Summary

096103be60d25ea47f0240b5cacf3b7c7dd6a751ac283a0dbdaf2075e5e52724

File 096103be60d25ea47f0240b5cacf3b7c7dd6a751ac283a0dbdaf2075e5e52724

Summary
Download Resubmit sample

Size 2.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 67d6bb4de69c44b296aac22dd87513d2
SHA1 363739567ed65f88287af64f775ccc529177cc02
SHA256 096103be60d25ea47f0240b5cacf3b7c7dd6a751ac283a0dbdaf2075e5e52724
SHA512
e42dbee9bc0603231a65636e67da2a934433b7f96cb5de0f758c959fd2d7b7c5a0a9e9099dee6fb7d4fb05bbba8f02c1214f37fd574a00b4c464bbdd1b3e1b0f
CRC32 561A5C94
ssdeep None
PDB Path c:\DevelBuildSlave\QuickStableVS\build\REALbasic\REALbasic Visual Studio\release\X86RunHoudini.pdb
Yara
  • Check_OutputDebugStringA_iat - (no description)
  • anti_dbg - Checks if being debugged
  • network_udp_sock - Communications over UDP network
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS
  • screenshot - Take screenshot
  • keylogger - Run a keylogger
  • win_mutex - Create or check mutex
  • win_registry - Affect system registries

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE April 12, 2025, 6:48 p.m. April 12, 2025, 6:56 p.m. 456 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-04-11 01:31:03,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpf7a_02
2025-04-11 01:31:03,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\AIEufaMmVHXXPEUNFXGAqMkTWOXpaOg
2025-04-11 01:31:03,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\jtwXSzJlaEplAxguGy
2025-04-11 01:31:03,328 [analyzer] DEBUG: Started auxiliary module Curtain
2025-04-11 01:31:03,328 [analyzer] DEBUG: Started auxiliary module DbgView
2025-04-11 01:31:03,812 [analyzer] DEBUG: Started auxiliary module Disguise
2025-04-11 01:31:04,062 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-04-11 01:31:04,062 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-04-11 01:31:04,062 [analyzer] DEBUG: Started auxiliary module Human
2025-04-11 01:31:04,062 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-04-11 01:31:04,062 [analyzer] DEBUG: Started auxiliary module Reboot
2025-04-11 01:31:04,280 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-04-11 01:31:04,280 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-04-11 01:31:04,296 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-04-11 01:31:04,296 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-04-11 01:31:04,515 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\096103be60d25ea47f0240b5cacf3b7c7dd6a751ac283a0dbdaf2075e5e52724.exe' with arguments '' and pid 1064
2025-04-11 01:31:04,750 [analyzer] DEBUG: Loaded monitor into process with pid 1064
2025-04-11 01:31:15,515 [analyzer] INFO: Process with pid 1064 has terminated
2025-04-11 01:31:15,515 [analyzer] INFO: Process list is empty, terminating analysis.
2025-04-11 01:31:16,733 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-04-11 01:31:16,733 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-04-12 18:48:58,295 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:48:59,442 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:00,651 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:01,725 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:02,812 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:03,880 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:04,952 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:06,031 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:07,108 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:08,180 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:09,236 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:10,792 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:11,863 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:13,017 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:14,125 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:15,210 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:16,290 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:17,381 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:18,619 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:19,677 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:20,865 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:21,946 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:23,039 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:24,117 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:25,200 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:26,280 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:27,371 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:28,496 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:29,578 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:30,661 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:31,738 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:32,804 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:33,874 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:34,952 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:36,003 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:37,046 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:38,202 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:39,247 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:40,673 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:41,740 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:42,793 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:43,829 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:44,862 [cuckoo.core.scheduler] DEBUG: Task #6268162: no machine available yet
2025-04-12 18:49:45,903 [cuckoo.core.scheduler] INFO: Task #6268162: acquired machine win7x6427 (label=win7x6427)
2025-04-12 18:49:45,904 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.227 for task #6268162
2025-04-12 18:49:46,225 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1642195 (interface=vboxnet0, host=192.168.168.227)
2025-04-12 18:49:51,406 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6427
2025-04-12 18:49:51,983 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6427 to vmcloak
2025-04-12 18:52:29,850 [cuckoo.core.guest] INFO: Starting analysis #6268162 on guest (id=win7x6427, ip=192.168.168.227)
2025-04-12 18:52:30,858 [cuckoo.core.guest] DEBUG: win7x6427: not ready yet
2025-04-12 18:52:35,894 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6427, ip=192.168.168.227)
2025-04-12 18:52:36,206 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6427, ip=192.168.168.227, monitor=latest, size=6660546)
2025-04-12 18:52:38,618 [cuckoo.core.resultserver] DEBUG: Task #6268162: live log analysis.log initialized.
2025-04-12 18:52:39,550 [cuckoo.core.resultserver] DEBUG: Task #6268162 is sending a BSON stream
2025-04-12 18:52:40,205 [cuckoo.core.resultserver] DEBUG: Task #6268162 is sending a BSON stream
2025-04-12 18:52:40,985 [cuckoo.core.resultserver] DEBUG: Task #6268162: File upload for 'shots/0001.jpg'
2025-04-12 18:52:41,006 [cuckoo.core.resultserver] DEBUG: Task #6268162 uploaded file length: 133455
2025-04-12 18:52:52,193 [cuckoo.core.resultserver] DEBUG: Task #6268162: File upload for 'curtain/1744327876.59.curtain.log'
2025-04-12 18:52:52,210 [cuckoo.core.resultserver] DEBUG: Task #6268162 uploaded file length: 36
2025-04-12 18:52:52,281 [cuckoo.core.resultserver] DEBUG: Task #6268162: File upload for 'sysmon/1744327876.72.sysmon.xml'
2025-04-12 18:52:52,290 [cuckoo.core.resultserver] DEBUG: Task #6268162 uploaded file length: 489378
2025-04-12 18:52:52,414 [cuckoo.core.resultserver] DEBUG: Task #6268162 had connection reset for <Context for LOG>
2025-04-12 18:52:53,457 [cuckoo.core.guest] INFO: win7x6427: analysis completed successfully
2025-04-12 18:52:53,494 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-04-12 18:52:53,539 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-04-12 18:52:54,436 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6427 to path /srv/cuckoo/cwd/storage/analyses/6268162/memory.dmp
2025-04-12 18:52:54,445 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6427
2025-04-12 18:56:23,663 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.227 for task #6268162
2025-04-12 18:56:24,215 [cuckoo.core.scheduler] DEBUG: Released database task #6268162
2025-04-12 18:56:24,239 [cuckoo.core.scheduler] INFO: Task #6268162: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description (no description) rule Check_OutputDebugStringA_iat
description Checks if being debugged rule anti_dbg
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
Allocates read-write-execute memory (usually to unpack itself) (1 event)
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1064
region_size: 290816
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
This executable has a PDB path (1 event)
pdb_path c:\DevelBuildSlave\QuickStableVS\build\REALbasic\REALbasic Visual Studio\release\X86RunHoudini.pdb
The file contains an unknown PE resource name possibly indicative of a packer (1 event)
resource name PICKLE
One or more processes crashed (1 event)
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x6e1e8a
0x6e154d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x774a33aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x779d9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x779d9f45

exception.instruction_r: ff 10 83 ec 10 85 c0 78 06 8b bd d4 fd ff ff 8d
exception.instruction: call dword ptr [eax]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6e20fe
registers.esp: 36174480
registers.edi: 0
registers.eax: 0
registers.ebp: 36175080
registers.edx: 37
registers.ebx: 36174536
registers.esi: 36175128
registers.ecx: 36175128
1 0 0
File has been identified by 3 AntiVirus engine on IRMA as malicious (3 events)
C4S ClamAV (Linux) C4S.MALWARE.SHA256.AUTOGEN.63987165.UNOFFICIAL
ESET Security (Windows) a variant of Win32/GenKryptik.HHZX trojan
Sophos Anti-Virus (Linux) Mal/Generic-S
File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)
Lionic Trojan.Win32.Generic.4!c
Cylance Unsafe
VirIT Trojan.Win32.GenHeur.B
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.HHZX
Rising Trojan.Injector!1.127AD (CLASSIC)
TrendMicro TrojanSpy.Win32.LUMMASTEALER.YXFDHZ
McAfeeD ti!096103BE60D2
CTX exe.trojan.genkryptik
Sophos Mal/Generic-S
Jiangmin Heur.Mint.z
Google Detected
Antiy-AVL Trojan/Win32.GenKryptik
Gridinsoft Spy.Win32.Gen.tr
Microsoft Trojan:Win32/Wacatac.B!ml
GData Win32.Trojan.Agent.QXYY1F
Varist W32/ABTrojan.LUUL-1384
AhnLab-V3 Trojan/Win.Wacatac.C5749432
McAfee Artemis!67D6BB4DE69C
DeepInstinct MALICIOUS
Malwarebytes Generic.Malware/Suspicious
Ikarus Trojan.Win32.Krypt
Panda Trj/Chgt.AD
TrendMicro-HouseCall TrojanSpy.Win32.LUMMASTEALER.YXFDHZ
Tencent Win32.Trojan.Genkryptik.Tzfl
Fortinet W32/GenKryptik.HHZX!tr
alibabacloud Trojan:Win/Wacapew.C9nj
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.