Summary

3e471b2ca8b1dbfc_8026c37c

File 3e471b2ca8b1dbfc_8026c37c

Summary
Download Resubmit sample

Size 4.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 18038b251b3c37956ab9a3145b521cf1
SHA1 b00a27b6e5cbe4575fc97f4eed1f80d5b5d981e9
SHA256 3e471b2ca8b1dbfc95b4fb1eafae09dff81a499681b2c98c606931eb686654d8
SHA512
fda42eca37080ebb55e5a1e9f66ce027ef958862ebb529c758ad2f1f2ada7f1152a7ad1f52c9baefa7e3ddceda83c96b7fcfc72944bb88f96cf9de90e1aab72f
CRC32 F652B595
ssdeep None
Yara
  • UPX - (no description)
  • HeavensGate - Heaven's Gate: Switch from 32-bit to 64-mode
  • DebuggerCheck__QueryInfo - (no description)
  • ThreadControl__Context - (no description)
  • anti_dbg - Checks if being debugged
  • inject_thread - Code injection with CreateRemoteThread in a remote process
  • network_http - Communications over HTTP
  • network_dns - Communications use DNS
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6697064

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 17, 2025, 9:49 a.m. July 17, 2025, 9:56 a.m. 441 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-13 07:08:15,015 [analyzer] DEBUG: Starting analyzer from: C:\tmp4hzt0l
2025-07-13 07:08:15,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\fDVQbXOvBZHyYemLXSMmCEWpoKSsQrRs
2025-07-13 07:08:15,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\ppBjrRcLIeCDLsiKSiXvwcuxQHyToaQK
2025-07-13 07:08:15,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-13 07:08:15,046 [analyzer] INFO: Automatically selected analysis package "exe"
2025-07-13 07:08:15,296 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-13 07:08:15,296 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-13 07:08:15,780 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-13 07:08:15,983 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-07-13 07:08:15,983 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-13 07:08:15,983 [analyzer] DEBUG: Started auxiliary module Human
2025-07-13 07:08:15,983 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-13 07:08:15,983 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-13 07:08:16,046 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-13 07:08:16,046 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-13 07:08:16,062 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-13 07:08:16,062 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-13 07:08:16,233 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\3e471b2ca8b1dbfc_8026c37c.exe' with arguments '' and pid 2508
2025-07-13 07:08:16,437 [analyzer] DEBUG: Loaded monitor into process with pid 2508
2025-07-13 07:08:16,515 [analyzer] INFO: Added new file to list with pid 2508 and path C:\Windows\SysWOW64\631febda
2025-07-13 07:08:48,015 [analyzer] INFO: Added new file to list with pid 2508 and path C:\Windows\2af018
2025-07-13 07:08:52,000 [analyzer] INFO: Added new file to list with pid 2508 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-07-13 07:08:52,015 [analyzer] INFO: Added new file to list with pid 2508 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-07-13 07:11:35,280 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-13 07:11:36,562 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-13 07:11:36,562 [lib.api.process] INFO: Successfully terminated process with pid 2508.
2025-07-13 07:11:36,640 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-17 09:49:11,066 [cuckoo.core.scheduler] INFO: Task #6725418: acquired machine win7x6420 (label=win7x6420)
2025-07-17 09:49:11,067 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.220 for task #6725418
2025-07-17 09:49:11,615 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 4190923 (interface=vboxnet0, host=192.168.168.220)
2025-07-17 09:49:14,786 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6420
2025-07-17 09:49:16,095 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6420 to vmcloak
2025-07-17 09:51:25,579 [cuckoo.core.guest] INFO: Starting analysis #6725418 on guest (id=win7x6420, ip=192.168.168.220)
2025-07-17 09:51:26,584 [cuckoo.core.guest] DEBUG: win7x6420: not ready yet
2025-07-17 09:51:31,603 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6420, ip=192.168.168.220)
2025-07-17 09:51:31,680 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6420, ip=192.168.168.220, monitor=latest, size=6660546)
2025-07-17 09:51:33,039 [cuckoo.core.resultserver] DEBUG: Task #6725418: live log analysis.log initialized.
2025-07-17 09:51:33,966 [cuckoo.core.resultserver] DEBUG: Task #6725418 is sending a BSON stream
2025-07-17 09:51:34,569 [cuckoo.core.resultserver] DEBUG: Task #6725418 is sending a BSON stream
2025-07-17 09:51:35,336 [cuckoo.core.resultserver] DEBUG: Task #6725418: File upload for 'shots/0001.jpg'
2025-07-17 09:51:35,355 [cuckoo.core.resultserver] DEBUG: Task #6725418 uploaded file length: 133461
2025-07-17 09:51:48,017 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:52:03,135 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:52:18,453 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:52:33,548 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:52:48,705 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:53:04,031 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:53:19,150 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:53:34,236 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:53:49,471 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:54:04,549 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:54:19,643 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:54:35,048 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:54:50,129 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6725418 still processing
2025-07-17 09:54:53,618 [cuckoo.core.resultserver] DEBUG: Task #6725418: File upload for 'curtain/1752383495.44.curtain.log'
2025-07-17 09:54:53,621 [cuckoo.core.resultserver] DEBUG: Task #6725418 uploaded file length: 36
2025-07-17 09:54:54,603 [cuckoo.core.resultserver] DEBUG: Task #6725418: File upload for 'sysmon/1752383496.42.sysmon.xml'
2025-07-17 09:54:54,735 [cuckoo.core.resultserver] DEBUG: Task #6725418 uploaded file length: 15287936
2025-07-17 09:54:54,767 [cuckoo.core.resultserver] DEBUG: Task #6725418: File upload for 'files/57fabead8f3536b7_631febda'
2025-07-17 09:54:54,794 [cuckoo.core.resultserver] DEBUG: Task #6725418 uploaded file length: 4194304
2025-07-17 09:54:54,803 [cuckoo.core.resultserver] DEBUG: Task #6725418: File upload for 'files/4c847e0c28733ed3_94308059b57b3142e455b38a6eb92015'
2025-07-17 09:54:54,806 [cuckoo.core.resultserver] DEBUG: Task #6725418: File upload for 'files/498ac8dc8a050f5d_94308059b57b3142e455b38a6eb92015'
2025-07-17 09:54:54,807 [cuckoo.core.resultserver] DEBUG: Task #6725418 uploaded file length: 344
2025-07-17 09:54:54,808 [cuckoo.core.resultserver] DEBUG: Task #6725418 uploaded file length: 73513
2025-07-17 09:54:54,812 [cuckoo.core.resultserver] DEBUG: Task #6725418: File upload for 'files/53c059093c87ba8b_2af018'
2025-07-17 09:54:54,813 [cuckoo.core.resultserver] DEBUG: Task #6725418 uploaded file length: 957
2025-07-17 09:54:54,825 [cuckoo.core.resultserver] DEBUG: Task #6725418 had connection reset for <Context for LOG>
2025-07-17 09:54:56,167 [cuckoo.core.guest] INFO: win7x6420: analysis completed successfully
2025-07-17 09:54:56,190 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-17 09:54:56,214 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-17 09:54:57,651 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6420 to path /srv/cuckoo/cwd/storage/analyses/6725418/memory.dmp
2025-07-17 09:54:57,653 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6420
2025-07-17 09:56:31,503 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.220 for task #6725418
2025-07-17 09:56:31,994 [cuckoo.core.scheduler] DEBUG: Released database task #6725418
2025-07-17 09:56:32,014 [cuckoo.core.scheduler] INFO: Task #6725418: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description (no description) rule UPX
description Heaven's Gate: Switch from 32-bit to 64-mode rule HeavensGate
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule ThreadControl__Context
description Checks if being debugged rule anti_dbg
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Communications over HTTP rule network_http
description Communications use DNS rule network_dns
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
Port scanning (2 events)
Port: 443 193 times
Port: 80 199 times
The file contains an unknown PE resource name possibly indicative of a packer (1 event)
resource name VMP
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
A process attempted to delay the analysis task. (1 event)
description 3e471b2ca8b1dbfc_8026c37c.exe tried to sleep 121 seconds, actually delayed analysis time by 121 seconds
Foreign language identified in PE resource (2 events)
name VMP language LANG_CHINESE filetype PE32+ executable (DLL) (GUI) x86-64, for MS Windows sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0003e0f0 size 0x00020e00
name RT_VERSION language LANG_CHINESE filetype MIPSEB-LE ECOFF executable not stripped - version 0.79 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005eef0 size 0x00000160
Creates a service (1 event)
Time & API Arguments Status Return Repeated

CreateServiceW

 service_start_name: LocalSystem
start_type: 2
password:
display_name: EHoiDE23Ufya
filepath: C:\Windows\SysWOW64\631febda
service_name: 4cW4oGJODAV
filepath_r: C:\Windows\Syswow64\631febda
desired_access: 983551
service_handle: 0x00723e68
error_control: 1
service_type: 16
service_manager_handle: 0x00723e90
1 7487080 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 event)
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000000b4
process_name: 631febda
process_identifier: 220
1 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 event)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 46
family: 0
1 0 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeTcbPrivilege
1 1 0
Expresses interest in specific running processes (1 event)
process 3e471b2ca8b1dbfc_8026c37c.exe
Raised Snort alerts (2 events)
snort ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
snort ET DNS Query to a *.top domain - Likely Hostile
Raised Suricata alerts (2 events)
suricata ET INFO Observed DNS Over HTTPS Domain (dns .alidns .com in TLS SNI)
suricata ET DNS Query to a *.top domain - Likely Hostile
Attempts to stop active services (1 event)
Time & API Arguments Status Return Repeated

ControlService

 service_handle: 0x0071ea50
service_name: 4cW4oGJODAV
control_code: 1
1 1 0
Installs itself for autorun at Windows startup (1 event)
service_name 4cW4oGJODAV service_path C:\Windows\SysWOW64\631febda
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (10 events)
Time & API Arguments Status Return Repeated

RegSetValueExW

 key_handle: 0x0000055c
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x0000055c
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ÀŽÂ ôÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x0000055c
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x0000055c
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
value: Network
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName
1 0 0

RegSetValueExW

 key_handle: 0x00000564
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x00000564
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ÀŽÂ ôÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x00000564
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

 key_handle: 0x00000564
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

 key_handle: 0x00000564
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: ÀŽÂ ôÛ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

 key_handle: 0x00000564
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0
File has been identified by 11 AntiVirus engine on IRMA as malicious (11 events)
G Data Antivirus (Windows) Virus: Generic.Dacic.5901.261F97A7 (Engine A), Win32.Trojan.PSE.1XKCGNB (Engine B)
Avast Core Security (Linux) Win32:MalwareX-gen [Bd]
C4S ClamAV (Linux) Win.Malware.Barys-10002593-0
WithSecure (Linux) Trojan.TR/AVI.Agent.qmsxb
eScan Antivirus (Linux) Generic.Dacic.5901.261F97A7(DB)
ESET Security (Windows) a variant of Win32/Sfuzuan.AB trojan
DrWeb Antivirus (Linux) Trojan.Siggen21.32276
ClamAV (Linux) Win.Malware.Barys-10002593-0
Bitdefender Antivirus (Linux) Generic.Dacic.5901.261F97A7
Kaspersky Standard (Windows) HEUR:Backdoor.Win32.Convagent.gen
Emsisoft Commandline Scanner (Windows) Generic.Dacic.5901.261F97A7 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.