SmartHawk

10.2

0-day

63 个模型检测该样本为恶意！

重新分析

下载样本

6141592a54730e4dc49205165c4b4c11ea62df8f236420e79d78cff20a82cda3

e3c1967937efa13e4b82476cdb09a5a7.exe

分析耗时

136s

最近分析

文件大小

311.0KB

静态报毒动态报毒 100% A + MAL AI SCORE=80 AIDETECTVM BSCOPE CHAPAK CNAR COINS CONFIDENCE CVE-2020-1672 CVE20167255 ELDORADO FDOUER FILECODER GANDCRAB GANDCRYPT GDE@7OO149 GENASA GENCIRC GENERICRXFR GENETIC GENKRYPTIK HIGH CONFIDENCE MALICIOUS PE MALWARE1 MALWAREX QVM10 RANSOMEWARE SCORE SI75QE8PLBY SMJS2 STATIC AI TSGENERIC TYX@AWFSOBI UNSAFE XEJY87AREAP ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Ransom:Win32/GandCrab.8a4eea92	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Tencent	Malware.Win32.Gencirc.10b9d113	20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565
McAfee	GenericRXFR-KG!E3C1967937EF	20201211	6.0.6.653

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951380.92175 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619951387.01475 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951380.84375 IsDebuggerPresent		failed	0	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619951386.95275 CryptGenKey	crypto_handle: 0x018a2648 algorithm_identifier: 0x0000a400 (CALG_RSA_KEYX) provider_handle: 0x018a0dd0 flags: 134217729 key:	success	1
1619951386.95275 CryptExportKey	crypto_handle: 0x018a2648 crypto_export_handle: 0x00000000 buffer: ¤RSA1çÇCÀAì¢O\|0±ÔõÎùö2B;Ñ½#kÃ]Ç²Ó÷ºxUz6ëïûM;/ ">Ó¶' §y&ï\7Ëg þÜ³%`¡4=(2ØE9T.0ûÁ ²À)ÁfÍ.!Gt£ÉDoËEgÔëÂ´·«A$·M\|¡×<ÐæJ(MéhjvCgÏF8 ü¦]!²È¤1qfcI[±dÞR¬'9¬w]OØöêù÷SRE±¢DõUàøò(Äu¼øG££Æs÷7ÅåãÑ\3Tó¥ìë=¤Ë blob_type: 6 flags: 0	success	1
1619951386.95275 CryptExportKey	crypto_handle: 0x018a2648 crypto_export_handle: 0x00000000 buffer: ¤RSA2çÇCÀAì¢O\|0±ÔõÎùö2B;Ñ½#kÃ]Ç²Ó÷ºxUz6ëïûM;/ ">Ó¶' §y&ï\7Ëg þÜ³%`¡4=(2ØE9T.0ûÁ ²À)ÁfÍ.!Gt£ÉDoËEgÔëÂ´·«A$·M\|¡×<ÐæJ(MéhjvCgÏF8 ü¦]!²È¤1qfcI[±dÞR¬'9¬w]OØöêù÷SRE±¢DõUàøò(Äu¼øG££Æs÷7ÅåãÑ\3Tó¥ìë=¤Ë'%í+Y»ÇWÁ_ÏèÖþÓ$w(-4¿@£R#UhLÜªÉúìµGë3õþ¼fdrÀ;IWTóÊ"{à½¡æÈ8Dµe1¡ì HB·-7ì§¡°wåyÕ$³º8 KýFÒt$êD8èAZè¶^áPðvlÆæµ´5D+vâ¨é¡±YSnÄ^D£¯¶YÈrö3¾cPúÄÕ(jvÞ%ÅOì}ÖÑÅ $åZ¶¦Ø6W¥çóB>¬7À/ßVf0°¬üã?»ëôN³ke,ê§#XÞSÍu§à_èLT4 çÊ)½U±.îüÍ#¤Tß,£®ýGîFz= %ÓÇK?&6ÙâPv¤Æ·ÌLîÒ&nÂéf W¸%ZÕ¹¹&^[·ÿí4q~AàXÊ$ zý¥¯ëvá$j1Q{ãA)2K ¹¡$oOiËhüFÓ°««Gçÿ}w%ZL¥H÷!IwX!@Ð[É²ÁÎµ yAÿ}gaÐh·Áø2¶ÊñúîyÞÛò pv;ÙVvn"'ìçd\0ÒÓnø¶(¦"%ÓÙô¶¥oF´NÑR[fÑ Öº+S7 lgÿ,1ñC½ÛOuQ7ý¦KõI²3OõEKîÂiåD&c³Åÿo?QÇM'ùjÎ@ÇÔg¬®}µrZ(jXèèïÖO±ûM ýÂ)àõr2"(!Üu¹òp8! ¿W gJ¨³¢f'IjÛßò;âë<ÜÑE³¬dñë·xV¹ÝÎo4Q»,I9eÈáGä¿ênlJ7¿ÕøV/\ÎÎÙä'~³Í,\"ÿ¥YµÌ"µëß1ÛÇo>èL§WÓqöSWSc=¢q*®gnÏKô©»P1I¸Ö-»lf×÷û¢Á``£>~w 4=£Lëî·Th,uJÈÚ¨íxäq:YzÓô>ç§¯³C¿D½ÓÊì9HÓA²gUy¼÷ýôÇ§ÇnõçIn]õÅkuLÆÉ~¿xtÐ [ôUE blob_type: 7 flags: 0	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619968121.601 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

DJQKUWWUB

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:778162340&cup2hreq=62463be4d7e408d35b96c0a1fb779c7fac8b9637395e6575898ac51d2211e1cb

Performs some HTTP requests (5 个事件)

request	GET http://carder.bit/
request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619939053&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=96909c0f7cc7c8af&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619939053&mv=m
request	POST https://update.googleapis.com/service/update2?cup2key=10:778162340&cup2hreq=62463be4d7e408d35b96c0a1fb779c7fac8b9637395e6575898ac51d2211e1cb

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:778162340&cup2hreq=62463be4d7e408d35b96c0a1fb779c7fac8b9637395e6575898ac51d2211e1cb

Resolves a suspicious Top Level Domain (TLD) (2 个事件)

domain	ns1.wowservers.ru				description	Russian Federation domain TLD
domain	ns2.wowservers.ru				description	Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (20 个事件)

Time & API	Arguments	Status
1619951380.85875 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 110592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01850000	success
1619951380.92175 NtProtectVirtualMemory	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 180224 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619951382.46875 NtProtectVirtualMemory	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 81920 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00414000	success
1619951382.46875 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 94208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01970000	success
1619951382.57775 NtProtectVirtualMemory	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 81920 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00414000	success
1619951383.57775 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000b0000	success
1619951383.57775 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000f0000	success
1619951383.63975 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000a0000	success
1619951383.63975 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00170000	success
1619951383.68675 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01a50000	success
1619951383.68675 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01a00000	success
1619951383.68675 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00110000	success
1619951383.68675 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00120000	success
1619951387.60875 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x03f10000	success
1619951387.60875 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x03f20000	success
1619951391.29675 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x03f10000	success
1619951391.29675 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x047d0000	success
1619951391.31175 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x047f0000	success
1619951391.31175 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x047f0000	success
1619951391.31175 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x04ab0000	success

A process attempted to delay the analysis task. (1 个事件)

description

e3c1967937efa13e4b82476cdb09a5a7.exe tried to sleep 148 seconds, actually delayed analysis time by 148 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951387.01475 GetDiskFreeSpaceW	root_path: C:\ sectors_per_cluster: 8 number_of_free_clusters: 4787316 total_number_of_clusters: 8362495 bytes_per_sector: 512	success	1	0

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\hvondr.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951387.88975 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.8370978624432945

section

{'size_of_data': '0x0001d200', 'virtual_address': '0x0104a000', 'entropy': 7.8370978624432945, 'name': '.rsrc', 'virtual_size': '0x0001d02c'}

description

A section with a high entropy has been found

entropy

0.3758064516129032

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (4 个事件)

cmdline	nslookup carder.bit ns1.wowservers.ru
cmdline	nslookup carder.bit ns2.wowservers.ru
cmdline	nslookup ransomware.bit ns2.wowservers.ru
cmdline	nslookup ransomware.bit ns1.wowservers.ru

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Checks the CPU name from registry, possibly for anti-virtualization (1 个事件)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Installs itself for autorun at Windows startup (1 个事件)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\memkjxgixgd

reg_value

"C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\hvondr.exe"

File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Ransom.GandCrab.Gen.2
FireEye	Generic.mg.e3c1967937efa13e
CAT-QuickHeal	Trojan.Chapak.ZZ6
ALYac	Trojan.Ransom.GandCrab.Gen.2
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
SUPERAntiSpyware	Ransom.GandCrab/Variant
Sangfor	Malware
K7AntiVirus	Trojan ( 00533b5d1 )
Alibaba	Ransom:Win32/GandCrab.8a4eea92
K7GW	Trojan ( 00533b5d1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Ransom.GandCrab.Gen.2
BitDefenderTheta	Gen:NN.ZexaF.34670.tyX@aWfSOBi
Cyren	W32/S-ba9a9755!Eldorado
Symantec	Packed.Generic.525
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Gandcrab-6520432-4
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Ransom.GandCrab.Gen.2
NANO-Antivirus	Trojan.Win32.Encoder.fdouer
ViRobot	Trojan.Win32.GandCrab.Gen.A
Tencent	Malware.Win32.Gencirc.10b9d113
Ad-Aware	Trojan.Ransom.GandCrab.Gen.2
TACHYON	Ransom/W32.GandCrab
Sophos	ML/PE-A + Mal/Agent-AUL
Comodo	TrojWare.Win32.Chapak.GDE@7oo149
F-Secure	Trojan.TR/FileCoder.FB
DrWeb	Trojan.Encoder.24384
Zillya	Trojan.Coins.Win32.168
TrendMicro	Ransom_GANDCRAB.SMJS2
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Trojan.Ransom.GandCrab.Gen.2 (B)
Ikarus	Trojan-Ransom.GandCrab
Jiangmin	Trojan.GandCrypt.di
Avira	TR/FileCoder.FB
Antiy-AVL	Trojan/Win32.TSGeneric
Microsoft	Ransom:Win32/GandCrab.AE
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.Ransom.GandCrab.Gen.2
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Gandcrab.Exp
Acronis	suspicious
McAfee	GenericRXFR-KG!E3C1967937EF
MAX	malware (ai score=80)
VBA32	BScope.TrojanRansom.GandCrypt

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.27.142:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2018-06-05 10:34:55

Imports

Library KERNEL32.dll:

• 0x420000 VirtualAlloc

• 0x420004 GetCurrentProcess

• 0x420008 RaiseException

• 0x42000c GetLastError

• 0x420010 ResetEvent

• 0x420014 PulseEvent

• 0x420018 GetNativeSystemInfo

• 0x42001c lstrlenA

• 0x420020 lstrlenW

• 0x420024 LoadLibraryW

• 0x420028 FindAtomA

• 0x42002c GetComputerNameW

• 0x420030 GetVersionExA

• 0x420034 FindFirstVolumeMountPointW

• 0x420038 SetThreadLocale

• 0x42003c SetConsoleMode

• 0x420040 AddConsoleAliasA

• 0x420044 WriteConsoleW

• 0x420048 GetConsoleCP

• 0x42004c FlushFileBuffers

• 0x420050 HeapSize

• 0x420054 SetFilePointerEx

• 0x420058 SetStdHandle

• 0x42005c FreeEnvironmentStringsW

• 0x420060 GetEnvironmentStringsW

• 0x420064 GetCommandLineW

• 0x420068 GetCommandLineA

• 0x42006c GetOEMCP

• 0x420070 IsValidCodePage

• 0x420074 WideCharToMultiByte

• 0x420078 EnterCriticalSection

• 0x42007c LeaveCriticalSection

• 0x420080 DeleteCriticalSection

• 0x420084 MultiByteToWideChar

• 0x420088 EncodePointer

• 0x42008c DecodePointer

• 0x420090 SetLastError

• 0x420094 InitializeCriticalSectionAndSpinCount

• 0x420098 CreateEventW

• 0x42009c TlsAlloc

• 0x4200a0 TlsGetValue

• 0x4200a4 TlsSetValue

• 0x4200a8 TlsFree

• 0x4200ac GetSystemTimeAsFileTime

• 0x4200b0 GetModuleHandleW

• 0x4200b4 GetProcAddress

• 0x4200b8 LCMapStringW

• 0x4200bc GetLocaleInfoW

• 0x4200c0 GetStringTypeW

• 0x4200c4 GetCPInfo

• 0x4200c8 CloseHandle

• 0x4200cc SetEvent

• 0x4200d0 WaitForSingleObjectEx

• 0x4200d4 IsProcessorFeaturePresent

• 0x4200d8 IsDebuggerPresent

• 0x4200dc UnhandledExceptionFilter

• 0x4200e0 SetUnhandledExceptionFilter

• 0x4200e4 GetStartupInfoW

• 0x4200e8 QueryPerformanceCounter

• 0x4200ec GetCurrentProcessId

• 0x4200f0 GetCurrentThreadId

• 0x4200f4 InitializeSListHead

• 0x4200f8 TerminateProcess

• 0x4200fc RtlUnwind

• 0x420100 FreeLibrary

• 0x420104 LoadLibraryExW

• 0x420108 HeapAlloc

• 0x42010c HeapFree

• 0x420110 HeapReAlloc

• 0x420114 ExitProcess

• 0x420118 GetModuleHandleExW

• 0x42011c GetModuleFileNameA

• 0x420120 GetStdHandle

• 0x420124 WriteFile

• 0x420128 GetACP

• 0x42012c ReadFile

• 0x420130 GetConsoleMode

• 0x420134 ReadConsoleW

• 0x420138 GetFileType

• 0x42013c IsValidLocale

• 0x420140 GetUserDefaultLCID

• 0x420144 EnumSystemLocalesW

• 0x420148 GetProcessHeap

• 0x42014c FindClose

• 0x420150 FindFirstFileExA

• 0x420154 FindNextFileA

• 0x420158 CreateFileW

Library USER32.dll:

• 0x420160 DrawEdge

• 0x420164 DefFrameProcW

• 0x420168 DestroyCursor

• 0x42016c CreateCursor

• 0x420170 LoadCursorFromFileW

• 0x420174 SetWindowsHookW

• 0x420178 UpdateWindow

• 0x42017c SetMenuInfo

• 0x420180 DeleteMenu

• 0x420184 LoadMenuW

• 0x420188 MapVirtualKeyA

• 0x42018c ReplyMessage

• 0x420190 PostMessageW

• 0x420194 DrawCaption

Library ole32.dll:

• 0x42019c OleLoadFromStream

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
carder.bit
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
ns2.wowservers.ru
redirector.gvt1.com	A 203.208.41.33	203.208.41.97
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
114.114.114.114.in-addr.arpa	PTR public1.114dns.com
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142 A 172.217.160.78	172.217.160.78
ransomware.bit
update.googleapis.com	A 203.208.40.34	203.208.41.34
carder.bit
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
ns1.wowservers.ru
ipv4bot.whatismyipaddress.com	A 66.171.248.178	66.171.248.178
teredo.ipv6.microsoft.com		127.0.0.1
ransomware.bit

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49327	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49329	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49316	203.208.40.34 update.googleapis.com	443
192.168.56.101	49326	203.208.41.33 redirector.gvt1.com	80
192.168.56.101	49175	66.171.248.178 ipv4bot.whatismyipaddress.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53211	114.114.114.114	53
192.168.56.101	53212	114.114.114.114	53
192.168.56.101	53213	114.114.114.114	53
192.168.56.101	53214	114.114.114.114	53
192.168.56.101	53215	114.114.114.114	53
192.168.56.101	53216	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	53381	114.114.114.114	53
192.168.56.101	53382	114.114.114.114	53
192.168.56.101	53383	114.114.114.114	53
192.168.56.101	53384	114.114.114.114	53
192.168.56.101	53385	114.114.114.114	53
192.168.56.101	54179	114.114.114.114	53
192.168.56.101	54180	114.114.114.114	53
192.168.56.101	54181	114.114.114.114	53
192.168.56.101	54182	114.114.114.114	53
192.168.56.101	54183	114.114.114.114	53
192.168.56.101	54184	114.114.114.114	53

HTTP & HTTPS Requests

URI	Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://carder.bit/	GET / HTTP/1.1 Host: carder.bit User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=96909c0f7cc7c8af&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619939053&mv=m	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=96909c0f7cc7c8af&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619939053&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619939053&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619939053&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.