File e0a19bbe0242c0e5e4195d446226ef01ce4b624482205693bba4c09292df63e6

Size 51.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 af7d9896a7312d2d9e1942a78f09da88
SHA1 82e57b65ca526f789b8c3fc0e771927e58a07dc7
SHA256 e0a19bbe0242c0e5e4195d446226ef01ce4b624482205693bba4c09292df63e6
SHA512
ef053059aca639d6034a3a07beb7ac30a86bbf9dc6e124d7f303d94432cdbd724f3f501c5cf9c56326a671a513f50d5d977a9c0a8517b151a21c8c0a341ba4ad
CRC32 565B1066
ssdeep None
Yara
  • RSharedStrings - identifiers for remote and gmremote

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.


Autosubmit

6790810

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 27, 2025, 6:10 a.m. July 27, 2025, 6:13 a.m. 151 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-26 02:41:21,015 [analyzer] DEBUG: Starting analyzer from: C:\tmp4hzt0l
2025-07-26 02:41:21,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\eehURmvnuWukUYedMeoJIjrA
2025-07-26 02:41:21,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\dWQcEXmbFGvPnWbFzDxsGOyXV
2025-07-26 02:41:21,280 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-26 02:41:21,280 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-26 02:41:21,842 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-26 02:41:22,046 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-07-26 02:41:22,046 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-26 02:41:22,046 [analyzer] DEBUG: Started auxiliary module Human
2025-07-26 02:41:22,046 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-26 02:41:22,046 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-26 02:41:22,108 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-26 02:41:22,125 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-26 02:41:22,125 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-26 02:41:22,125 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-26 02:41:22,250 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\e0a19bbe0242c0e5e4195d446226ef01ce4b624482205693bba4c09292df63e6.exe' with arguments '' and pid 2156
2025-07-26 02:41:22,453 [analyzer] DEBUG: Loaded monitor into process with pid 2156
2025-07-26 02:41:22,483 [analyzer] INFO: Added new file to list with pid 2156 and path C:\Users\Administrator\AppData\Local\Temp\26973875.reg
2025-07-26 02:41:22,592 [analyzer] INFO: Injected into process with pid 2332 and name u'regedit.exe'
2025-07-26 02:41:22,608 [analyzer] INFO: Added new file to list with pid 2156 and path C:\Windows\SysWOW64\WinHelp59.exe
2025-07-26 02:41:22,812 [analyzer] DEBUG: Loaded monitor into process with pid 2332
2025-07-26 02:41:23,250 [analyzer] INFO: Process with pid 2332 has terminated
2025-07-26 02:41:27,046 [analyzer] INFO: Injected into process with pid 2116 and name u'WinHelp59.exe'
2025-07-26 02:41:27,203 [analyzer] DEBUG: Loaded monitor into process with pid 2116
2025-07-26 02:41:27,250 [analyzer] INFO: Process with pid 2156 has terminated
2025-07-26 02:41:27,342 [analyzer] INFO: Injected into process with pid 2548 and name u'svchost.exe'
2025-07-26 02:41:28,250 [analyzer] INFO: Process with pid 2116 has terminated
2025-07-26 02:41:30,250 [analyzer] INFO: Process with pid 2548 has terminated
2025-07-26 02:41:30,250 [analyzer] INFO: Process list is empty, terminating analysis.
2025-07-26 02:41:31,515 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-26 02:41:31,530 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-27 06:10:33,869 [cuckoo.core.scheduler] INFO: Task #6770258: acquired machine win7x6420 (label=win7x6420)
2025-07-27 06:10:33,870 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.220 for task #6770258
2025-07-27 06:10:34,450 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 446006 (interface=vboxnet0, host=192.168.168.220)
2025-07-27 06:10:34,609 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6420
2025-07-27 06:10:36,200 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6420 to vmcloak
2025-07-27 06:11:31,791 [cuckoo.core.guest] INFO: Starting analysis #6770258 on guest (id=win7x6420, ip=192.168.168.220)
2025-07-27 06:11:32,797 [cuckoo.core.guest] DEBUG: win7x6420: not ready yet
2025-07-27 06:11:37,830 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6420, ip=192.168.168.220)
2025-07-27 06:11:37,908 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6420, ip=192.168.168.220, monitor=latest, size=6660546)
2025-07-27 06:11:39,091 [cuckoo.core.resultserver] DEBUG: Task #6770258: live log analysis.log initialized.
2025-07-27 06:11:40,081 [cuckoo.core.resultserver] DEBUG: Task #6770258 is sending a BSON stream
2025-07-27 06:11:40,458 [cuckoo.core.resultserver] DEBUG: Task #6770258 is sending a BSON stream
2025-07-27 06:11:40,815 [cuckoo.core.resultserver] DEBUG: Task #6770258 is sending a BSON stream
2025-07-27 06:11:41,539 [cuckoo.core.resultserver] DEBUG: Task #6770258: File upload for 'shots/0001.jpg'
2025-07-27 06:11:41,580 [cuckoo.core.resultserver] DEBUG: Task #6770258 uploaded file length: 133454
2025-07-27 06:11:45,222 [cuckoo.core.resultserver] DEBUG: Task #6770258 is sending a BSON stream
2025-07-27 06:11:45,335 [cuckoo.core.resultserver] DEBUG: Task #6770258: File upload for 'files/e0a19bbe0242c0e5_e0a19bbe0242c0e5e4195d446226ef01ce4b624482205693bba4c09292df63e6.exe'
2025-07-27 06:11:45,342 [cuckoo.core.resultserver] DEBUG: Task #6770258 uploaded file length: 52866
2025-07-27 06:11:49,604 [cuckoo.core.resultserver] DEBUG: Task #6770258: File upload for 'curtain/1753490491.36.curtain.log'
2025-07-27 06:11:49,622 [cuckoo.core.resultserver] DEBUG: Task #6770258 uploaded file length: 36
2025-07-27 06:11:49,634 [cuckoo.core.resultserver] DEBUG: Task #6770258: File upload for 'sysmon/1753490491.52.sysmon.xml'
2025-07-27 06:11:49,644 [cuckoo.core.resultserver] DEBUG: Task #6770258: File upload for 'files/46814408d1951069_winhelp59.exe'
2025-07-27 06:11:49,648 [cuckoo.core.resultserver] DEBUG: Task #6770258 uploaded file length: 53091
2025-07-27 06:11:49,663 [cuckoo.core.resultserver] DEBUG: Task #6770258: File upload for 'files/74b729de4b171a0d_26973875.reg'
2025-07-27 06:11:49,666 [cuckoo.core.resultserver] DEBUG: Task #6770258 uploaded file length: 384
2025-07-27 06:11:49,668 [cuckoo.core.resultserver] DEBUG: Task #6770258 uploaded file length: 418180
2025-07-27 06:11:49,900 [cuckoo.core.resultserver] DEBUG: Task #6770258 had connection reset for <Context for LOG>
2025-07-27 06:11:50,805 [cuckoo.core.guest] INFO: win7x6420: analysis completed successfully
2025-07-27 06:11:50,816 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-27 06:11:50,851 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-27 06:11:52,181 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6420 to path /srv/cuckoo/cwd/storage/analyses/6770258/memory.dmp
2025-07-27 06:11:52,183 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6420
2025-07-27 06:13:04,450 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.220 for task #6770258
2025-07-27 06:13:04,934 [cuckoo.core.scheduler] DEBUG: Released database task #6770258
2025-07-27 06:13:04,957 [cuckoo.core.scheduler] INFO: Task #6770258: analysis procedure completed

Signatures

Yara rule detected for file (1 event)
description identifiers for remote and gmremote rule RSharedStrings
Allocates read-write-execute memory (usually to unpack itself) (50 out of 172 events)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 53248
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13152000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13151000
process_handle: 0xffffffff
1 0 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)
section .ex_cod
section .ex_rsc
section .nwroh
The executable uses a known packer (1 event)
packer eXPressor v1.3 -> CGSoftLabs
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Foreign language identified in PE resource (3 events)
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 48 x 96 x 32, image size 9216 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000140f0 size 0x000025a8
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00016698 size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000166ac size 0x00000348
Creates executable files on the filesystem (2 events)
file C:\Users\Administrator\AppData\Local\Temp\26973875.reg
file C:\Windows\System32\WinHelp59.exe
Creates a suspicious process (1 event)
cmdline C:\Windows\system32\svchost.exe
Drops an executable to the user AppData folder (1 event)
file C:\Users\Administrator\AppData\Local\Temp\e0a19bbe0242c0e5e4195d446226ef01ce4b624482205693bba4c09292df63e6.exe
The binary likely contains encrypted or compressed data indicative of a packer (2 events)
section {u'size_of_data': u'0x00004dcf', u'virtual_address': u'0x00001000', u'entropy': 7.992448818985285, u'name': u'.data', u'virtual_size': u'0x00011000'} entropy 7.99244881899 description A section with a high entropy has been found
entropy 0.534494324738 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeShutdownPrivilege
1 1 0
One or more of the buffers contains an embedded PE file (1 event)
buffer Buffer with sha1: d7ddf1b357841287a6d5fb8f984afa375283e2b9
Allocates execute permission to another process indicative of possible code injection (1 event)
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 98304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13150000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000f0
1 0 0
Installs itself for autorun at Windows startup (1 event)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CFF8FD86-05DB-4990-92A9-0EE5FDFB7BFE}\stubpath reg_value C:\Windows\system32\WinHelp59.exe
Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (2 events)
Process injection Process 2116 created a remote thread in non-child process 2548
Time & API Arguments Status Return Repeated

CreateRemoteThread

thread_identifier: 0
process_identifier: 2548
function_address: 0x13157d20
flags: 0
stack_size: 0
parameter: 0x13150000
process_handle: 0x000000f0
1 236 0
Manipulates memory of a non-child process indicative of process injection (2 events)
Process injection Process 2116 manipulating memory of non-child process 2548
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 98304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x13150000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000f0
1 0 0
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Gen:Variant.Barys.494697 (Engine A)
Avast Core Security (Linux) Win32:MalwareX-gen [Trj]
C4S ClamAV (Linux) Win.Dropper.Gh0stRAT-7645027-0
Trellix (Linux) ACL/Bifrost Backdoor trojan
WithSecure (Linux) Trojan.TR/Crypt.XPACK.Gen
eScan Antivirus (Linux) Gen:Variant.Barys.494697(DB)
ESET Security (Windows) Win32/Farfli.AAG trojan
Sophos Anti-Virus (Linux) Troj/Farfli-DL
DrWeb Antivirus (Linux) Trojan.DownLoad3.17387
ClamAV (Linux) Win.Dropper.Gh0stRAT-7645027-0
Bitdefender Antivirus (Linux) Gen:Variant.Barys.494697
Kaspersky Standard (Windows) HEUR:Trojan-Dropper.Win32.Injector.gen
Emsisoft Commandline Scanner (Windows) Gen:Variant.Barys.494697 (B)
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)
Bkav W32.AIDetectMalware
tehtris Generic.Malware
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Onlinegames.P.mue
Skyhigh BehavesLike.Win32.Malware.qh
ALYac Gen:Variant.Barys.494697
Cylance Unsafe
VIPRE Gen:Variant.Barys.494697
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
BitDefender Gen:Variant.Barys.494697
K7GW Trojan ( 0047d1d01 )
K7AntiVirus Trojan ( 0047d1d01 )
Arcabit Trojan.Barys.D78C69
VirIT Trojan.Win32.DownLoad3.ZST
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 Win32/Farfli.AAG
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
ClamAV Win.Dropper.Gh0stRAT-7645027-0
Kaspersky HEUR:Trojan-Dropper.Win32.Injector.gen
NANO-Antivirus Trojan.Win32.Inject.brokcs
SUPERAntiSpyware Trojan.Agent/Gen-Injector
MicroWorld-eScan Gen:Variant.Barys.494697
Rising Backdoor.Agent!8.C5D (TFE:1:lnX5PAbmTjT)
Emsisoft Gen:Variant.Barys.494697 (B)
F-Secure Trojan.TR/Crypt.XPACK.Gen
DrWeb Trojan.DownLoad3.17387
Zillya Trojan.Farfli.Win32.97094
McAfeeD Real Protect-LS!AF7D9896A731
Trapmine malicious.high.ml.score
CTX exe.unknown.barys
Sophos Troj/Farfli-DL
SentinelOne Static AI - Malicious PE
Jiangmin TrojanDropper.Injector.brzp
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Crypt.XPACK.Gen
Antiy-AVL Trojan/Win32.Farfli.aag
Kingsoft malware.kb.b.999
Gridinsoft Ransom.Win32.Sabsik.oa!s1
Xcitium TrojWare.Win32.Farfli.S@6jgvla
Microsoft Backdoor:Win32/Bifrose!pz
ZoneAlarm Troj/Farfli-DL
GData Win32.Trojan.PSE.11TOFEQ
Varist W32/Trojan.WLBV-0998
AhnLab-V3 Win32/ExprPacked.suspicious
VBA32 BScope.Trojan.Download
DeepInstinct MALICIOUS
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.