SmartHawk

12.8

0-day

10 个模型检测该样本为恶意！

重新分析

下载样本

ad6f8f856aee8fbe7896ef40d03181660f2625e2bbe4f88c746d951f6250be22

c39c94a4e3bab8a511eb4e4fad814d9d.exe

分析耗时

130s

最近分析

文件大小

19.1MB

静态报毒动态报毒 ARTEMIS BKGH CLOUD FILEREPMETAGEN UNSAFE

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!C39C94A4E3BA	20210504	6.0.6.653
Baidu		20190318	1.0.0.2
Alibaba		20190527	0.3.0.5
Kingsoft		20210510	2017.9.26.565
Tencent		20210510	1.0.0.1
Avast	FileRepMetagen [Malware]	20210510	21.1.5827.0
CrowdStrike		20210203	1.0

Queries for the computername (4 个事件)

Time & API	Arguments	Status	Return
1621001428.24875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1621001429.01475 GetComputerNameW	computer_name: OSKAR-PC	success	1
1621001429.12375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1621001001.081395 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (5 个事件)

Time & API	Arguments	Status	Return	Repeated
1621001047.877395 IsDebuggerPresent		failed	0	0
1621001049.143395 IsDebuggerPresent		failed	0	0
1621001037.189645 IsDebuggerPresent		failed	0	0
1621001037.220645 IsDebuggerPresent		failed	0	0
1621001037.267645 IsDebuggerPresent		failed	0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable is signed

Tries to locate where the browsers are installed (1 个事件)

file	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621001397.53075 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1621001399.95275 NtProtectVirtualMemory	process_identifier: 472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x10004000	success	0	0
1621001036.674395 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000050c0000	success	0	0

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621001001.909395 GetDiskFreeSpaceExW	root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer free_bytes_available: 19403513856 total_number_of_free_bytes: 0 total_number_of_bytes: 0	success	1	0

Steals private information from local Internet browsers (13 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF102d0e5.TMP
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\

Creates executable files on the filesystem (50 out of 69 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\DumpLog.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn\tap-windows.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn\lzo2.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn64\openvpn.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn\liblzo2-2.dll
file	C:\Program Files (x86)\OkayFreedom\UninstallWindow.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\Processes.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn64\devcon.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn\ssleay32.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn\libcrypto-1_1.dll
file	C:\Program Files (x86)\OkayFreedom\sqlite3.dll
file	C:\Program Files (x86)\OkayFreedom\vpn.dll
file	C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\uac.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn64\tapinstall.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\nsExec.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn\msvcr90.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\TMP5.tmp\setup.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn\tapinstall.exe
file	C:\Program Files (x86)\OkayFreedom\setuptool.exe
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OkayFreedom\OkayFreedom.lnk
file	C:\Program Files (x86)\OkayFreedom\openvpn64\libcrypto-1_1-x64.dll
file	C:\Program Files (x86)\OkayFreedom\LibShred.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\System.dll
file	C:\Program Files (x86)\OkayFreedom\concrt140.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn64\up.cmd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\SimpleSC.dll
file	C:\Program Files (x86)\OkayFreedom\vcruntime140.dll
file	C:\Program Files (x86)\OkayFreedom\infohelper.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn\openvpn.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn64\ssleay32.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn64\msvcr90.dll
file	C:\Program Files (x86)\OkayFreedom\ResetPendingMoves.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn64\msvcp60.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn64\openssl.exe
file	C:\Program Files (x86)\OkayFreedom\msvcr90.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn\msvcr71.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn\libeay32.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn64\liblzo2-2.dll
file	C:\Program Files (x86)\OkayFreedom\msvcp90.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn\deltapall.bat
file	C:\Program Files (x86)\OkayFreedom\openvpn\libpkcs11-helper-1.dll
file	C:\Program Files (x86)\OkayFreedom\7-zip\7za.exe
file	C:\Program Files (x86)\OkayFreedom\OkayFreedomServiceStarter.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn64\libpkcs11-helper-1.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn\openssl.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn64\msvcr71.dll
file	C:\Program Files (x86)\OkayFreedom\openvpn\devcon.exe
file	C:\Program Files (x86)\OkayFreedom\openvpn64\deltapall.bat
file	C:\Program Files (x86)\OkayFreedom\ShutdownApp.exe

Creates a service (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621001426.49875 CreateServiceA	service_start_name: start_type: 2 service_handle: 0x005cf908 display_name: OkayFreedom VPN Starter Service error_control: 1 service_name: OkayFreedom VPN Starter Service filepath: C:\Program Files (x86)\OkayFreedom\"C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe" filepath_r: "C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe" service_manager_handle: 0x005cf868 desired_access: 65556 service_type: 16 password:	success	6093064	0

Creates a shortcut to an executable file (5 个事件)

file	C:\Users\Public\Desktop\OkayFreedom.lnk
file	C:\Users\Administrator.Oskar-PC\Desktop\OkayFreedom.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OkayFreedom\OkayFreedom.lnk
file	C:\Users\Public\Desktop\Google Chrome.lnk
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\OkayFreedom.lnk

Drops an executable to the user AppData folder (6 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\uac.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\Processes.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\System.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\DumpLog.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\nsExec.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsh71F0.tmp\SimpleSC.dll

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621001469.342625 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.384240981991221

section

{'size_of_data': '0x00019e00', 'virtual_address': '0x0002e000', 'entropy': 7.384240981991221, 'name': '.rsrc', 'virtual_size': '0x00019d8c'}

description

A section with a high entropy has been found

entropy

0.3826247689463956

description

Overall entropy of this PE file is high

Queries for potentially installed applications (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1621001400.01475 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3F3FB10C-7175-4D38-9335-3488B89C12AF} regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{3F3FB10C-7175-4D38-9335-3488B89C12AF} options: 0	failed	2	0
1621001400.63975 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3F3FB10C-7175-4D38-9335-3488B89C12AF} regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{3F3FB10C-7175-4D38-9335-3488B89C12AF} options: 0	failed	2	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Installs itself for autorun at Windows startup (3 个事件)

service_name	OkayFreedom VPN Starter Service	service_path	C:\Program Files (x86)\OkayFreedom\"C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OKAYFREEDOM Notifier	reg_value	"C:\Program Files (x86)\OkayFreedom\Notifier.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\OKAYFREEDOM_Agent	reg_value	"C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe" -agent

Attempts to modify browser security settings (2 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Notifier.exe
registry	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OkayFreedomClient.exe

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 个事件)

McAfee	Artemis!C39C94A4E3BA
Cylance	Unsafe
AegisLab	Trojan.Win32.Keylogger.l!c
Kaspersky	UDS:DangerousObject.Multi.Generic
Rising	Spyware.Keylogger!8.12F (CLOUD)
McAfee-GW-Edition	Artemis
Jiangmin	TrojanSpy.KeyLogger.miv
Fortinet	W32/KeyLogger.BKGH!tr
AVG	FileRepMetagen [Malware]
Avast	FileRepMetagen [Malware]

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1621001472.530625 RegSetValueExA	key_handle: 0x00000b18 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1621001472.530625 RegSetValueExA	key_handle: 0x00000b18 value: /1¯H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1621001472.530625 RegSetValueExA	key_handle: 0x00000b18 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1621001472.530625 RegSetValueExW	key_handle: 0x00000b18 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1621001472.530625 RegSetValueExA	key_handle: 0x00000b0c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1621001472.530625 RegSetValueExA	key_handle: 0x00000b0c value: /1¯H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1621001472.530625 RegSetValueExA	key_handle: 0x00000b0c value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1621001473.092625 RegSetValueExW	key_handle: 0x00000afc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

One or more non-safelisted processes were created (1 个事件)

parent_process

chrome.exe

martian_process

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef22e4f50,0x7fef22e4f60,0x7fef22e4f70

Writes a potential ransom message to disk (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1621001408.60875 NtWriteFile	file_handle: 0x00000244 filepath: C:\Program Files (x86)\OkayFreedom\openvpn\README.txt buffer: Extract all zip'd files to the OpenVPN home directory, including the openssl.cnf file from the top-level "easy-rsa" directory. First run init-config.bat Next, edit vars.bat to adapt it to your environment, and create the directory that will hold your key files. To generate TLS keys: Create new empty index and serial files (once only) 1. vars 2. clean-all Build a CA key (once only) 1. vars 2. build-ca Build a DH file (for server side, once only) 1. vars 2. build-dh Build a private key/certficate for the openvpn server 1. vars 2. build-key-server <machine-name> Build key files in PEM format (for each client machine) 1. vars 2. build-key <machine-name> (use <machine name> for specific name within script) or Build key files in PKCS #12 format (for each client machine) 1. vars 2. build-key-pkcs12 <machine-name> (use <machine name> for specific name within script) To revoke a TLS certificate and generate a CRL file: 1. vars 2. revoke-full <machine-name> 3. verify last line of output confirms revokation 4. copy crl.pem to server directory and ensure config file uses "crl-verify <crl filename>" offset: 0	success	0	0
1621001413.23375 NtWriteFile	file_handle: 0x00000248 filepath: C:\Program Files (x86)\OkayFreedom\openvpn64\README.txt buffer: Extract all zip'd files to the OpenVPN home directory, including the openssl.cnf file from the top-level "easy-rsa" directory. First run init-config.bat Next, edit vars.bat to adapt it to your environment, and create the directory that will hold your key files. To generate TLS keys: Create new empty index and serial files (once only) 1. vars 2. clean-all Build a CA key (once only) 1. vars 2. build-ca Build a DH file (for server side, once only) 1. vars 2. build-dh Build a private key/certficate for the openvpn server 1. vars 2. build-key-server <machine-name> Build key files in PEM format (for each client machine) 1. vars 2. build-key <machine-name> (use <machine name> for specific name within script) or Build key files in PKCS #12 format (for each client machine) 1. vars 2. build-key-pkcs12 <machine-name> (use <machine name> for specific name within script) To revoke a TLS certificate and generate a CRL file: 1. vars 2. revoke-full <machine-name> 3. verify last line of output confirms revokation 4. copy crl.pem to server directory and ensure config file uses "crl-verify <crl filename>" offset: 0	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3076 resumed a thread in remote process 3244
1621001483.828 NtResumeThread	thread_handle: 0x000009bc suspend_count: 1 process_identifier: 3244	success	0	0

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	216.58.200.238:443
dead_host	188.5.4.96:443
dead_host	54.76.135.1:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2015-02-23 18:18:26

Imports

Library USER32.dll:

• 0x424168 MessageBoxA

Library ADVAPI32.dll:

• 0x424000 RegQueryValueExA

• 0x424004 RegCloseKey

• 0x424008 RegSetValueExA

• 0x42400c RegCreateKeyA

Library SHELL32.dll:

• 0x424160 ShellExecuteA

Library KERNEL32.dll:

• 0x424014 SetFilePointer

• 0x424018 GetTempFileNameA

• 0x42401c GetTempPathA

• 0x424020 Sleep

• 0x424024 CopyFileA

• 0x424028 GetModuleFileNameA

• 0x42402c InterlockedIncrement

• 0x424030 InterlockedDecrement

• 0x424034 WideCharToMultiByte

• 0x424038 InterlockedExchange

• 0x42403c InitializeCriticalSection

• 0x424040 DeleteCriticalSection

• 0x424044 EnterCriticalSection

• 0x424048 LeaveCriticalSection

• 0x42404c MultiByteToWideChar

• 0x424050 RtlUnwind

• 0x424054 RaiseException

• 0x424058 TerminateProcess

• 0x42405c GetCurrentProcess

• 0x424060 UnhandledExceptionFilter

• 0x424064 SetUnhandledExceptionFilter

• 0x424068 IsDebuggerPresent

• 0x42406c GetCommandLineA

• 0x424070 GetLastError

• 0x424074 HeapFree

• 0x424078 GetCPInfo

• 0x42407c LCMapStringA

• 0x424080 LCMapStringW

• 0x424084 GetModuleHandleW

• 0x424088 GetProcAddress

• 0x42408c TlsGetValue

• 0x424090 TlsAlloc

• 0x424094 TlsSetValue

• 0x424098 TlsFree

• 0x42409c SetLastError

• 0x4240a0 GetCurrentThreadId

• 0x4240a4 SetHandleCount

• 0x4240a8 GetStdHandle

• 0x4240ac GetFileType

• 0x4240b0 GetStartupInfoA

• 0x4240b4 CloseHandle

• 0x4240b8 ReadFile

• 0x4240bc CreateDirectoryA

• 0x4240c0 WriteFile

• 0x4240c4 GetConsoleCP

• 0x4240c8 GetConsoleMode

• 0x4240cc HeapAlloc

• 0x4240d0 GetModuleHandleA

• 0x4240d4 HeapSize

• 0x4240d8 ExitProcess

• 0x4240dc FreeEnvironmentStringsA

• 0x4240e0 GetEnvironmentStrings

• 0x4240e4 FreeEnvironmentStringsW

• 0x4240e8 GetEnvironmentStringsW

• 0x4240ec HeapCreate

• 0x4240f0 VirtualFree

• 0x4240f4 QueryPerformanceCounter

• 0x4240f8 GetTickCount

• 0x4240fc GetCurrentProcessId

• 0x424100 GetSystemTimeAsFileTime

• 0x424104 VirtualAlloc

• 0x424108 HeapReAlloc

• 0x42410c FlushFileBuffers

• 0x424110 GetACP

• 0x424114 GetOEMCP

• 0x424118 IsValidCodePage

• 0x42411c GetUserDefaultLCID

• 0x424120 GetLocaleInfoA

• 0x424124 EnumSystemLocalesA

• 0x424128 IsValidLocale

• 0x42412c GetStringTypeA

• 0x424130 GetStringTypeW

• 0x424134 InitializeCriticalSectionAndSpinCount

• 0x424138 SetStdHandle

• 0x42413c CreateFileA

• 0x424140 WriteConsoleA

• 0x424144 GetConsoleOutputCP

• 0x424148 WriteConsoleW

• 0x42414c LoadLibraryA

• 0x424150 GetLocaleInfoW

• 0x424154 SetEndOfFile

• 0x424158 GetProcessHeap

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
steganos.com	A 188.5.4.96	188.5.4.96
backend.steganos.com	A 118.5.49.6	118.5.49.6
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	216.58.200.238
api.steganos.com	A 77.4.7.92	77.4.7.92
vpn1.steganos.com	A 54.76.135.1	54.76.135.1
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.