We are hiring! Windows Kernel Developer (Remote), apply here!
flash

SY5DeZW6pz.exe

Status: finished
Submission Time: 2022-08-31 23:30:16 +02:00
Malicious
Ransomware
Spreader
Trojan
Evader
Gandcrab, ReflectiveLoader

Comments

Tags

  • exe

Details

  • Analysis ID:
    694552
  • API (Web) ID:
    1062024
  • Analysis Started:
    2022-08-31 23:40:24 +02:00
  • Analysis Finished:
    2022-08-31 23:50:08 +02:00
  • MD5:
    536f2c1238ef65a64820c35d4504ce67
  • SHA1:
    7806d51132e40728f581374a9d72d9713bff2dd0
  • SHA256:
    b6a71449958283718f01e6be9f7a9eb057479072c1cc55f26a11b033ea210271
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
57/70

malicious
26/34

malicious
25/25

malicious

malicious

IPs

IP Country Detection
63.251.106.25
United States

Domains

Name IP Detection
ddos.dnsnb8.net
63.251.106.25

URLs

Name Detection
http://gdcbghvjyqy7jclk.onion/3a23db8448d3b2b
http://ddos.dnsnb8.net:799/cj//k3.rar%
http://ddos.dnsnb8.net:799/cj//k3.rar
Click to see the 22 hidden entries
http://ddos.dnsnb8.net:799/cj//k1.rar
http://ddos.dnsnb8.net:799/cj//k2.rar%
http://ddos.dnsnb8.net:799/cj//k2.rar
http://ddos.dnsnb8.net/&
https://tox.chat/download.html
http://www.autoitscript.com/autoit3/scite
http://www.scintila.org/scite.rng
http://www.baanboard.com
http://www.rftp.comSteve
http://www.spaceblue.com
http://www.spaceblue.comDenis
http://www.lua.org
http://www.develop.com
http://www.activestate.comJames
http://www.scintilla.org
https://www.torproject.org/
http://www.rftp.com
http://upx.sf.net
http://www.baanboard.comPraveen
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
http://www.develop.comYann
http://www.activestate.com

Dropped files

Name File Type Hashes Detection
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SY5DeZW6pz.exe_5a1e64436764aeb06a12223e505a1adc0f838d9_cfc0479b_04a1246b\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe
MS-DOS executable
#
Click to see the 14 hidden entries
C:\Users\user\AppData\Local\Temp\vSQshX.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
#
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a
data
#
C:\Users\user\AppData\Local\Temp\7830502D.exe
ASCII text
#
C:\Users\user\AppData\Local\Temp\584026FF.exe
ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\k2[1].rar
ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\k1[1].rar
ASCII text
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F2.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2855.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER26BE.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EED.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Aug 31 21:41:40 2022, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER182.tmp.dmp
Mini DuMP crash report, 14 streams, Wed Aug 31 21:41:32 2022, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vSQshX.exe_e41397ed243f95936a1fabef5fb2c6d1bf7554_3e01cb5b_16a9314c\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#