3.6
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.97
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | TrojanDownloader:Win32/Upatre.bd70f0bc | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-ASIV [Trj] | 20200731 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.c | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200731 | 2013.8.14.323 |
| McAfee | GenericRXAA-AA!CE790866462C | 20200731 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b078bd | 20200731 | 1.0.0.1 |
静态指标
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(4 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\asih.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\asih.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\asih.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测）
(8 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00009000', 'virtual_size': '0x00003000', 'size_of_data': '0x00002800', 'entropy': 7.750771030870659} | entropy | 7.750771030870659 | description | 发现高熵的节 | |||||||||
| entropy | 0.47619047619047616 | description | 此PE文件的整体熵值较高 | |||||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
创建已知的 Upatre 文件、注册表项和/或互斥体
(1 个事件)
| file | C:\Users\jbayuelo\AppData\Local\Temp\Rar$EX00.060\Invoice_OCT-02-2013.exe |
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Agent.BALW |
| APEX | Malicious |
| AVG | Win32:Agent-ASIV [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Agent.BALW |
| AhnLab-V3 | Malware/RL.Generic.R256208 |
| Alibaba | TrojanDownloader:Win32/Upatre.bd70f0bc |
| Antiy-AVL | Trojan/Win32.ShipUp |
| Arcabit | Trojan.Agent.BALW |
| Avast | Win32:Agent-ASIV [Trj] |
| Avira | HEUR/AGEN.1117597 |
| Baidu | Win32.Trojan-Downloader.Small.c |
| BitDefender | Trojan.Agent.BALW |
| BitDefenderTheta | Gen:NN.ZexaF.34144.fmNfaqWz3vfi |
| Bkav | W32.AIDetectVM.malware1 |
| ClamAV | Win.Trojan.Zbot-64721 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.6462cc |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Upatre.HS.gen!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Agent.BALW (B) |
| F-Prot | W32/Upatre.HS.gen!Eldorado |
| F-Secure | Heuristic.HEUR/AGEN.1117597 |
| FireEye | Generic.mg.ce790866462ccc8f |
| Fortinet | W32/Mdrop.AAB!tr |
| GData | Win32.Trojan-Downloader.Upatre.BJ |
| Ikarus | Backdoor.Win32.Androm |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.edzjq |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Lionic | Trojan.Win32.Zbot.lMmI |
| MAX | malware (ai score=85) |
| Malwarebytes | Trojan.Injector |
| McAfee | GenericRXAA-AA!CE790866462C |
| MicroWorld-eScan | Trojan.Agent.BALW |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.cjxpzu |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Generic/HEUR/QVM11.1.B287.Malware.Gen |
| Rising | Downloader.Small!8.B41 (TFE:dGZlOgUqcqQ6nqVYfw) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(2 个事件)
| dead_host | 18.119.154.66:443 |
| dead_host | 3.140.13.188:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-02 20:59:11
PE Imphash
b87535261f3aabcbc0671e73baadce5c
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00008000 | 0x00000000 | 0.0 |
| UPX1 | 0x00009000 | 0x00003000 | 0x00002800 | 7.750771030870659 |
| .rsrc | 0x0000c000 | 0x00003000 | 0x00002c00 | 5.07456226037999 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0000c150 | 0x00002668 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000e7bc | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x0000e7d4 | 0x00000198 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000e970 | 0x0000015a | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library gdi32.dll:
• 0x50eb1c CreateFontIndirectA
Library KERNEL32.DLL:
• 0x50eb24 LoadLibraryA
• 0x50eb28 ExitProcess
• 0x50eb2c GetProcAddress
• 0x50eb30 VirtualProtect
Library user32.dll:
• 0x50eb38 EndPaint
L!This program cannot be run in DOS mode.
^|S^|=
^|I>|h^|+
^|Rich
c,.Y.P/O19v
"8u&7F
IuZw;v;Es"nZG}
KuRGF!u_+
Pf__Y{6s_8b
?%|5tsR^
VdO<m^e
z]qq ~
Ni*gLVK
xJ9uqL
%oMZ7^
uIH</SSD
.f}Dm\t`
<hU(n
` a2Ou
mcnEC3nmD
Jou"kR
+f{~h
tJ^[qg]
ZwV?6NBZ
9C~ tVe
gggNaEv[VR
g>*g|sL%
Tz` ?d
wnK'RIl
g2Z)JxJ
0LY |'"
*goLeB
x78af2z.K
&?+q{CI{
?gKWhT
b6f>6.'!Z
V_45o.
kscdS
h@^:lu
3cppuE-a[P3tepP}1f,
am[Qu(*sA
2ce*Vx i
C2ma/n
<-2ShPsrtWd@@aCm
0(djcHl9s
,2(F"yup2=cc
tst<0xA
2 xcE7l
eo;1s+Wsus7;a
T*lUfJ+
j@h5h=
l@a5m&
@;sy;s
+L{lw@
~uru# 4B
M3@jZM1{ W?
r`E`0)V
I,dr!]v
,m>/Wn^}og@
u _0j(
V4V"lW
La0$vk {
>Rsa C[SXP
"Zpt}=fcj<
(I^wWu
G'1q5/NL(
LIEdc`
CE?ikQ7
hXPt|W
_Ehl<lSVh
B.'c9]e
WUiV%>hK.R
/.M _<
PEpi /SO1
<ckUyj9XrW
rTq|p x'sp
/p/01$
u$<2D>3
"_u9NL
n8tP/D
ctc|uuBQ
jj|j(h6m@
AMY,h!\FBY
_j"h|@,e&JE6}p|*
8hDD;[
h(8vfX=)
u.EPdC
hCE47um=6jz
~$8u3f
o7=>yuJ_H
oP*6[D"X
%Th@dI C
hTVUWa5
h`FzZY
S5Pgd Bru
j<dl{rQ
=^l<uUulq
2xto`uXz
0,aYd\{
QOH{zJ;
V povrK
/mnG@ICW#
P =dO#
thVVjk+
cr eto Rllj
R f`22
Wyb [`
Cu5Mz3
|hZFe4M8&
'arokXbegi
last."
Jib~+:dbutto<wa0
^-nnGP"
CL&d22L&&dl2L
R,tCAjp!ei
_OhJiS
Xpps-"
tAWtsgeu;[chli
#VErTir
bWut@$x
- B^
M'l#PB
t@ _^,#
vus`clt
1EJ2TE
GetLastErrorl
ModuleHand
[kc FA
5essag
Close
Nex)De
rea!t}
ontI.y}{ect
<PGtQui
Upd;Wvvow
ch)B2w;
Trsl8T,B
mEx:Rera.n{
mh*}oy\Loa>
IcgnX4h
j2@.&Sw /8't-mOs2
XPTPSWXaD$j
+ F<e]xq:/
9.OGhaRH
VNvnmf
gdDA;8
lVOUOUOUOUOUOVOVOVOVOVOVOVPXQ_X\VUOVPVPWPTN
wwwsssxxx
dZdZ:-,
- - - - - - - - /"
- .!w- -
- - - - - - - +
- / / / / / / / / / {0!/ / `T/ / / / / / / -
/ 0!0!0!0!0!0!0!1"J=REQD5&1"J=RE0 / 1"1"I<SFSF9*0!0!0!0!0!0!0!/
1"2"2"2"2"2"2"2"1!)
2"3#3#3#-
2#5%5%5%5%5%5%5%4%
2#3#3#3#3#3#3#3#G9H9H9B3A3A2B3B3A2A2A2A2-
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
gdi32.dll
KERNEL32.DLL
user32.dll
CreateFontIndirectA
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
EndPaint
L!This program cannot be run in DOS mode.
W*6D6D6D6)W6D?6D6E6Dd
6D6D6Dd
6DRich6D
`.text
.rdata
@.data
.rdata6
@.rdata4
@.rdata3
@.rdata2
@.rsrc
]U]U@E
]U]UQE
]UQEPh
lUR\Ph
skRpP=
3_^[]U
`fuPMlbACgseLp
kl`dcjcr>qxE'B
k`dicrpxE
K`nndA
pdaeGie@
ourauA
euWmeopEifbtpqxA
XfuMxgtlzK`nCodW
k`dicrpxEA
esnn22
owcv/dg
rvwcmo/dg
z`lco|
qlstJdmA;gnc
Rila/Qhe0JgF6gd
_`pfmo
_snf22
_uPibeuIer
v kgi hn"b
lnKSkd
`5>b>b>bb>b5b
a$a5b>b%b>b5b>b
Cqgb
W6q_hdwD VjV
D F`V~
B*S3_
2-H ]|H g
`q+C~:7yC ]] |] ~ow#W
cX~5NY
Zr^\+,
rAj\Q.W1
HCklFD
/QGCKp@FQ{
?{+cHo
5vrgT `
*QHO6:j)&
eqjNjkv)5`fo
OOaXhp
Ejk)-p\
`y 1ycr
*xj9R3MG ]Y [$z_
(v}55lARB
B~* CD ~
"3CD |
q9G}+C
t;Nd_Q\PQA*)
W{q@hL
1?(S-W
b Q|8f|
a}V#+c@
{W+WOGbHU
g8pC zc(O|j_G
9z |<|Q4q@'|?4zbm`Bzjby}`
Fe>0N6b
*8ryGeM
wy;6>9U
p)#x9x]
NktRRRRRND6PA
ROAjj|S
PPOp~t(L
UNQhfE
Mmo0_x
eW'x'X:xR
NCxjGBC
tc.$`3b
P;sPjm
jR@ eGU~dApTvljXl
mm:o'}*_5
s2gi3c'
Pl_^yTdF+A
A@ Q`
)D{G'c4
^aP3@4
4D$Om2o
AmtfQHd
qT#ibpL#
bpL#?3
]dpVeL
FR@ a
E^3QIm
z0e$wk'|1
'7F3Z|
aA%O|A
u)?83^TAJ
QX`jM^00
U@ yrc
kH zoF
vpH [L
/]{Ec@
yHOW;W
N~^?47
;aC v<xP<Bv:Mb~
a]B=zMe$3q
3ccA$`@
v%>W#Q
x(]Y [
xE(x[ 3q7NCxk 4I;.C
c/3x51
[tbW^Zp
Lyj+u6bH
YL4ABM
V_Q3o@6;M$1Q
'tV5+5P
Esh0Hw6
A6 sf
~C|G `j
Sbq@tSq6PSfq@FtCwt
^l${D .
-7(_/O'
Lo\5j4O;
]dEV.p@F|@
dGsRD`
Ck)1V+
QP6WQ<
AYEo=v
\/(7 yLW
PSlmyPjX
{TV 37
)Qap^#
8d20d
`'SBz^
I D R _ V E R S I O N 1
V S _ V E R S I O N _ I N F O
F i l e I n f o
F F F F 0 4 E 3
F i l e V e r s i o n
2 . 0 . 1 . 7
P r o d u c t V e r s i o n
2 . 0 . 1 . 0
C o m p a n y N a m e
S a n n y L t d .
P r o d u c t N a m e
L o o k F o r
V F i l e I n f o
T r a n s l a t i o n
C : \ U s e r s \ j b a y u e l o \ A p p D a t a \ L o c a l \ T e m p \ R a r $ E X 0 0 . 0 6 0 \ I n v o i c e _ O C T - 0 2 - 2 0 1 3 . e x e
C : \ 1 5 f 7 b 8 4 a 4 c d c b 5 0 2 e d d c 6 5 7 a 7 3 e f a 5 7 4 e 9 2 c e 8 e e 6 c 1 c b d 2 9 4 a f b 7 8 e e 6 8 b 3 4 0 a f
C : \ j d Q T w 6 v 9 . e x e
C : \ S i c l i o 3 q . e x e
C : \ k k U F L u b y . e x e
C : \ D p A A K V 4 u . e x e
C : \ x z s 9 W i J w . e x e
C : \ l m 6 c f 0 B d . e x e
C : \ r A P O i j g M . e x e
C : \ L P t z E t a u . e x e
C : \ c 3 d 3 f f 1 4 f 9 5 b 3 a 8 f 7 7 1 6 d 1 8 c 2 0 0 4 9 8 9 d 4 3 1 d 9 d f e 2 1 c f 3 6 8 e 9 0 d 6 9 9 8 e 3 7 4 0 0 d 8 d
C : \ n 0 S d Z l z y . e x e
C : \ h n g G c o a 0 . e x e
C : \ t t T g X t c a . e x e
C : \ 6 1 q A Q j K W . e x e
C : \ d f f 2 b e 9 2 3 8 b b 5 e 0 2 4 2 6 6 0 8 5 c f 4 d e e d 3 c 3 c 9 a 6 f 6 1 8 b e 1 f 7 2 d 5 c 6 d d 0 b 7 f 8 e d a 3 c 2
C : \ b 5 0 0 6 4 e a 3 e e 9 1 2 8 6 f e 3 3 c 2 f e 0 6 2 5 e 5 7 7 8 f 3 f e e e a c 5 0 7 d 1 e 9 8 8 3 b 7 f f 2 9 0 3 d e 6 c 7
C : \ 0 Y D Y V X 8 K . e x e
C : \ M P m f n s p F . e x e
C : \ n c e 7 c 9 H g . e x e
C : \ H z n 2 w L x p . e x e
C : \ L S s C V y 8 I . e x e
C : \ g w O E U 6 Z z . e x e
C : \ W Q j M y C W V . e x e
C : \ _ o Z 1 X 5 V b . e x e
C : \ D j 9 G D s J S . e x e
C : \ C d p 9 k F O q . e x e
C : \ U O G o y J 1 r . e x e
C : \ 9 n p _ 0 z p F . e x e
C : \ r A L h _ 5 o 6 . e x e
C : \ x V f m q V p E . e x e
C : \ M j D N b u u X . e x e
C : \ F W g N M 5 k V . e x e
C : \ 4 M I G w j O Z . e x e
C : \ 2 e 9 5 b 1 2 a 0 9 e c 8 d 4 9 d 8 e f 2 1 7 2 2 5 a 5 e 1 9 a 3 b 3 1 f e 1 9 6 e 7 a 6 7 9 6 6 8 c 4 6 e 4 7 a b 2 0 5 e a 7
C : \ F 4 1 3 p o N v . e x e
C : \ x a w p _ i q F . e x e
C : \ V I F T a B Y p . e x e
C : \ I U C G d Q t r . e x e
C : \ t 6 m p W Z n U . e x e
C : \ 3 L j l 2 O E J . e x e
C : \ Z R o 1 8 4 a i . e x e
C : \ h v m 8 E c B I . e x e
C : \ N 6 u H V N R U . e x e
C : \ e 9 a 2 b f 8 7 1 5 1 b 2 3 6 b 8 2 b 4 f 8 8 6 e 0 5 5 e 5 0 9 f c a 3 c 3 0 1 4 5 1 e 7 d 5 3 b 6 f e b 8 8 4 2 6 0 e 4 5 4 4
C : \ N 0 j 4 Q r B 2 . e x e
C : \ F B J H m o t D . e x e
C : \ x a H y O I u E . e x e
C : \ c a _ r K a D C . e x e
C : \ h N b p T M V L . e x e
C : \ b G n m o p 1 x . e x e
C : \ D O C U M E ~ 1 \ c u c k o o \ L O C A L S ~ 1 \ T e m p \ a f d 0 d f 9 6 0 7 0 c 0 4 9 8 3 8 0 4 3 8 2 3 c 0 5 6 4 5 f a b 2 1 c 4 3 b 5
C : \ v d A 3 c 9 A t . e x e
C : \ s R V z B X y T . e x e
C : \ u X Q B 8 8 u M . e x e
C : \ n P L L I j 6 F . e x e
C : \ 2 c 0 4 d 7 9 9 2 6 1 6 8 f 9 e f d e 8 3 4 0 6 b 4 a 3 6 1 4 5 6 0 b d f 0 c 2 8 a 8 4 6 0 f 1 7 0 e f b 3 8 1 8 2 7 b 5 6 2 0
C : \ 1 c d 9 a 4 6 8 0 c f 7 1 7 a 7 1 1 9 6 0 c b 3 9 0 0 0 0 b 0 e 3 e 5 2 9 b 9 3 4 8 e 9 e 0 5 7 d 6 3 3 5 d f d 6 c b 9 0 7 9 c
C : \ a f 2 8 4 a 7 7 0 0 6 6 c 0 6 5 d d c e 6 6 2 e 0 1 5 8 f a e f 7 7 5 6 b a f 5 4 f 1 2 a d 3 f 3 e 2 f 6 e 4 c 8 d 6 0 8 2 e 3
C : \ 1 f 8 6 7 0 8 4 7 0 9 e b e 3 7 1 c b 6 2 b c e 9 e 0 c 9 5 b 9 3 0 a d f 5 c b 8 2 3 8 2 0 5 1 9 9 e 6 0 6 b 2 5 6 e 3 0 7 8 4
C : \ U s e r s \ L i s a \ D e s k t o p \ n H T r 4 T T O . e x e
C : \ 6 c 4 5 8 6 d 5 3 f f b 6 c 7 e 3 1 0 c 4 2 3 3 4 c 2 0 a d d 3 5 8 c 5 f c 4 2 9 8 a 3 b 9 0 f 0 f 5 8 c e 6 5 b 7 0 0 9 b a 5
C : \ U s e r s \ L i s a \ D e s k t o p \ Z 1 D A c O a 2 . e x e
C : \ 2 a 0 7 8 5 3 c 7 2 e 6 1 3 a 7 a 1 6 6 7 b a d 0 6 2 9 0 9 0 a 4 6 3 f d 8 5 8 5 d 2 b 9 8 e f b b e d 0 0 1 a c c 8 e 8 a a 2
C : \ c e a 0 9 1 9 3 e c c 1 0 4 c e 9 5 4 f b 4 f b 3 e 5 b 6 8 2 2 3 3 f 3 9 b f 0 c 1 0 9 8 1 4 3 b e 8 c f e 6 6 5 7 0 2 7 9 0 a
C : \ U s e r s \ L i s a \ D e s k t o p \ s q C Z 2 6 w 9 . e x e
C : \ 5 4 2 e a d d 8 4 f 2 9 a 1 9 2 d 1 b b 5 1 f 1 3 6 f 7 7 1 7 f 6 9 8 0 2 f c 1 d c 0 7 9 7 e b 9 3 f 2 d d 2 7 0 2 2 8 e 6 0 0
C : \ m S f P q z w b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ M 8 N i 8 C j b . e x e
C : \ 0 3 6 0 d d 1 5 1 f 3 0 d f f 8 8 f 9 1 b e b 1 5 1 4 d a e 5 f c d a d 1 8 4 2 1 7 0 e 5 1 e 6 b 5 e 7 6 3 c e 8 1 7 7 e a 1 7
C : \ e 0 c f 4 5 5 b a 2 5 e 4 0 7 4 4 5 1 7 2 f 5 e c a 4 4 9 5 d 8 c 6 c 1 9 b 4 2 a d e 5 8 6 1 4 b 6 6 3 6 6 6 8 3 e c c 3 c 8 6
C : \ U s e r s \ L i s a \ D e s k t o p \ a L F y w O e f . e x e
C : \ 7 s p e E H w d . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ x 0 S T j B l x . e x e
C : \ H 4 U R o H N S . e x e
C : \ f 9 4 a e 2 a 4 8 8 e 3 0 3 8 7 1 c 6 c e 0 2 b 0 0 9 4 7 2 7 1 2 9 2 4 4 f 5 d f 0 1 3 4 3 2 b a 0 5 9 0 0 9 2 1 5 6 8 0 9 b f
C : \ U s e r s \ L i s a \ D e s k t o p \ i 8 K R J v W P . e x e
C : \ 9 e I o X V _ c . e x e
C : \ c a 8 c 9 f 0 0 f e 5 8 a 2 d 7 d 4 5 8 d 9 3 0 1 9 8 2 e b 5 a 1 6 f 2 3 e c f a 0 b 7 6 4 e 6 3 b b c c f e 1 2 4 7 c 6 3 0 c
C : \ a c d a 1 6 b 2 7 6 4 6 6 f 3 7 4 e 0 b 2 d 4 7 3 f c e 2 b 4 0 0 d f b b f 8 e c 2 0 f 5 2 d f c 7 9 3 7 f 8 e f 1 4 8 2 7 3 f
C : \ e H W i H k 6 B . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ I K A u 6 Q k t . e x e
C : \ e 6 L C Q k t 9 . e x e
C : \ 5 7 9 9 f b 9 8 f 0 9 0 0 7 a a 9 6 8 d d 7 9 2 7 4 4 8 4 d 3 5 b f d a b c 9 e a b 3 0 5 d 6 2 a c 0 d c 4 9 a 0 3 e b d c f 9
C : \ 7 e 1 c 2 4 9 8 0 4 6 0 6 2 d e 5 8 b 6 1 3 c b 5 2 c e 5 3 4 4 d 0 5 1 2 4 1 d 3 6 1 0 e b 8 4 5 d f f 7 e a b 5 9 5 2 5 4 c 2
C : \ f 3 f 7 c f c 3 d 2 7 2 3 3 4 2 9 2 d d 8 0 b 6 f f f 7 7 2 1 0 4 e 8 4 e 6 e 6 4 c 1 1 a 6 6 6 7 9 2 4 8 6 0 8 3 5 2 f 2 0 c 1
C : \ h e r e u X k u . e x e
C : \ 3 e 8 d 4 4 6 9 4 8 7 4 1 e 5 5 8 a e 8 f 2 2 b 8 2 a 6 d 3 0 0 b 4 2 c 6 b 8 d 7 8 2 9 5 2 b 6 2 6 1 d 5 4 5 5 2 a 9 8 c e c 3
C : \ 9 7 5 8 1 3 a 8 c d 6 d 3 0 5 9 d d e 1 c b 9 b 6 e c b c b 5 6 5 9 1 1 5 1 0 5 9 a 0 0 7 f 4 9 a 2 4 8 7 9 1 e d 8 3 7 7 f 1 5
C : \ b d c 9 0 2 8 c 7 d c 0 8 5 1 4 c 1 c a 5 d 7 3 c 7 2 2 4 b 0 b c b a 7 f f 1 7 3 8 9 d 8 b 5 9 9 2 c 3 6 2 6 1 0 5 7 3 f b e 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ 7 b 3 1 f 1 b 0 d f 6 3 6 3 4 d e 4 1 3 b 4 a 0 9 0 1 3 f 6 8 7 e 3 9 2 2 8 f b 1 a 5 a d c f 4 d f 4 d 8 1 4 0 d 3 9 4 a a 9 6
C : \ k x n b d s 8 t . e x e
C : \ f 3 d 2 3 7 6 0 f 2 7 b e c 1 f 7 a 9 2 d 9 2 7 e 0 a f 4 7 d c 3 6 d 5 c 8 2 a 9 3 2 b e e 5 a e c b 4 1 1 0 f c d 1 a 0 c 5 4
C : \ 6 4 f 0 d d 0 f e 8 2 1 7 f f 5 a f a 3 2 1 e e 9 0 8 8 6 8 1 f 8 d 9 0 3 8 c d f 8 5 5 d 6 2 0 3 5 1 d 6 7 2 b 8 4 f e 6 9 7 0
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ c a e f 6 a f 1 b 4 c b 1 b b 9 f 1 b 9 b 2 0 8 6 2 a d f 0 9 f b f c 1 9 7 4 f e 7 6 d 5 a a 8 a 5 f 3 e d f 3 5 d 0 2 3 7 f e . e x e
C : \ B W 4 I s e 4 z . e x e
C : \ 4 f f c c 6 8 a d 0 0 7 4 8 2 c 2 c 6 0 a f 2 1 4 1 6 0 e 0 0 1 e f 8 6 b a 6 b 8 5 f 4 d 7 c 6 9 f a f 6 6 b c 0 a 5 5 2 3 8 b
C : \ e 6 3 2 7 e 4 6 e 8 6 2 9 1 0 7 9 1 6 2 6 8 d d 4 c e b 2 4 8 7 3 2 b e 7 a 6 4 f 4 8 1 7 a 0 8 4 a b 0 a 5 c d b 8 1 7 c 9 6 9
C : \ U R B P G f L J . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 6 C O 2 q n N V . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ m S R w 7 K E R . e x e
C : \ 0 2 4 e 2 a a a 2 b b 9 1 c e 0 c 4 4 d 5 1 1 a 2 8 f a c 5 5 c e e a 1 b 0 f 1 6 f d c b 0 9 5 9 1 b 0 f c 7 4 6 4 2 8 4 9 4 f
C : \ 3 3 9 e c 9 1 5 2 8 c f 4 7 b 4 4 9 9 c 0 c 1 4 b b f 1 0 6 d f 5 7 6 1 8 1 6 2 c 8 a 3 9 6 e e e 8 0 3 e f 3 a 8 9 2 d 7 a 9 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ K s l G h R x P . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 6 g e I W a X i . e x e
C : \ e 3 0 5 8 1 1 6 5 9 9 c 8 2 6 d a e a 6 e 5 8 9 d 1 b 1 2 7 5 7 2 1 4 8 6 e e a 0 1 e e 2 6 3 1 a 4 c b 0 7 d 9 a 5 c d 4 4 e 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ e f e 9 0 c 3 a b f 2 b c f 3 0 9 b c 6 2 6 0 7 6 a 1 b 5 7 a a e 3 6 3 5 3 a 5 f 3 7 5 1 b a 3 3 7 d 2 3 7 8 2 8 8 9 c c f b c
C : \ 0 5 8 e 9 9 d 8 c 9 9 b f f f 0 d 5 d 1 9 a 9 e 5 5 6 2 b a 0 4 1 a 2 a f f 6 0 c 9 2 5 1 4 b e 7 b 5 8 f b 3 c 7 4 0 1 9 f f e
C : \ 7 d c 3 e e b 5 a 1 f 1 d a f d e 0 5 3 9 6 0 4 6 b 0 7 1 6 6 4 8 5 e 4 2 6 e e a 6 d 8 2 3 5 4 d e 2 5 5 4 f 1 8 3 3 2 c a a 2
C : \ r 0 V 9 R R L F . e x e
C : \ 6 2 f 7 8 f 6 3 1 7 9 5 7 3 a a 3 f d 9 7 e e b b 5 0 9 c 3 8 e 2 4 a d f e 8 0 3 c 4 8 1 4 e 3 d b 4 6 1 b 3 f d 2 0 b 2 4 5 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s D 6 N Y z 6 E . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 7 f c 0 5 7 6 1 a f 7 0 5 9 5 5 c e 8 0 2 8 c 0 c 8 3 f e 3 c f 7 5 5 f 4 1 4 d 1 2 b 4 d 9 c b a c 2 d 2 6 c a 8 f f 6 4 f f 5
C : \ k p K 7 Y T e z . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ R q 2 7 v F u R . e x e
c : \ t a s k \ 7 A D C C 8 6 8 A C B 2 8 4 A C 3 F 2 D 8 D B C 3 7 9 7 E F 3 A . e x e
c : \ t a s k \ E A F 3 4 F 5 D E 9 7 2 D 4 5 6 0 4 6 B 9 2 D C C C B B 0 E D 9 . e x e
C : \ e 4 7 1 7 2 f f 6 f a c 5 0 3 2 f 2 b 2 0 f a e b a c e 4 8 c 7 3 f b 7 c 5 2 9 d 1 a 4 8 f 4 9 2 f d 9 4 a 3 9 e 3 7 6 f 2 3 7
C : \ K 8 U f d 8 g 8 . e x e
C : \ a 6 7 e 2 1 b 3 e 9 0 3 a 8 f 0 c 5 3 8 8 7 8 2 d 7 3 c 2 d 1 0 0 c 1 c 6 8 9 b d 7 7 3 2 a 6 5 0 b 6 4 2 5 0 0 3 1 3 b 8 c b 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ 4 f 3 3 9 8 6 6 e 2 e c 2 5 6 5 e a 2 9 d 7 9 2 0 3 4 0 2 4 8 9 d 6 d a 7 3 5 c 2 2 2 3 8 1 2 a f 8 3 1 2 7 2 9 d 9 d 4 a d 3 2
C : \ d d 1 8 3 f 0 0 b f 7 b a b 8 8 f 8 c d a 7 5 3 8 f 2 3 e 9 0 a 4 4 3 1 4 6 b f a 3 6 f c 4 c 2 4 d 1 4 3 a 3 7 f 5 1 0 f 1 7 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ 0 Q B V P L S O . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ y h U T Z x 3 1 . e x e
C : \ 1 b b e c 6 f 3 c 5 9 8 c 7 3 9 8 1 8 8 f d 0 6 2 c a 7 8 e 0 c 6 1 5 c 7 5 4 7 d 2 e b 5 1 2 6 8 3 2 6 0 2 5 a 7 d 6 9 3 f 7 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ a 5 8 4 5 9 c 8 7 e f 6 5 6 4 3 c a f 7 7 e 1 7 a c d 2 e 4 0 a b a 8 1 0 5 f a 3 9 e b c 4 6 d 8 d 2 5 3 0 f a a 5 9 b b 6 0 8
C : \ e e c b 9 b b 7 d d 8 9 0 8 4 c 3 c 4 2 5 1 b e 5 d 6 5 8 1 a 8 a 7 7 f e 7 3 f 2 6 6 4 9 f e 2 0 9 8 3 3 d b 1 7 3 1 7 a 6 5 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ n 2 f V Q u h s . e x e
C : \ 2 0 2 2 8 a a 8 e d b 1 1 f c e 4 9 d e 8 b 5 4 b 2 f c c d 2 2 7 b f 9 1 2 9 d b 7 8 d 0 8 6 b 9 e 6 5 3 f 3 0 0 3 6 5 a f 7 2
C : \ 3 4 5 1 7 9 6 7 f 4 b 6 9 8 5 0 b c 6 a d c c c a b 8 d 4 5 d 8 1 7 8 6 9 1 3 1 9 8 e 9 2 a e 9 d 8 3 3 b 7 1 5 a 9 d 6 9 8 8 b
C : \ b 5 c 2 5 e 7 2 b 0 9 7 c 9 f 5 0 4 e a 1 a e d 3 7 9 7 2 5 c d a 2 8 3 b 7 d a 6 c 4 5 8 1 a c f f 4 b 3 4 9 6 5 f b 9 d e 5 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ f 8 5 5 7 5 b f c 3 d b 2 8 e 8 f b f 1 0 2 5 4 a 5 b a 0 0 8 2 8 6 b 7 4 6 0 b 2 b 4 9 8 3 0 0 9 3 6 c 4 2 6 b a 8 3 4 8 4 a b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ 5 3 3 5 8 4 d 1 7 0 f 8 7 a 5 9 1 7 8 a 9 c 6 e f d 1 e 0 1 3 e c b 2 f 8 e 1 4 3 9 0 e b a 4 8 6 d e a f f e 9 4 3 7 5 a 6 c 4
C : \ U s e r s \ r . v u l t \ A p p D a t a \ L o c a l \ T e m p \ e b 1 d c a b 7 e 8 8 b e 9 6 3 a 5 5 1 6 7 4 4 9 e 8 5 5 8 3 e . e x e
C : \ j I 0 3 O u o L . e x e
C : \ 1 9 7 5 2 1 4 1 c f 4 9 4 2 6 9 c e c 2 f 5 3 b 3 0 e 0 0 e 7 9 0 1 d d 4 c 3 8 7 a d 0 3 9 0 b e 0 f 6 d 6 c 8 c a 1 a 6 e f c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ a s i h . p e 3 2
C : \ 2 y Q y a X i P . e x e
Process Tree
-
033c3a3a166bc90017c00bdc68dde68d812d8357ec05675e64e78fb7da69229c.exe (1612)
"C:\Users\Administrator\AppData\Local\Temp\033c3a3a166bc90017c00bdc68dde68d812d8357ec05675e64e78fb7da69229c.exe"
- asih.exe (616) "C:\Users\ADMINI~1\AppData\Local\Temp\asih.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 18.119.154.66 |
| 3.140.13.188 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| emrlogistics.com |
CNAME traff-6.hugedomains.com
A 3.140.13.188 CNAME hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com A 18.119.154.66 |
3.140.13.188 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | be97e28777aa044b_asih.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\asih.exe |
| Size | 89.2KB |
| Processes | 1612 (033c3a3a166bc90017c00bdc68dde68d812d8357ec05675e64e78fb7da69229c.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 713ffa2568e605f3e48b8cc199e8a7be |
| SHA1 | db6bdf1b9b008f980bf6c811fde2d90a7eb95d49 |
| SHA256 | be97e28777aa044b9d7095d47423d8a41ded7c4a914672de1d7ec0f7cbd4259b |
| CRC32 | BFA31E8E |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.