SmartHawk

9.6

极危

64 个模型检测该样本为恶意！

重新分析

下载样本

a53f639d9fc551902cccea22dacc77b62fac63516d18418c3008c18cd619f993

995b0673e908e50fd55f6aa6e1d82acc.exe

分析耗时

133s

最近分析

文件大小

311.0KB

静态报毒动态报毒 100% A + MAL AI SCORE=83 AIDETECTVM BSCOPE CHAPAK CNAR COINS CONFIDENCE CVE-2020-1672 CVE20167255 ELDORADO FDOUER FILECODER GANDCRAB GANDCRYPT GDE@7OO149 GENASA GENCIRC GENERICRXFR GENETIC GENKRYPTIK HIGH CONFIDENCE MALICIOUS PE MALWARE1 MALWAREX QVM10 RANSOMEWARE SCORE SI75QE8PLBY SMJS2 STATIC AI TSGENERIC TYX@AWFSOBI UNSAFE XEJY87AREAP ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Ransom:Win32/GandCrab.6c93024b	20190527	0.3.0.5
Avast	Win32:MalwareX-gen [Trj]	20201223	21.1.5827.0
Baidu		20190318	1.0.0.2
Kingsoft		20201223	2017.9.26.565
McAfee	GenericRXFR-KG!995B0673E908	20201223	6.0.6.653
Tencent	Malware.Win32.Gencirc.10b9d113	20201223	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619797618.747375 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619797622.685375 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619797618.435375 IsDebuggerPresent		failed	0	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619797622.622375 CryptGenKey	crypto_handle: 0x01521768 algorithm_identifier: 0x0000a400 (CALG_RSA_KEYX) provider_handle: 0x0150e428 flags: 134217729 key:	success	1
1619797622.622375 CryptExportKey	crypto_handle: 0x01521768 crypto_export_handle: 0x00000000 buffer: ¤RSA1Ãgè¼ö«Ð ÀL/åÀ³Úbá@ ?-ó+$ <côEp]LÙ[Ö´k¯Fjö,do]þ6ðþÄÈ 'OÚzGBP>Zµ(5êÀ¸,t°6§éy2½À·Ïiþë(Þ¢ã½.<eÐ={º5]«Û×¼¼~Õ:¾¼F2Ï¬Ç ÌçåðlxUjn»+Q©¨UøñÍÑvLðÒ:`áý©yOÔ={ÈZ+Whâx(°²Îíüõd½KÙ/±}êpÓt©EäP:ÞÚÑXÐÈ¨@ÐîbôaÇ:õ¤½ blob_type: 6 flags: 0	success	1
1619797622.622375 CryptExportKey	crypto_handle: 0x01521768 crypto_export_handle: 0x00000000 buffer: ¤RSA2Ãgè¼ö«Ð ÀL/åÀ³Úbá@ ?-ó+$ <côEp]LÙ[Ö´k¯Fjö,do]þ6ðþÄÈ 'OÚzGBP>Zµ(5êÀ¸,t°6§éy2½À·Ïiþë(Þ¢ã½.<eÐ={º5]«Û×¼¼~Õ:¾¼F2Ï¬Ç ÌçåðlxUjn»+Q©¨UøñÍÑvLðÒ:`áý©yOÔ={ÈZ+Whâx(°²Îíüõd½KÙ/±}êpÓt©EäP:ÞÚÑXÐÈ¨@ÐîbôaÇ:õ¤½é¼k=½¬§ú!]üâJÂ¹Ê0è~\5®KOCzSLô¶>Ï46¯:ÃF.Ö$üF÷%ëî é»épzPÂ.±w"ìÕÓõ`c_/-Ç/Õxûûú HäkFrS£æ¦ÜnL{< ¿Ì@E5=mºüË5d3³4Jcù\Ú¼»³Cü PàRÚ3Ëz1`ª6ù¿íªüßè×vä¶Éöôx³AÔhÙRy\|ÁíU½ªmïG<âVìøS6ìGÈóx}S¹QD!ÖGý=óÀ¹¯'ó}×dõõNX [Ö'sòCÊþH4`Ú·)ÎòÀGd<ñ ®ÜCêC%Rþú§u>K¯nrÔGocÉ×1X÷¸}¬×>²÷ÌôÚâÿS\|ë6ÿPkÃÈ'krÓA¡÷@7ìOòÅ¯Vo\%îêI{ñÛÆDèm9w°à´eOHBãsHla®í¡»õH°üÁ({´ xÅ.\|ÂëÑ¯-ô·âÉÉkðàÅB52ë^9ÕæÌ óñÊ5ÔØF~,ìÓæqMôæåëCo&]~È<¼z~$ ÄW{ÛeöPô5´"}t.åüEþâr}þû&ÕnW¤Nw>Uðïì¢=ûïì÷@0À3ù6»+ÃÓ¨¡ÄÔ§Px»<\³míqøsæ´jsdßóÂ^àe5¦ïn%És/¢7¢¾îqÄ÷ðÎÃD²ÉÿÓÒy Úñ¼õÅï§¢_Y*ÎXÂ$&k8gnHÏãccÛÜÆVæT27©Ç¾Üë43Ú3 éÆ¢åkOÑV§hÌÔÿmú°b´Zg;"Ì½RÇÕÝðY¹ó(u8Åi!ù±üí:o¦¶ûÄz ¯a+Ò¾_Ã¬õ©ÃÊ¾T_ðÚ1NcÈÛ´+ÃjUáC_BÉCºôKÛ×ø0têzº=®§QµS¡¯1ÆJ3ÎT¥Í=%HÛ¸Ê8óøTÅÌT31ÂEìÒD_\|ÓElÅÛ\¡b& blob_type: 7 flags: 0	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619797629.435125 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

DJQKUWWUB

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:1572673780&cup2hreq=7fc324a8e36c90fafbefe664b12186653108556be9f7f21b02795f3f5f918a38

Performs some HTTP requests (5 个事件)

request	GET http://carder.bit/
request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619768417&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=205b28966108a91b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619768417&mv=m
request	POST https://update.googleapis.com/service/update2?cup2key=10:1572673780&cup2hreq=7fc324a8e36c90fafbefe664b12186653108556be9f7f21b02795f3f5f918a38

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:1572673780&cup2hreq=7fc324a8e36c90fafbefe664b12186653108556be9f7f21b02795f3f5f918a38

Resolves a suspicious Top Level Domain (TLD) (2 个事件)

domain	ns1.wowservers.ru				description	Russian Federation domain TLD
domain	ns2.wowservers.ru				description	Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (20 个事件)

Time & API	Arguments	Status
1619797618.513375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 110592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a0000	success
1619797618.747375 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 180224 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619797620.357375 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 81920 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00414000	success
1619797620.357375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 94208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003c0000	success
1619797620.544375 NtProtectVirtualMemory	process_identifier: 2340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 81920 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00414000	success
1619797621.544375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000b0000	success
1619797621.544375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000f0000	success
1619797621.857375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000a0000	success
1619797621.904375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00170000	success
1619797622.263375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x03920000	success
1619797622.325375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x038d0000	success
1619797622.357375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00110000	success
1619797622.357375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00120000	success
1619797623.169375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x03f10000	success
1619797623.200375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x03f20000	success
1619797628.232375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x03f10000	success
1619797628.232375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x04670000	success
1619797628.232375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x04850000	success
1619797628.247375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x04850000	success
1619797628.247375 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x04870000	success

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619797622.716375 GetDiskFreeSpaceW	root_path: C:\ sectors_per_cluster: 8 number_of_free_clusters: 4788591 total_number_of_clusters: 8362495 bytes_per_sector: 512	success	1	0

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\rmmndq.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\rmmndq.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619797624.232375 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.8370978624432945

section

{'size_of_data': '0x0001d200', 'virtual_address': '0x0104a000', 'entropy': 7.8370978624432945, 'name': '.rsrc', 'virtual_size': '0x0001d02c'}

description

A section with a high entropy has been found

entropy

0.3758064516129032

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (4 个事件)

cmdline	nslookup carder.bit ns1.wowservers.ru
cmdline	nslookup carder.bit ns2.wowservers.ru
cmdline	nslookup ransomware.bit ns2.wowservers.ru
cmdline	nslookup ransomware.bit ns1.wowservers.ru

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Checks the CPU name from registry, possibly for anti-virtualization (1 个事件)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Installs itself for autorun at Windows startup (1 个事件)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vrbrjlolxbn

reg_value

"C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\rmmndq.exe"

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

File has been identified by 64 AntiVirus engines on VirusTotal as malicious (50 out of 64 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.24384
MicroWorld-eScan	Trojan.Ransom.GandCrab.Gen.2
FireEye	Generic.mg.995b0673e908e50f
CAT-QuickHeal	Trojan.Chapak.ZZ6
ALYac	Trojan.Ransom.GandCrab.Gen.2
Cylance	Unsafe
Zillya	Trojan.Coins.Win32.168
SUPERAntiSpyware	Ransom.GandCrab/Variant
Sangfor	Malware
K7AntiVirus	Trojan ( 00533b5d1 )
Alibaba	Ransom:Win32/GandCrab.6c93024b
K7GW	Trojan ( 00533b5d1 )
Cybereason	malicious.3e908e
Arcabit	Trojan.Ransom.GandCrab.Gen.2
BitDefenderTheta	Gen:NN.ZexaF.34700.tyX@aWfSOBi
Cyren	W32/S-ba9a9755!Eldorado
Symantec	Packed.Generic.525
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Gandcrab-6520432-4
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Ransom.GandCrab.Gen.2
NANO-Antivirus	Trojan.Win32.Encoder.fdouer
ViRobot	Trojan.Win32.GandCrab.Gen.A
Avast	Win32:MalwareX-gen [Trj]
Rising	Ransom.GandCrab!8.F355 (TFE:5:xejy87arEAP)
Ad-Aware	Trojan.Ransom.GandCrab.Gen.2
TACHYON	Ransom/W32.GandCrab
Sophos	ML/PE-A + Mal/Agent-AUL
Comodo	TrojWare.Win32.Chapak.GDE@7oo149
F-Secure	Trojan.TR/FileCoder.FB
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_GANDCRAB.SMJS2
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Trojan.Ransom.GandCrab.Gen.2 (B)
Ikarus	Trojan-Ransom.GandCrab
Jiangmin	Trojan.GandCrypt.di
Avira	TR/FileCoder.FB
Antiy-AVL	Trojan/Win32.TSGeneric
Microsoft	Ransom:Win32/GandCrab.AE
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.Ransom.GandCrab.Gen.2
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Gandcrab.Exp
Acronis	suspicious
McAfee	GenericRXFR-KG!995B0673E908
MAX	malware (ai score=83)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2018-06-05 10:34:55

Imports

Library KERNEL32.dll:

• 0x420000 VirtualAlloc

• 0x420004 GetCurrentProcess

• 0x420008 RaiseException

• 0x42000c GetLastError

• 0x420010 ResetEvent

• 0x420014 PulseEvent

• 0x420018 GetNativeSystemInfo

• 0x42001c lstrlenA

• 0x420020 lstrlenW

• 0x420024 LoadLibraryW

• 0x420028 FindAtomA

• 0x42002c GetComputerNameW

• 0x420030 GetVersionExA

• 0x420034 FindFirstVolumeMountPointW

• 0x420038 SetThreadLocale

• 0x42003c SetConsoleMode

• 0x420040 AddConsoleAliasA

• 0x420044 WriteConsoleW

• 0x420048 GetConsoleCP

• 0x42004c FlushFileBuffers

• 0x420050 HeapSize

• 0x420054 SetFilePointerEx

• 0x420058 SetStdHandle

• 0x42005c FreeEnvironmentStringsW

• 0x420060 GetEnvironmentStringsW

• 0x420064 GetCommandLineW

• 0x420068 GetCommandLineA

• 0x42006c GetOEMCP

• 0x420070 IsValidCodePage

• 0x420074 WideCharToMultiByte

• 0x420078 EnterCriticalSection

• 0x42007c LeaveCriticalSection

• 0x420080 DeleteCriticalSection

• 0x420084 MultiByteToWideChar

• 0x420088 EncodePointer

• 0x42008c DecodePointer

• 0x420090 SetLastError

• 0x420094 InitializeCriticalSectionAndSpinCount

• 0x420098 CreateEventW

• 0x42009c TlsAlloc

• 0x4200a0 TlsGetValue

• 0x4200a4 TlsSetValue

• 0x4200a8 TlsFree

• 0x4200ac GetSystemTimeAsFileTime

• 0x4200b0 GetModuleHandleW

• 0x4200b4 GetProcAddress

• 0x4200b8 LCMapStringW

• 0x4200bc GetLocaleInfoW

• 0x4200c0 GetStringTypeW

• 0x4200c4 GetCPInfo

• 0x4200c8 CloseHandle

• 0x4200cc SetEvent

• 0x4200d0 WaitForSingleObjectEx

• 0x4200d4 IsProcessorFeaturePresent

• 0x4200d8 IsDebuggerPresent

• 0x4200dc UnhandledExceptionFilter

• 0x4200e0 SetUnhandledExceptionFilter

• 0x4200e4 GetStartupInfoW

• 0x4200e8 QueryPerformanceCounter

• 0x4200ec GetCurrentProcessId

• 0x4200f0 GetCurrentThreadId

• 0x4200f4 InitializeSListHead

• 0x4200f8 TerminateProcess

• 0x4200fc RtlUnwind

• 0x420100 FreeLibrary

• 0x420104 LoadLibraryExW

• 0x420108 HeapAlloc

• 0x42010c HeapFree

• 0x420110 HeapReAlloc

• 0x420114 ExitProcess

• 0x420118 GetModuleHandleExW

• 0x42011c GetModuleFileNameA

• 0x420120 GetStdHandle

• 0x420124 WriteFile

• 0x420128 GetACP

• 0x42012c ReadFile

• 0x420130 GetConsoleMode

• 0x420134 ReadConsoleW

• 0x420138 GetFileType

• 0x42013c IsValidLocale

• 0x420140 GetUserDefaultLCID

• 0x420144 EnumSystemLocalesW

• 0x420148 GetProcessHeap

• 0x42014c FindClose

• 0x420150 FindFirstFileExA

• 0x420154 FindNextFileA

• 0x420158 CreateFileW

Library USER32.dll:

• 0x420160 DrawEdge

• 0x420164 DefFrameProcW

• 0x420168 DestroyCursor

• 0x42016c CreateCursor

• 0x420170 LoadCursorFromFileW

• 0x420174 SetWindowsHookW

• 0x420178 UpdateWindow

• 0x42017c SetMenuInfo

• 0x420180 DeleteMenu

• 0x420184 LoadMenuW

• 0x420188 MapVirtualKeyA

• 0x42018c ReplyMessage

• 0x420190 PostMessageW

• 0x420194 DrawCaption

Library ole32.dll:

• 0x42019c OleLoadFromStream

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
carder.bit
ipv4bot.whatismyipaddress.com	A 66.171.248.178	66.171.248.178
ns2.wowservers.ru
114.114.114.114.in-addr.arpa	PTR public1.114dns.com
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
ransomware.bit
ns1.wowservers.ru
carder.bit
redirector.gvt1.com	A 203.208.41.65	203.208.41.65
update.googleapis.com	A 203.208.40.98	203.208.40.98
dns.msftncsi.com	A 131.107.255.255
ransomware.bit

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49236	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49226	203.208.40.98 update.googleapis.com	443
192.168.56.101	49233	203.208.41.65 redirector.gvt1.com	80
192.168.56.101	49170	66.171.248.178 ipv4bot.whatismyipaddress.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	50003	114.114.114.114	53
192.168.56.101	50004	114.114.114.114	53
192.168.56.101	50005	114.114.114.114	53
192.168.56.101	50006	114.114.114.114	53
192.168.56.101	50007	114.114.114.114	53
192.168.56.101	50008	114.114.114.114	53
192.168.56.101	50009	114.114.114.114	53
192.168.56.101	50010	114.114.114.114	53
192.168.56.101	50011	114.114.114.114	53
192.168.56.101	50012	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51379	114.114.114.114	53
192.168.56.101	51380	114.114.114.114	53
192.168.56.101	51381	114.114.114.114	53
192.168.56.101	51382	114.114.114.114	53
192.168.56.101	51383	114.114.114.114	53
192.168.56.101	51384	114.114.114.114	53
192.168.56.101	51385	114.114.114.114	53

HTTP & HTTPS Requests

URI	Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619768417&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619768417&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com
http://carder.bit/	GET / HTTP/1.1 Host: carder.bit User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=205b28966108a91b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619768417&mv=m	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=205b28966108a91b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619768417&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.