Analysis Date2015-11-14 07:01:24
MD5c57a5d289a9fb5804dfebe01af39ac2f
SHA1822dd392629009798bcb7980369cc808dc92b71d

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 6928aab2373d23fb8be1dc3ea524ee7c sha1: b0dc07cd425262064fe7e587870739f5947920b7 size: 1411072
Section.rdata md5: f15026566843228d1fa7833b3ef14d24 sha1: 7965e1cab6a9437b5424317203b76965af205193 size: 320512
Section.data md5: 8c27893e3b774b6a09bd05d9f6a1ac2b sha1: 2234b90643853ca614c41b5db46173fc3d5b2459 size: 7680
Section.reloc md5: 2c10928603d4446aa71109eedeadce88 sha1: aa24b302da6a808dd7ca11780fceab588701621d size: 203264
Timestamp2015-05-11 04:39:48
PackerVC8 -> Microsoft Corporation
PEhash204553ef08def0db7f93ae4f0eeb29253d565cbc
IMPhash1266e8ffccb479754380b4b18272a2f2
AVRisingno_virus
AVMcafeeTrojan-FGIJ!C57A5D289A9F
AVAvira (antivir)no_virus
AVTwisterBackdoor.SoxGrave.afx.khym
AVAd-AwareGen:Variant.Zusy.141331
AVAlwil (avast)Dropper-OJQ [Drp]
AVEset (nod32)Win32/Bayrob.Y
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Bayrob.X!tr
AVBitDefenderGen:Variant.Zusy.141331
AVK7Trojan ( 004c77f41 )
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Diley.1
AVMalwareBytesno_virus
AVAuthentiumW32/SoxGrave.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusTrojan.Win32.Bayrob
AVEmsisoftGen:Variant.Diley.1
AVZillya!Backdoor.SoxGrave.Win32.258
AVKasperskyTrojan.Win32.Generic
AVTrend Microno_virus
AVCAT (quickheal)no_virus
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Zusy.141331
AVArcabit (arcavir)Gen:Variant.Zusy.141331
AVClamAVno_virus
AVDr. WebTrojan.Bayrob.5
AVF-SecureGen:Variant.Zusy.141331
AVCA (E-Trust Ino)no_virus
AVRisingno_virus
AVMcafeeTrojan-FGIJ!C57A5D289A9F
AVAvira (antivir)no_virus
AVTwisterBackdoor.SoxGrave.afx.khym
AVAd-AwareGen:Variant.Zusy.141331
AVAlwil (avast)Dropper-OJQ [Drp]
AVEset (nod32)Win32/Bayrob.Y
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Bayrob.X!tr
AVBitDefenderGen:Variant.Zusy.141331
AVK7Trojan ( 004c77f41 )
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Diley.1
AVMalwareBytesno_virus
AVAuthentiumW32/SoxGrave.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusTrojan.Win32.Bayrob

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\system32\pmpwfwidnie\tst
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\ilc5xh1llsxlupoxgxmpm.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\ilc5xh1llsxlupoxgxmpm.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\ilc5xh1llsxlupoxgxmpm.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IP Builder Office DLL Procedure Profile ➝
C:\WINDOWS\system32\amkbmkh.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\pmpwfwidnie\tst
Creates FileC:\WINDOWS\system32\pmpwfwidnie\etc
Creates FileC:\WINDOWS\system32\amkbmkh.exe
Creates FileC:\WINDOWS\system32\pmpwfwidnie\lck
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\amkbmkh.exe
Creates ServicePerformance Receiver DHCP Audio - C:\WINDOWS\system32\amkbmkh.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 800

Process
↳ Pid 848

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\spoolsv.exe

Process
↳ Pid 1136

Process
↳ C:\WINDOWS\system32\amkbmkh.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\pmpwfwidnie\rng
Creates FileC:\WINDOWS\system32\pmpwfwidnie\tst
Creates FileC:\WINDOWS\system32\pmpwfwidnie\lck
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\system32\evkooibsaaa.exe
Creates FileC:\WINDOWS\TEMP\ilc5xh1r2uxlu.exe
Creates FileC:\WINDOWS\system32\pmpwfwidnie\cfg
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\pmpwfwidnie\run
Creates ProcessC:\WINDOWS\TEMP\ilc5xh1r2uxlu.exe -r 28751 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\amkbmkh.exe"

Process
↳ C:\WINDOWS\system32\amkbmkh.exe

Creates FileC:\WINDOWS\system32\pmpwfwidnie\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\amkbmkh.exe"

Creates FileC:\WINDOWS\system32\pmpwfwidnie\tst

Process
↳ C:\WINDOWS\TEMP\ilc5xh1r2uxlu.exe -r 28751 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSrecordsoldier.net
Type: A
208.91.197.241
DNSfliersurprise.net
Type: A
208.91.197.241
DNShistorybright.net
Type: A
208.91.197.241
DNSchiefsoldier.net
Type: A
208.91.197.241
DNSclasssurprise.net
Type: A
208.91.197.241
DNSthosecontinue.net
Type: A
208.91.197.241
DNSthroughcontain.net
Type: A
208.91.197.241
DNSbelongguard.net
Type: A
208.91.197.241
DNSmaybellinethaddeus.net
Type: A
208.91.197.241
DNSkimberleyshavonne.net
Type: A
208.91.197.241
DNSnaildeep.com
Type: A
74.220.215.218
DNSriddenstorm.net
Type: A
66.147.240.171
DNSdestroystorm.net
Type: A
216.239.138.86
DNSsignvoice.net
Type: A
208.100.26.234
DNSroomfive.net
Type: A
217.160.193.90
DNSroomeight.net
Type: A
220.124.143.32
DNSjumpfive.net
Type: A
82.165.21.75
DNSthreefive.net
Type: A
184.168.221.54
DNShusbandfound.net
Type: A
DNSleadershort.net
Type: A
DNSeggbraker.com
Type: A
DNSithouneed.com
Type: A
DNSpickeight.net
Type: A
DNSsongeight.net
Type: A
DNSpickthey.net
Type: A
DNSsongthey.net
Type: A
DNSroomvoice.net
Type: A
DNSsignfive.net
Type: A
DNSsigneight.net
Type: A
DNSroomthey.net
Type: A
DNSsignthey.net
Type: A
DNSmovevoice.net
Type: A
DNSjumpvoice.net
Type: A
DNSmovefive.net
Type: A
DNSmoveeight.net
Type: A
DNSjumpeight.net
Type: A
DNSmovethey.net
Type: A
DNSjumpthey.net
Type: A
DNShillvoice.net
Type: A
DNSwhomvoice.net
Type: A
DNShillfive.net
Type: A
DNSwhomfive.net
Type: A
DNShilleight.net
Type: A
DNSwhomeight.net
Type: A
DNShillthey.net
Type: A
DNSwhomthey.net
Type: A
DNSfeltvoice.net
Type: A
DNSlookvoice.net
Type: A
DNSfeltfive.net
Type: A
DNSlookfive.net
Type: A
DNSfelteight.net
Type: A
DNSlookeight.net
Type: A
DNSfeltthey.net
Type: A
DNSlookthey.net
Type: A
DNSthreevoice.net
Type: A
DNSlordvoice.net
Type: A
DNSlordfive.net
Type: A
DNSthreeeight.net
Type: A
DNSlordeight.net
Type: A
DNSthreethey.net
Type: A
DNSlordthey.net
Type: A
DNSdrinkvoice.net
Type: A
DNSwifevoice.net
Type: A
DNSdrinkfive.net
Type: A
DNSwifefive.net
Type: A
DNSdrinkeight.net
Type: A
DNSwifeeight.net
Type: A
DNSdrinkthey.net
Type: A
DNSwifethey.net
Type: A
DNSknowaunt.net
Type: A
DNSableaunt.net
Type: A
DNSknowscene.net
Type: A
DNSablescene.net
Type: A
DNSknowgreat.net
Type: A
DNSablegreat.net
Type: A
DNSknowdont.net
Type: A
DNSabledont.net
Type: A
DNSpickaunt.net
Type: A
DNSsongaunt.net
Type: A
DNSpickscene.net
Type: A
DNSsongscene.net
Type: A
DNSpickgreat.net
Type: A
DNSsonggreat.net
Type: A
DNSpickdont.net
Type: A
DNSsongdont.net
Type: A
DNSroomaunt.net
Type: A
DNSsignaunt.net
Type: A
DNSroomscene.net
Type: A
DNSsignscene.net
Type: A
DNSroomgreat.net
Type: A
DNSsigngreat.net
Type: A
DNSroomdont.net
Type: A
DNSsigndont.net
Type: A
DNSmoveaunt.net
Type: A
DNSjumpaunt.net
Type: A
DNSmovescene.net
Type: A
DNSjumpscene.net
Type: A
DNSmovegreat.net
Type: A
DNSjumpgreat.net
Type: A
DNSmovedont.net
Type: A
DNSjumpdont.net
Type: A
DNShillaunt.net
Type: A
HTTP GEThttp://recordsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://fliersurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://historybright.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://chiefsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://classsurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://thosecontinue.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://throughcontain.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://belongguard.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://maybellinethaddeus.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://kimberleyshavonne.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://naildeep.com/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://riddenstorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://destroystorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://signvoice.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomeight.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://jumpfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://threefive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://recordsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://fliersurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://historybright.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://chiefsoldier.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://classsurprise.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://thosecontinue.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://throughcontain.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://belongguard.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://maybellinethaddeus.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://kimberleyshavonne.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://naildeep.com/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://riddenstorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://destroystorm.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://signvoice.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://roomeight.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://jumpfive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
HTTP GEThttp://threefive.net/index.php?method=validate&mode=sox&v=050&sox=4f239805&lenhdr
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1037 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1038 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1039 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1040 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1041 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1042 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1044 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1045 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1046 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1047 ➝ 74.220.215.218:80
Flows TCP192.168.1.1:1048 ➝ 66.147.240.171:80
Flows TCP192.168.1.1:1049 ➝ 216.239.138.86:80
Flows TCP192.168.1.1:1050 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1051 ➝ 217.160.193.90:80
Flows TCP192.168.1.1:1052 ➝ 220.124.143.32:80
Flows TCP192.168.1.1:1053 ➝ 82.165.21.75:80
Flows TCP192.168.1.1:1054 ➝ 184.168.221.54:80
Flows TCP192.168.1.1:1055 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1056 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1057 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1058 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1059 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1060 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1061 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1062 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1063 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1064 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1065 ➝ 74.220.215.218:80
Flows TCP192.168.1.1:1066 ➝ 66.147.240.171:80
Flows TCP192.168.1.1:1067 ➝ 216.239.138.86:80
Flows TCP192.168.1.1:1068 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1069 ➝ 217.160.193.90:80
Flows TCP192.168.1.1:1070 ➝ 220.124.143.32:80
Flows TCP192.168.1.1:1071 ➝ 82.165.21.75:80
Flows TCP192.168.1.1:1072 ➝ 184.168.221.54:80

Raw Pcap

Strings