Analysis Date2015-09-19 07:02:37
MD5f66fb4bc9d4e2b53be13cfe31b1ac3bd
SHA12fa64487b4e9969227a6f9b402e7b68c3e75a811

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 9077e041465eabb3cbdab54b4b32cf46 sha1: 3ab506f53de92568dbb2b7e1b6c592a0e483d780 size: 839168
Section.rdata md5: 6e2ead5c88d68cfbf4e841cbbdf80fbe sha1: b29eaf97647e294b302a4b9977813fd77fd5fd60 size: 293888
Section.data md5: 99fa5ba7e64571da545e42429323d5ad sha1: d632a20ee38633a2559a5de62496bbdf35050085 size: 7680
Timestamp2015-04-12 19:55:20
PackerMicrosoft Visual C++ ?.?
PEhashd7164ec9677b734076a52eed474127946b8afbdd
IMPhash1c7a6ff455c4a0555a9a945a51fa356a
AVTwisterno_virus
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVTrend Microno_virus
AVAuthentiumW32/Zusy.X.gen!Eldorado
AVF-SecureGen:Variant.Zusy.133308
AVK7Trojan ( 004cd0081 )
AVEset (nod32)Win32/Kryptik.DDQD
AVMcafeeno_virus
AVFortinetW32/Kryptik.DDQD!tr
AVPadvishno_virus
AVVirusBlokAda (vba32)no_virus
AVKasperskyTrojan.Win32.Generic
AVBullGuardGen:Variant.Zusy.133308
AVFrisk (f-prot)no_virus
AVMalwareBytesno_virus
AVAlwil (avast)Downloader-TLD [Trj]
AVBitDefenderGen:Variant.Zusy.133308
AVEmsisoftGen:Variant.Zusy.133308
AVCAT (quickheal)no_virus
AVAd-AwareGen:Variant.Zusy.133308
AVMicrosoft Security Essentialsno_virus
AVClamAVno_virus
AVMicroWorld (escan)Gen:Variant.Zusy.133308
AVIkarusTrojan.Win32.Crypt
AVCA (E-Trust Ino)no_virus
AVAvira (antivir)TR/Crypt.Xpack.258990
AVRisingno_virus
AVArcabit (arcavir)Gen:Variant.Zusy.133308
AVZillya!Trojan.Kryptik.Win32.777622
AVDr. WebTrojan.DownLoader15.51759

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\veopzme1l8brzdfzyqioc2.exe
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\tst
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\veopzme1l8brzdfzyqioc2.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\veopzme1l8brzdfzyqioc2.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Location Spooler Engine PnP-X ➝
C:\WINDOWS\system32\hogqjuckdi.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\etc
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\lck
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\tst
Creates FileC:\WINDOWS\system32\hogqjuckdi.exe
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\hogqjuckdi.exe
Creates ServiceTP Builder User Launcher Storage - C:\WINDOWS\system32\hogqjuckdi.exe

Process
↳ Pid 804

Process
↳ Pid 848

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1108

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1856

Process
↳ Pid 1124

Process
↳ C:\WINDOWS\system32\hogqjuckdi.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\TEMP\veopzme1sjsrzd.exe
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\rng
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\cfg
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\lck
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\run
Creates FileC:\WINDOWS\system32\lvwfaezgrypl\tst
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\kwatdsqcwjn.exe
Creates ProcessC:\WINDOWS\TEMP\veopzme1sjsrzd.exe -r 23621 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\hogqjuckdi.exe"

Process
↳ C:\WINDOWS\system32\hogqjuckdi.exe

Creates FileC:\WINDOWS\system32\lvwfaezgrypl\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\hogqjuckdi.exe"

Creates FileC:\WINDOWS\system32\lvwfaezgrypl\tst

Process
↳ C:\WINDOWS\TEMP\veopzme1sjsrzd.exe -r 23621 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSnailthere.net
Type: A
98.139.135.129
DNSgroupgrain.net
Type: A
208.91.197.241
DNSthreeonly.net
Type: A
208.91.197.241
DNSnaildeep.com
Type: A
74.220.215.218
DNSfridaystudy.net
Type: A
74.220.215.214
DNSlongwall.net
Type: A
192.185.27.36
DNSwheelfree.net
Type: A
184.168.221.40
DNSstickfree.net
Type: A
184.168.221.104
DNSballfree.net
Type: A
209.99.40.223
DNSableread.net
Type: A
DNSfearstate.net
Type: A
DNSlongcold.net
Type: A
DNSfridayloss.net
Type: A
DNSwrongbelow.net
Type: A
DNShilldance.net
Type: A
DNSeggbraker.com
Type: A
DNSithouneed.com
Type: A
DNStillloss.net
Type: A
DNSmouthonce.net
Type: A
DNStillonce.net
Type: A
DNSshalluncle.net
Type: A
DNSdeepuncle.net
Type: A
DNSshallstudy.net
Type: A
DNSdeepstudy.net
Type: A
DNSshallloss.net
Type: A
DNSdeeploss.net
Type: A
DNSshallonce.net
Type: A
DNSdeeponce.net
Type: A
DNSpushuncle.net
Type: A
DNSfridayuncle.net
Type: A
DNSpushstudy.net
Type: A
DNSpushloss.net
Type: A
DNSpushonce.net
Type: A
DNSfridayonce.net
Type: A
DNSalonguncle.net
Type: A
DNSdecemberuncle.net
Type: A
DNSalongstudy.net
Type: A
DNSdecemberstudy.net
Type: A
DNSalongloss.net
Type: A
DNSdecemberloss.net
Type: A
DNSalongonce.net
Type: A
DNSdecemberonce.net
Type: A
DNSlongfree.net
Type: A
DNSsoilfree.net
Type: A
DNSlongforty.net
Type: A
DNSsoilforty.net
Type: A
DNSlongother.net
Type: A
DNSsoilother.net
Type: A
DNSsoilwall.net
Type: A
DNSsaidfree.net
Type: A
DNSwheelforty.net
Type: A
DNSsaidforty.net
Type: A
DNSwheelother.net
Type: A
DNSsaidother.net
Type: A
DNSwheelwall.net
Type: A
DNSsaidwall.net
Type: A
DNSstickforty.net
Type: A
DNSballforty.net
Type: A
DNSstickother.net
Type: A
HTTP GEThttp://nailthere.net/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
HTTP GEThttp://groupgrain.net/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
HTTP GEThttp://threeonly.net/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
HTTP GEThttp://naildeep.com/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
HTTP GEThttp://fridaystudy.net/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
HTTP GEThttp://longwall.net/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
HTTP GEThttp://wheelfree.net/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
HTTP GEThttp://stickfree.net/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
HTTP GEThttp://ballfree.net/index.php?method=validate&mode=sox&v=047&sox=4b654800&lenhdr
User-Agent:
Flows TCP192.168.1.1:1037 ➝ 98.139.135.129:80
Flows TCP192.168.1.1:1038 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1039 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1040 ➝ 74.220.215.218:80
Flows TCP192.168.1.1:1041 ➝ 74.220.215.214:80
Flows TCP192.168.1.1:1042 ➝ 192.185.27.36:80
Flows TCP192.168.1.1:1043 ➝ 184.168.221.40:80
Flows TCP192.168.1.1:1044 ➝ 184.168.221.104:80
Flows TCP192.168.1.1:1045 ➝ 209.99.40.223:80

Raw Pcap

Strings