBÝ_æ£ìÉ^Ù^ ë¥£à¤ò6iÝ4³õeg´C»º( ÷UU>^ âØ$äÇ@·íµ*<¿[Ùl±Ä4ðOT=ð¦£¿éÑ×!ÏÒíht¾üÈ[(\1²#[Màg§fQm¶i+~mqW´;ijÏª®Öº+ãà¹627ï·ø}v³AªýÕ9ùyuë\|Í´ÀqÈÎç,=ÁMì_Z×e!fÚþE`Á%ñà+Ó/«añ1«/ñ¦ñ~\|\|:u:âëàçp(nS9àNÆÆä"Oþð\|)YF ßó!ú°§K"ö"OYöOA¢EV®xü²Ã¶<ÐëCÍ$óë¸W©Û·7¨vÜÅ=èÁ#`8¶Ñ½ÆÃ1T\|òÁÕ$®drÕlWNÆß3Öº<,¸R6;ZXàpÀ3Û¿ëW^âìÃ¦ë_ðú="Ñz Â¸íäÖ°ûrô¯ÆXÕö³^Tt 3¿=e®ÎÉ]ÆWY6ó´à)}ôÆäÖyFT{_:x?©ñ rì¸jZå dÅ~êLµ¨±$L8ú+,£¼Yêm>> ³+ÒàäÌ[ßô«$»CÑu	success	1

检查系统中的内存量，这可以用于检测可用内存较少的虚拟机 (12 个事件)

Time & API	Status	Return
1727545347.07775 GlobalMemoryStatusEx	success	1
1727545358.749625 GlobalMemoryStatusEx	success	1
1727545369.0305 GlobalMemoryStatusEx	success	1
1727545379.328375 GlobalMemoryStatusEx	success	1
1727545389.608625 GlobalMemoryStatusEx	success	1
1727545399.9055 GlobalMemoryStatusEx	success	1
1727545410.219 GlobalMemoryStatusEx	success	1
1727545420.515875 GlobalMemoryStatusEx	success	1
1727545430.81275 GlobalMemoryStatusEx	success	1
1727545441.108625 GlobalMemoryStatusEx	success	1
1727545451.4055 GlobalMemoryStatusEx	success	1
1727545461.703375 GlobalMemoryStatusEx	success	1

解析可疑的顶级域名（TLD） (1 个事件)

domain

dns1.soprodns.ru

description

俄罗斯联邦域名 TLD

分配可读-可写-可执行内存（通常用于自解压） (15 个事件)

Time & API	Arguments	Status
1727545344.421875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00360000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545344.421875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x005c0000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545344.624875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00340000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545344.624875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00900000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545344.733875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00920000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545344.749875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00900000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545344.749875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x008e0000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545344.749875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x008f0000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545345.546875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00f60000 region_size: 12288 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545345.546875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00f70000 region_size: 12288 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545346.702875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00f60000 region_size: 98304 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545346.702875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00db0000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545346.702875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x02a20000 region_size: 4096 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545346.702875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x02a20000 region_size: 36864 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success
1727545346.702875 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x02a30000 region_size: 8192 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1848	success

查询磁盘大小，可用于检测具有小固定大小或动态分配的虚拟机 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727545345.483875 GetDiskFreeSpaceW	root_path: C:\ sectors_per_cluster: 8 bytes_per_sector: 512 number_of_free_clusters: 1782372 total_number_of_clusters: 8362495	success	1	0

在文件系统上创建可执行文件 (1 个事件)

file	C:\Users\Administrator\AppData\Roaming\Microsoft\zzzqcc.exe

将可执行文件投放到用户的 AppData 文件夹 (1 个事件)

file	C:\Users\Administrator\AppData\Roaming\Microsoft\zzzqcc.exe

检查适配器地址以检测虚拟网络接口 (12 个事件)

Time & API	Arguments	Status
1727545348.49975 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545358.812625 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545369.0935 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545379.391375 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545389.671625 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545399.9685 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545410.281 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545420.577875 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545430.87475 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545441.171625 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545451.4685 GetAdaptersAddresses	family: 0 flags: 1158	success
1727545461.766375 GetAdaptersAddresses	family: 0 flags: 1158	success

使用 Windows 工具进行基本 Windows 功能 (3 个事件)

cmdline	nslookup gandcrab.bit dns1.soprodns.ru
cmdline	nslookup emsisoft.bit dns1.soprodns.ru
cmdline	nslookup nomoreransom.bit dns1.soprodns.ru

与未执行 DNS 查询的主机进行通信 (2 个事件)

host	114.114.114.114
host	8.8.8.8

在 Windows 启动时自我安装以实现自动运行 (1 个事件)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\rcdlairqkpv

reg_value

"C:\Users\Administrator\AppData\Roaming\Microsoft\zzzqcc.exe"

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2018-02-04 02:58:37

PE Imphash

40306b615af659fc1f93cfb121cc38d9

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00008000	0x00008000	6.296861858288883
.rdata	0x00009000	0x00009000	0x00008600	6.1322099086141595
.data	0x00012000	0x00001000	0x00000c00	3.450195070880191
.CRT	0x00013000	0x00001000	0x00000200	0.06116285224115448
.rsrc	0x00014000	0x00001000	0x00000200	4.710061382693063
.reloc	0x00015000	0x00001000	0x00000c00	6.434410350416442

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_MANIFEST	0x00014060	0x0000017d	LANG_ENGLISH	SUBLANG_ENGLISH_US	None

Imports

Library KERNEL32.dll:

• 0x409058 SetFilePointer

• 0x40905c GetFileAttributesW

• 0x409060 ReadFile

• 0x409064 GetLastError

• 0x409068 MoveFileW

• 0x40906c lstrcpyW

• 0x409070 SetFileAttributesW

• 0x409074 CreateMutexW

• 0x409078 GetDriveTypeW

• 0x40907c VerSetConditionMask

• 0x409080 WaitForSingleObject

• 0x409084 GetTickCount

• 0x409088 InitializeCriticalSection

• 0x40908c OpenProcess

• 0x409090 GetSystemDirectoryW

• 0x409094 TerminateThread

• 0x409098 Sleep

• 0x40909c TerminateProcess

• 0x4090a0 VerifyVersionInfoW

• 0x4090a4 WaitForMultipleObjects

• 0x4090a8 DeleteCriticalSection

• 0x4090ac ExpandEnvironmentStringsW

• 0x4090b0 lstrlenW

• 0x4090b4 SetHandleInformation

• 0x4090b8 lstrcatA

• 0x4090bc MultiByteToWideChar

• 0x4090c0 CreatePipe

• 0x4090c4 lstrcmpiA

• 0x4090c8 Process32NextW

• 0x4090cc CreateToolhelp32Snapshot

• 0x4090d0 LeaveCriticalSection

• 0x4090d4 EnterCriticalSection

• 0x4090d8 FindFirstFileW

• 0x4090dc lstrcmpW

• 0x4090e0 FindClose

• 0x4090e4 FindNextFileW

• 0x4090e8 GetNativeSystemInfo

• 0x4090ec GetComputerNameW

• 0x4090f0 GetDiskFreeSpaceW

• 0x4090f4 GetWindowsDirectoryW

• 0x4090f8 GetVolumeInformationW

• 0x4090fc LoadLibraryA

• 0x409100 lstrcmpiW

• 0x409104 VirtualFree

• 0x409108 CreateThread

• 0x40910c CloseHandle

• 0x409110 lstrcatW

• 0x409114 CreateFileMappingW

• 0x409118 ExitThread

• 0x40911c CreateFileW

• 0x409120 GetModuleFileNameW

• 0x409124 WriteFile

• 0x409128 GetModuleHandleW

• 0x40912c UnmapViewOfFile

• 0x409130 MapViewOfFile

• 0x409134 GetFileSize

• 0x409138 GetEnvironmentVariableW

• 0x40913c lstrcpyA

• 0x409140 GetModuleHandleA

• 0x409144 VirtualAlloc

• 0x409148 Process32FirstW

• 0x40914c GetTempPathW

• 0x409150 GetProcAddress

• 0x409154 GetProcessHeap

• 0x409158 HeapFree

• 0x40915c HeapAlloc

• 0x409160 lstrlenA

• 0x409164 CreateProcessW

• 0x409168 ExitProcess

• 0x40916c IsProcessorFeaturePresent

Library USER32.dll:

• 0x409190 wsprintfW

• 0x409194 TranslateMessage

• 0x409198 RegisterClassExW

• 0x40919c LoadIconW

• 0x4091a0 SetWindowLongW

• 0x4091a4 EndPaint

• 0x4091a8 BeginPaint

• 0x4091ac LoadCursorW

• 0x4091b0 GetMessageW

• 0x4091b4 ShowWindow

• 0x4091b8 CreateWindowExW

• 0x4091bc SendMessageW

• 0x4091c0 DispatchMessageW

• 0x4091c4 DefWindowProcW

• 0x4091c8 UpdateWindow

• 0x4091cc GetForegroundWindow

• 0x4091d0 DestroyWindow

Library GDI32.dll:

• 0x409050 TextOutW

Library ADVAPI32.dll:

• 0x409000 CryptExportKey

• 0x409004 AllocateAndInitializeSid

• 0x409008 RegSetValueExW

• 0x40900c RegCreateKeyExW

• 0x409010 RegCloseKey

• 0x409014 CryptAcquireContextW

• 0x409018 CryptGetKeyParam

• 0x40901c CryptReleaseContext

• 0x409020 CryptImportKey

• 0x409024 CryptEncrypt

• 0x409028 CryptGenKey

• 0x40902c CryptDestroyKey

• 0x409030 GetUserNameW

• 0x409034 RegQueryValueExW

• 0x409038 RegOpenKeyExW

• 0x40903c FreeSid

Library SHELL32.dll:

• 0x409180 SHGetSpecialFolderPathW

• 0x409184 ShellExecuteExW

• 0x409188 ShellExecuteW

Library CRYPT32.dll:

• 0x409044 CryptStringToBinaryA

• 0x409048 CryptBinaryToStringA

Library WININET.dll:

• 0x4091d8 InternetCloseHandle

• 0x4091dc HttpAddRequestHeadersW

• 0x4091e0 HttpSendRequestW

• 0x4091e4 InternetConnectW

• 0x4091e8 HttpOpenRequestW

• 0x4091ec InternetOpenW

• 0x4091f0 InternetReadFile

Library PSAPI.DLL:

• 0x409174 EnumDeviceDrivers

• 0x409178 GetDeviceDriverBaseNameW

L!This hn 
m cannot be run in DOS mode.
4.Rich
`.rdata
@.rsrc
@.reloc
UQSVWj
3_^[]j
W_^[]U
^[]^3[]U
SVWj@h
fD$$QD$
U\SV3D$
fD$,D$
D$DP,@
D$TD$X
t$PD$\D$`
D$dD$8P
_^]SEPuW
[_3^]h
^]U$SV3Ek
]U\SV3Es
fE_^[u(Mu
<}tK<=tBF>
<}t)F<=t
UQSV3WE33p
[]_^[]VWy
GFu33;_
GFu33;_
HthHuo
<}tcG<=t
EPWuu(
MPEPPEP]
U_^[]UE
E F$E(F0E0F<E8FHE@FTEPFtEXF
PPRPRPRPj#
PD$ D$$i
VD$TD$Tp
_^[]jw8
D$8f|$8P
FFPh@h@
GfZvjj
D$P\$$
W|$,t$ D$03D$
r]K\$(
T$4T$$L$
L$(T$$;s
D$D\$@
s(SV`@
BNu^[=
3VL$dl(
\$$D$,m
D$DD$0w
fL$@D$Ds
f|$ D$h/
L$h)L$
FK$'rt$
V_^[]3<
EPMQUREPMN
u4MQUREPU
]U\VjDE
FGuh8@
SVUMWj
GFu_^[t
]ULSVW3En
t6SEPV
3_^[]h8@
_^3[]UDf
ESVW=D@
EemsiEsoftE.bitE
EgandEcrabE.bitE
33DFE3
_^[]V5D@
t'Whp@
SVUWPE
33EVVPWj
t(MAQSjVj
SVWj@h
EtPpNWu
UWM]d$
uP|PhP
|PSM<%
SVWj@h
u_^[]U
L$(|$,
D$$D$$PQh
6D$$D$$PWh
Wt$(j@Bh
t$(D$$D$
L$@<GW
PVjt$ j
D$<L$J
PPT$4$
D$$D$$PWh
t$(3HL$
SVW3Uh
u_^[]U
U3M39]
r_^[]U
E]UQMEM
E]SVWj@h
_^[SV5@
ft?+ft
fu[_3^
SVWj@h
_^[]UQSVWj@h
_^[]Uh
_^3[]U0SWj@h
D$@D$D
3_fLF^[]
SVW39t
^[_^[UQVEPh
SVW=D@
F t=Qh
EF8EPh
EFPEPh
umMEPQj
3fEEPv|t\
EPEPEPEPEP
v|uN|uh
N|3fTA
ULSV5D@
33WPMM
3PPPPfE$
_^[]U<SVWF
PfEEjPWEs
KPSVWE
E_^[],
Vft;+ft
fu^_3[^_[SVW
GFu_^3[
_^[UdSVWh
AafDMA
EECrypPEtGenERandfEomE
EAdvaEpi32E.dllE
_^3[]U8SVWh
3MWWEP]
EECrypPEtGenERandfEomE
EAdvaEpi32E.dllE
_^3[]U
MH$E3M
P0p4x8X<
MHDE3M
pTxXX\
MHdE3M
ptxxX|
on0v00f
on0v00f
on0v00f
DDDDDDDDDDDDDD
EMEineIE5ntel5*A
E5Genu
MMtCE%?
KuZ^%l@
vwv$v2
vFvFv.Av
xv}vBv2vA
v)vyv{xv%
wY5v #vUv
u,IuBJuu
cc||ww{{
kkooT`00P
ggV++}
bMvvE@}}
Ag_E#Srr[u
=L&&jl66Z~??A
Oh44\Q4
qqsb11S*
RF##e^0
=&N''i
-nnZZ[RRv;;Ma}R)){>^//q
,@  `y
[[jjFgr99KJJ
XXJk*O
MMf33U
PPx<<D%KQQ]@@
?!p88H
cwuB!!c 
5/__5DD.
9WU~~z==Gdd]]2
D""fT**~;
v;d22Vt::N
H$$l\\]nCbb917yy2Cn77Ymm
dNNIllVV
%eezzG
oxxJ%%o\..r8
Q#|tt>!KKa
pp|>>BqffHH
aaj55_WWi
 IUUP((xz
e1BBhhAA)Z--w
:cc||ww{{
kkooTP`00
gg}V++
Ag_E#Srr[u
=jL&&Zl66A~??
O\h44Q4
qqsSb11?*
ReF##^(0
=&iN''
tX,,.4
nnZZ[RRMv;;a}{R))>q^//
,`@  y[[jjFgKr99
LLXXJk*O
MMUf33
PPDx<<%KQQ]@@
?!Hp88
cwucB!!0 
WU~~Gz==dd]]+2
fD""~T**;
FF)k<(
v;Vd22Nt::
lH$$\\]nCbb917yy2CYn77mm
NNIllVV
%eezzG
oxxoJ%%r\..$8
tt!>
ppB|>>qff
aa_j55WWi
 IUUxP((z
AA)wZ--
{TTm:,
cc||ww{{
kkooT0P`0
gg+}V+
_E#Srr[u
=&jL&6Zl6?A~?
O4\h4Q4
qqs1Sb1
R#eF#^
=&'iN'
nnZZ[RR;Mv;a
}){R)>/q^/
, `@ y[[jjF
g9Kr9J
LXXJk*O
PP<Dx<%KQQ]@@
?!8Hp8
cwu!cB!
U~~=Gz=dd]]
"fD"*~T*;
v;2Vd2:Nt:
$lH$\\]n
Cbb917yy2C7Yn7mm
NIllVV
%eezzG
oxx%oJ%.r\.
WsQ#|tt!>K
pp>B|>qffH
aa5_j5WWi
 IUU(xP(z
A)-wZ-
cc||ww{{
kkooT00P`
gg++}V
bMvvE@}}
Ag_E#Srr[u
=&&jL66Zl??A~
O44\hQ4
qqs11Sb
R##eF^
=&''iN
-6nnZZ
[RR;;Mva})){R>//q^
,  `@
y[[jjFg99KrJJ
PP<<Dx%KQQ
?!88Hp
cwu!!cB
9.WU~~==Gzdd]]
+2ss``
""fD**~T;
v;22Vd::Nt
$$lH\\]nCbb
917yy2C77Ynmm
%eezzG
oxx%%oJ..r\
$8WsQ#|tt!>KK
pp>>B|qffHH
aa55_jWWi
 IUU((xPz
QP~AeS
:'^;kEXK
 0Uvmv
L%O*&5Db
-Xt!Ii)Du
jyxX>k'q
 f}:cJ
1Q3`bS
+pHhXE
lR{s#rK
WfU*(
dh\![T$6.:
Oa ZwKi
&\rDf;[~4C)v#
V},"3IN8
&?,:Px
}cn;{&x
)|1*?#1
05ftN7
zG<YUs?
ys7S_[=o
h>8$4,
a2pHl\t
WBPQS~Ae
:'^;kEXK
U 0vmv%
Xt!)IiDju
xykX>'qO
1`Q3EbS
ElR{#srK
='6-9d
[T:$6.
a iZwK
&\rDf;4[~vC)#hc1
?V},"3
Pxj_bT~F
)|11*?#0
<zGY?Usy
>h,8$4_
p2tHl\B
WPQeS~A
^:'k;EX
KU 0mvvL%
O*D&5bZI
!Xti)ID
juyx>kXq'O
EbSwdk
ElR{#s
rKW*fU(
=9'6-d
[.:$6g
O aKiZw
\r;Df~4[)vC#hc1
,V}"3N
j_FbT~
|)1#1*?0
vMMCMT
<zGYs?Uy
7sS[_o
>h4,8$@_
p2\tHlWB
PQAeS~
'^:k;EX
K0U vmv
L%O*5D&bZI
-t!Xi)ID
juyxX>kq'O
+HhXpE
l{Rs#K
rWU*f(
O awKiZ
&r\f;D~4[C)v#hc1c
 J$}=2
},V3"IN
cn;{&x
|)1?#1*0
G<zYs?U
7sS[_=o
xh>$4,8@_
a{2pl\tHWBR
8$4,6-9'$6.:*?#1pHhX~AeSlZrNbS
EHl\tFeQ
T~FbZwKi
;{2p)m fW
Js#z(a5h>W
;k5f'q)|
s7}:o-a vm
`dwmzRY
&MFCMQP_[u
dVNi@`R{\r
>!0("3,:
necntsyx
MTAO]Sywek1?-#
ZX>kQ3`J$}C)v4b=o
A.al{vUXOB
'*zG<tN7fU*h\!Bc
y2+H<"C.9^ 0U
0YRODu~ch
p4.S:'^(<I&5D|B
Df;Jo6Xt!V},7
/KGd"Ii)[~4Us?
ypkb]TOF
,8$4'6-9:$6.1*?#XpHhS~AeNlZrEbS
FeQbT~FiZwK
{;p2m)f W\
#s(z5a>h
L;k5f'q)|
s7}:o-a vm
&FMMCPQ[_ju
dVNi@`R{\r
>!0("3,:=
%enncstxyI
MAO]Sywek1?-#
kX>`Q3}J$vC)4b
Aal{vUXOB
'*<zG7tN*fU!h\
H2+C<"^.9U 0
YRODu~ch
p4.S:'^(<I&5D|B
Df;Jo6Xt!V},z7
/"Gd)Ii4[~?Us
mG18#*
ypkb]TOF
4,8$9'6-.:$6#1*?hXpHeS~ArNlZ
EbS\tHlQ
FeFbT~KiZw
{;p2m)f W\
#s(z5a>h
Lk;f5q'|)_
Y7s:}-o amv`
FMMCPQ[_ju
j_dVNi@`R{\r
>!0("3,:
necntsyxZI
AO]Sywek
Zg>kX3`Q$}J)vCb4o
al{vUXOB
*<zG7tN*fU!h\
H2+C<"^.9U 0
YRODu~chg
S4.^:'I(<D&5
nY;Df6Jo!Xt,V}
d"Gi)I~4[s?UP
ypkb]TOF
$4,8-9'66.:$?#1*HhXpAeS~ZrNlS
Ebl\tHeQ
F~FbTwKiZ
;{2p)m fW
Js#z(a5h>W
k;f5q'|)_
Y7s:}-o avm
`dwmzRY
&FMMCPQ[_
jVdiN`@{Rr\
!>(03":,
necntsyxZI
MTAO]Sywek1?-#
ZX>kQ3`J$}C)v4b=o
A.al{vUXOB
*G<zN7tU*f\!hc
+H2"C<9^.0U 
0YRODu~ch
.S4'^:<I(5D&B
nf;Do6Jt!X},V
d"Gi)I~4[s?UP
ypkb]TOFA
pub_key
DELETE}
{DELETE}
advapi32.dll
CheckTokenMembership
Address:
fabian wosar <3
Can't find server
aeriedjD#shasj
*******************
RtlComputeCrc32
GandCrabGandCrabnomoreransom.bit|
ExitProcess
lstrlenA
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
VirtualAlloc
GetModuleHandleA
lstrcpyA
GetEnvironmentVariableW
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
WriteFile
GetModuleFileNameW
CreateFileW
ExitThread
lstrlenW
GetTempPathW
CreateFileMappingW
lstrcatW
CloseHandle
CreateThread
VirtualFree
lstrcmpiW
lstrcmpiA
SetFilePointer
GetFileAttributesW
ReadFile
GetLastError
MoveFileW
lstrcpyW
SetFileAttributesW
CreateMutexW
GetDriveTypeW
VerSetConditionMask
WaitForSingleObject
GetTickCount
InitializeCriticalSection
OpenProcess
GetSystemDirectoryW
TerminateThread
TerminateProcess
VerifyVersionInfoW
WaitForMultipleObjects
DeleteCriticalSection
ExpandEnvironmentStringsW
CreateProcessW
SetHandleInformation
lstrcatA
MultiByteToWideChar
CreatePipe
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
lstrcmpW
FindClose
FindNextFileW
GetNativeSystemInfo
GetComputerNameW
GetDiskFreeSpaceW
GetWindowsDirectoryW
GetVolumeInformationW
LoadLibraryA
KERNEL32.dll
DispatchMessageW
DefWindowProcW
UpdateWindow
SendMessageW
CreateWindowExW
ShowWindow
SetWindowLongW
LoadIconW
RegisterClassExW
TranslateMessage
wsprintfW
BeginPaint
LoadCursorW
GetMessageW
DestroyWindow
EndPaint
GetForegroundWindow
USER32.dll
TextOutW
GDI32.dll
RegCloseKey
RegCreateKeyExW
RegSetValueExW
AllocateAndInitializeSid
FreeSid
CryptExportKey
CryptAcquireContextW
CryptGetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptGenKey
CryptDestroyKey
GetUserNameW
RegQueryValueExW
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHELL32.dll
CryptStringToBinaryA
CryptBinaryToStringA
CRYPT32.dll
InternetOpenW
InternetReadFile
InternetConnectW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetCloseHandle
WININET.dll
GetDeviceDriverBaseNameW
EnumDeviceDrivers
PSAPI.DLL
IsProcessorFeaturePresent
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>
0000000000
1#1-171A1i1s1}111111111111
2:2D2N2X2b2l2v2222222222
33)333=3G3^3h3r3|3333333333
4/494C4M4W4g4q4{444444444
5(585B5L5V5~555555555555
6'6O6Y6c6m6w666666666666 7*747>7H7R7\7s7}7777777777
8#8-8D8N8X8b8l8|88888888888
99)939=9M9W9a9k99999999999
:(:2:<:d:n:x::::::::::::
;5;?;I;S;];g;q;;;;;;;;;;<<<<<<<<<
='=1=;=E=m=w============
>?>I>S>]>g>q>{>>>>>>>>>>
?%?/?9?C?M?e?o?y??????????
0070A0K0U0_0o0y0000000000
1'111A1K1U1_111111111111
2'212Y2c2m2w222222222222
3+353?3I3S3]3g3
3333333333
4%4/494Q4[4e4o4y4444444444
5#5-575A5K5[5e5o5y5555555555
6-676A6K6s6}666666666666
7E7O7Y7c7m7w77777777777N8k8{88888
9D9M99:::::.;:;
;;;;;;;
<0<7<I<Z<b<<<<<<<<<
>0>U>[>j>w>>>>>>>>>>>>
?A?\?????
01111S2]2d2u2
22222:3A333444445
6(6Z6e6m666&7S77748\8888888-989p9x999
:#:1:8:H:N:::::::9;;O<
=-=B=H=====
>'>L>j>>>>?
0"0)030:0D0Q0k000
151A1I1Q1V11111111111122222
5%595555555
6W6_6g6o6w6
66666666666666666
77*757@7K7V7a7l7w7777777777
8&8-878L8e8888888
9p9999
:.:4:T:Z:|::::::::/;=;q;{;;;;
<i<<<<<
>&>+>1>;>U>g>>>>>>N?\?y????????
0(0-050=0g0m000000
1T11111111
2!222Q2`222222
3+3=3L3S3a333333
44,494D4l4s44444*5a555555
6?666666
77P888w9|9999999999
::R:\:n:~:::
<======
>%>/>;>D>P>
0$000:0J0V0000000
1%1*1@1T1h1|111
232D2p2x222222222
3A33334F4444444
5&5-5U5s5~55555555
6/6W6^6e666666666%7+707G7q7~7777
8808[8i8p8~8888
9%989=9M9\9e9{9999999
:,:::N:\:p:~::::::::
;";);7;E;X;i;w;;;;;;;;
< <6<A<W<b<x<<<<<<<<(=I=Y=h=q=====!>&>B>J>>>>>>>>B?b?m???????
0 0P0b0}00000000
1#1*11111
20292H2Z2_2s2~22222222
33&3-343S3[3
333 4*434<4R4^4f4r4}4444
5*5R5Y5`5g5n5u5|5555555555
6'6L6Q6Y6a6h6v666666&77
:4:a:k:u::::
;4;b;n;t;;
=g=u=====O>]>l>>>>>6?C?R?\?b??????
00g0n0~0000000$1+1;1H1s1z111111
2H2O2^2h2n22222
3$333=3C3333333
5+5956
7#7+7074787a77777777777
8 8$888888888
9A9H9L9P9T9X9\9`9d999999D;g;;;;;$<<<<<<<<
jjjjjj
@@@@@@
AppData
\Microsoft\
GandCrab!
win32app
firefox
ransom_id
os_bit
os_major
pc_keyb
pc_lang
pc_group
pc_name
pc_user
ransom_id=
{USERID}
Global\
msftesql.exe
sqlagent.exe
sqlbrowser.exe
sqlservr.exe
sqlwriter.exe
oracle.exe
ocssd.exe
dbsnmp.exe
synctime.exe
mydesktopqos.exe
agntsvc.exeisqlplussvc.exe
xfssvccon.exe
mydesktopservice.exe
ocautoupds.exe
agntsvc.exeagntsvc.exe
agntsvc.exeencsvc.exe
firefoxconfig.exe
tbirdconfig.exe
ocomm.exe
mysqld.exe
mysqld-nt.exe
mysqld-opt.exe
dbeng50.exe
sqbcoreservice.exe
excel.exe
infopath.exe
msaccess.exe
mspub.exe
onenote.exe
outlook.exe
powerpnt.exe
steam.exe
thebat.exe
thebat64.exe
thunderbird.exe
visio.exe
winword.exe
wordpad.exe
/c timeout -c 5 & del "%s" /f /q
cmd.exe
Content-Type: application/x-www-form-urlencoded
curl.php?token=
action=result&e_files=%d&e_size=%I64u&e_time=%d&
action=call&
&pub_key=
&priv_key=
&version=2.1
Microsoft Enhanced Cryptographic Provider v1.0
\ProgramData\
\Program Files\
\Tor Browser\
Ransomware
\All Users\
\Local Settings\
desktop.ini
autorun.inf
ntuser.dat
iconcache.db
bootsect.bak
boot.ini
ntuser.dat.log
thumbs.db
GDCB-DECRYPT.txt
%s\GDCB-DECRYPT.txt
ipv4bot.whatismyipaddress.com
undefined
Domain
SYSTEM\CurrentControlSet\services\Tcpip\Parameters
WORKGROUP
LocaleName
Control Panel\International
Keyboard Layout\Preload
00000419
productName
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion
Itanium
Unknown
ProcessorNameString
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Identifier
2ntdll.dll
UNKNOWN
NO_ROOT_DIR
REMOVABLE
REMOTE
RAMDISK
%I64u/
AVP.EXE
ekrn.exe
avgnt.exe
ashDisp.exe
NortonAntiBot.exe
Mcshield.exe
avengine.exe
cmdagent.exe
smc.exe
persfw.exe
pccpfw.exe
fsguiexe.exe
cfp.exe
msmpeng.exe
HTTP/1.1

Process Tree

0df6d010499c4337892cae71bedfc617a4c9a4549c781e9440352da6bf387fe8.exe (1848) "C:\Users\Administrator\AppData\Local\Temp\0df6d010499c4337892cae71bedfc617a4c9a4549c781e9440352da6bf387fe8.exe"
- nslookup.exe (2708) nslookup nomoreransom.bit dns1.soprodns.ru
- nslookup.exe (1384) nslookup emsisoft.bit dns1.soprodns.ru
- nslookup.exe (2424) nslookup emsisoft.bit dns1.soprodns.ru
- nslookup.exe (2692) nslookup gandcrab.bit dns1.soprodns.ru
- nslookup.exe (2876) nslookup emsisoft.bit dns1.soprodns.ru
- nslookup.exe (1188) nslookup nomoreransom.bit dns1.soprodns.ru
- nslookup.exe (2612) nslookup nomoreransom.bit dns1.soprodns.ru
- nslookup.exe (900) nslookup emsisoft.bit dns1.soprodns.ru
- nslookup.exe (2884) nslookup nomoreransom.bit dns1.soprodns.ru
- nslookup.exe (2488) nslookup gandcrab.bit dns1.soprodns.ru
- nslookup.exe (792) nslookup gandcrab.bit dns1.soprodns.ru
- nslookup.exe (2084) nslookup gandcrab.bit dns1.soprodns.ru

0df6d010499c4337892cae71bedfc617a4c9a4549c781e9440352da6bf387fe8.exe, PID: 1848, Parent PID: 844

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2708, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1384, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2692, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1188, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2876, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2488, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2612, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2424, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 792, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2884, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 900, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2084, Parent PID: 1848

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114
8.8.8.8

DNS

Name	Response	Post-Analysis Lookup
ipv4bot.whatismyipaddress.com
dns.msftncsi.com	A 131.107.255.255 A 131.107.255.255
dns.msftncsi.com
dns1.soprodns.ru
114.114.114.114.in-addr.arpa	PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com
nomoreransom.bit
nomoreransom.bit
emsisoft.bit
emsisoft.bit
gandcrab.bit
gandcrab.bit

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	56933	114.114.114.114	53
192.168.56.101	58485	114.114.114.114	53
192.168.56.101	61714	8.8.8.8	53
192.168.56.101	57665	8.8.8.8	53
192.168.56.101	57665	114.114.114.114	53
192.168.56.101	57666	114.114.114.114	53
192.168.56.101	138	192.168.56.255	138
192.168.56.101	57667	114.114.114.114	53
192.168.56.101	51758	114.114.114.114	53
192.168.56.101	51759	114.114.114.114	53
192.168.56.101	51758	8.8.8.8	53
192.168.56.101	52215	8.8.8.8	53
192.168.56.101	52216	114.114.114.114	53
192.168.56.101	52217	114.114.114.114	53
192.168.56.101	52218	114.114.114.114	53
192.168.56.101	52219	114.114.114.114	53
192.168.56.101	52220	114.114.114.114	53
192.168.56.101	52221	114.114.114.114	53
192.168.56.101	52222	114.114.114.114	53
192.168.56.101	52223	114.114.114.114	53
192.168.56.101	52224	114.114.114.114	53
192.168.56.101	52225	114.114.114.114	53
192.168.56.101	52226	114.114.114.114	53
192.168.56.101	52227	114.114.114.114	53
192.168.56.101	52228	114.114.114.114	53
192.168.56.101	52229	114.114.114.114	53
192.168.56.101	52230	114.114.114.114	53
192.168.56.101	52231	114.114.114.114	53
192.168.56.101	52232	114.114.114.114	53
192.168.56.101	52233	114.114.114.114	53
192.168.56.101	52234	114.114.114.114	53
192.168.56.101	52235	114.114.114.114	53
192.168.56.101	52236	114.114.114.114	53
192.168.56.101	52237	114.114.114.114	53
192.168.56.101	52238	114.114.114.114	53
192.168.56.101	52239	114.114.114.114	53
192.168.56.101	52240	114.114.114.114	53
192.168.56.101	52241	114.114.114.114	53
192.168.56.101	52242	114.114.114.114	53
192.168.56.101	52243	114.114.114.114	53
192.168.56.101	52244	114.114.114.114	53
192.168.56.101	52245	114.114.114.114	53
192.168.56.101	52246	114.114.114.114	53
192.168.56.101	52247	114.114.114.114	53
192.168.56.101	52248	114.114.114.114	53
192.168.56.101	52249	114.114.114.114	53
192.168.56.101	52250	114.114.114.114	53
192.168.56.101	52251	114.114.114.114	53
192.168.56.101	52252	114.114.114.114	53
192.168.56.101	52253	114.114.114.114	53
192.168.56.101	52254	114.114.114.114	53
192.168.56.101	52255	114.114.114.114	53
192.168.56.101	52256	114.114.114.114	53
192.168.56.101	52257	114.114.114.114	53
192.168.56.101	52258	114.114.114.114	53
192.168.56.101	52259	114.114.114.114	53
192.168.56.101	52260	114.114.114.114	53
192.168.56.101	52261	114.114.114.114	53
192.168.56.101	52262	114.114.114.114	53
192.168.56.101	52263	114.114.114.114	53
192.168.56.101	52264	114.114.114.114	53
192.168.56.101	52265	114.114.114.114	53
192.168.56.101	52266	114.114.114.114	53
192.168.56.101	52267	114.114.114.114	53
192.168.56.101	52268	114.114.114.114	53
192.168.56.101	52269	114.114.114.114	53
192.168.56.101	52270	114.114.114.114	53
192.168.56.101	52271	114.114.114.114	53
192.168.56.101	52272	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	0289b6ed05a18067_zzzqcc.exe
Filepath	C:\Users\Administrator\AppData\Roaming\Microsoft\zzzqcc.exe
Size	73.5KB
Processes	1848 (0df6d010499c4337892cae71bedfc617a4c9a4549c781e9440352da6bf387fe8.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`718d6cb7657191da3c2a7464dc7ad47b`
SHA1	`8e146c35b9821b2ac2fcc8d6c57a8e29fa724c8f`
SHA256	`0289b6ed05a18067ddeeb0692d9880dbe2bd272d88b7e519c4ab5b437565d494`
CRC32	`EFCC6060`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.