Summary

Malware_7aa9127853d3bd2095db9dfc2475a2f74246ea83e7d4ce8519b9c04a02749850

File Malware_7aa9127853d3bd2095db9dfc2475a2f74246ea83e7d4ce8519b9c04a02749850

Summary
Download Resubmit sample

Size 39.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 dd600093d8a167e361a7d0160d676391
SHA1 373f7eb97c0ff494899b4ee9627cc0d4e0bf1d35
SHA256 7aa9127853d3bd2095db9dfc2475a2f74246ea83e7d4ce8519b9c04a02749850
SHA512
23e8780adcc213cf87ae2b7746c01d33b5b7295a9d45801db8a04f2dbacbe4e027c89e3ed8842c782d4cf781c6f723d580edd13b486b67be17314eb7341c44be
CRC32 D2B914E7
ssdeep None
Yara
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_private_profile - Affect private profile
  • win_files_operation - Affect private profile

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 15, 2024, 5:49 a.m. July 15, 2024, 5:50 a.m. 66 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2024-07-15 05:48:55,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpd0os1j
2024-07-15 05:48:55,000 [analyzer] DEBUG: Pipe server name: \??\PIPE\sWDEWnuAZwrDdYlFoQXvfHynfmOZrm
2024-07-15 05:48:55,000 [analyzer] DEBUG: Log pipe server name: \??\PIPE\zaNFvVMQcpKQYLvzzAO
2024-07-15 05:48:55,421 [analyzer] DEBUG: Started auxiliary module Curtain
2024-07-15 05:48:55,421 [analyzer] DEBUG: Started auxiliary module DbgView
2024-07-15 05:48:55,812 [analyzer] DEBUG: Started auxiliary module Disguise
2024-07-15 05:48:56,000 [analyzer] DEBUG: Loaded monitor into process with pid 512
2024-07-15 05:48:56,000 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2024-07-15 05:48:56,000 [analyzer] DEBUG: Started auxiliary module Human
2024-07-15 05:48:56,015 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2024-07-15 05:48:56,015 [analyzer] DEBUG: Started auxiliary module Reboot
2024-07-15 05:48:56,092 [analyzer] DEBUG: Started auxiliary module RecentFiles
2024-07-15 05:48:56,092 [analyzer] DEBUG: Started auxiliary module Screenshots
2024-07-15 05:48:56,092 [analyzer] DEBUG: Started auxiliary module Sysmon
2024-07-15 05:48:56,092 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2024-07-15 05:48:56,217 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\Malware_7aa9127853d3bd2095db9dfc2475a2f74246ea83e7d4ce8519b9c04a02749850.exe' with arguments '' and pid 2864
2024-07-15 05:48:56,405 [analyzer] DEBUG: Loaded monitor into process with pid 2864
2024-07-15 05:48:57,030 [analyzer] INFO: Added new file to list with pid 2864 and path C:\Users\Administrator\AppData\Local\Temp\nso4B7D.tmp\ddnow.exe
2024-07-15 05:48:57,030 [analyzer] INFO: Added new file to list with pid 2864 and path C:\Users\Administrator\AppData\Local\Temp\nso4B7D.tmp\ddnow4.exe
2024-07-15 05:48:58,092 [analyzer] INFO: Injected into process with pid 2444 and name u'ddnow.exe'
2024-07-15 05:48:58,342 [analyzer] DEBUG: Loaded monitor into process with pid 2444
2024-07-15 04:49:41,743 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 2444.
2024-07-15 04:49:55,336 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2024-07-15 04:49:55,414 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2864.
2024-07-15 04:49:55,414 [lib.api.process] WARNING: The process with pid 2444 is not alive, memory dump aborted
2024-07-15 04:49:55,664 [analyzer] INFO: Terminating remaining processes before shutdown.
2024-07-15 04:49:55,664 [lib.api.process] INFO: Successfully terminated process with pid 2864.
2024-07-15 04:49:55,680 [analyzer] INFO: Analysis completed.

Cuckoo Log

2024-07-15 05:49:00,598 [cuckoo.core.scheduler] INFO: Task #5072591: acquired machine win7x6429 (label=win7x6429)
2024-07-15 05:49:00,598 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.229 for task #5072591
2024-07-15 05:49:00,906 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3192101 (interface=vboxnet0, host=192.168.168.229)
2024-07-15 05:49:01,282 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6429
2024-07-15 05:49:02,098 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6429 to vmcloak
2024-07-15 05:49:17,687 [cuckoo.core.guest] INFO: Starting analysis #5072591 on guest (id=win7x6429, ip=192.168.168.229)
2024-07-15 05:49:18,694 [cuckoo.core.guest] DEBUG: win7x6429: not ready yet
2024-07-15 05:49:23,711 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6429, ip=192.168.168.229)
2024-07-15 05:49:23,791 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6429, ip=192.168.168.229, monitor=latest, size=6660546)
2024-07-15 05:49:25,095 [cuckoo.core.resultserver] DEBUG: Task #5072591: live log analysis.log initialized.
2024-07-15 05:49:26,054 [cuckoo.core.resultserver] DEBUG: Task #5072591 is sending a BSON stream
2024-07-15 05:49:26,447 [cuckoo.core.resultserver] DEBUG: Task #5072591 is sending a BSON stream
2024-07-15 05:49:27,136 [cuckoo.core.resultserver] DEBUG: Task #5072591: File upload for 'files/e3b0c44298fc1c14_nso4B7C.tmp'
2024-07-15 05:49:27,139 [cuckoo.core.resultserver] DEBUG: Task #5072591 uploaded file length: 0
2024-07-15 05:49:27,303 [cuckoo.core.resultserver] DEBUG: Task #5072591: File upload for 'shots/0001.jpg'
2024-07-15 05:49:27,334 [cuckoo.core.resultserver] DEBUG: Task #5072591 uploaded file length: 133379
2024-07-15 05:49:28,288 [cuckoo.core.resultserver] DEBUG: Task #5072591 is sending a BSON stream
2024-07-15 05:49:39,723 [cuckoo.core.guest] DEBUG: win7x6429: analysis #5072591 still processing
2024-07-15 05:49:54,786 [cuckoo.core.guest] DEBUG: win7x6429: analysis #5072591 still processing
2024-07-15 05:49:55,548 [cuckoo.core.resultserver] DEBUG: Task #5072591: File upload for 'curtain/1721011795.54.curtain.log'
2024-07-15 05:49:55,552 [cuckoo.core.resultserver] DEBUG: Task #5072591 uploaded file length: 36
2024-07-15 05:49:55,661 [cuckoo.core.resultserver] DEBUG: Task #5072591: File upload for 'sysmon/1721011795.65.sysmon.xml'
2024-07-15 05:49:55,665 [cuckoo.core.resultserver] DEBUG: Task #5072591 uploaded file length: 136356
2024-07-15 05:49:55,673 [cuckoo.core.resultserver] DEBUG: Task #5072591: File upload for 'files/b6e08bfe80854efa_ddnow.exe'
2024-07-15 05:49:55,675 [cuckoo.core.resultserver] DEBUG: Task #5072591 uploaded file length: 6656
2024-07-15 05:49:55,679 [cuckoo.core.resultserver] DEBUG: Task #5072591: File upload for 'files/2e57a40dfed94791_ddnow4.exe'
2024-07-15 05:49:55,681 [cuckoo.core.resultserver] DEBUG: Task #5072591 uploaded file length: 6144
2024-07-15 05:49:56,153 [cuckoo.core.resultserver] DEBUG: Task #5072591 had connection reset for <Context for LOG>
2024-07-15 05:49:57,797 [cuckoo.core.guest] INFO: win7x6429: analysis completed successfully
2024-07-15 05:49:57,810 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2024-07-15 05:49:57,865 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2024-07-15 05:49:58,684 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6429 to path /srv/cuckoo/cwd/storage/analyses/5072591/memory.dmp
2024-07-15 05:49:58,685 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6429
2024-07-15 05:50:06,250 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.229 for task #5072591
2024-07-15 05:50:06,784 [cuckoo.core.scheduler] DEBUG: Released database task #5072591
2024-07-15 05:50:06,801 [cuckoo.core.scheduler] INFO: Task #5072591: analysis procedure completed

Signatures

Yara rules detected for file (6 events)
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
Allocates read-write-execute memory (usually to unpack itself) (50 out of 56 events)
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000950000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0c41000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebe000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebe000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ec1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef0ebe000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00052000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0010a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00053000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0011a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00142000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0011d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0005c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00054000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00190000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0006f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff000a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00073000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0005a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0010b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00102000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff000a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0005b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff001d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff001d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0004a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
Queries for the computername (1 event)
Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: RAWJDBQVXIMOE
1 1 0
Checks if process is being debugged by a debugger (1 event)
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)
section .ndata
Creates executable files on the filesystem (2 events)
file C:\Users\Administrator\AppData\Local\Temp\nso4B7D.tmp\ddnow.exe
file C:\Users\Administrator\AppData\Local\Temp\nso4B7D.tmp\ddnow4.exe
Checks adapter addresses which can be used to detect virtual network interfaces (1 event)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Raised Snort alerts (1 event)
snort ET DNS Query to a *.pw domain - Likely Hostile
Raised Suricata alerts (1 event)
suricata ET DNS Query to a *.pw domain - Likely Hostile
File has been identified by 8 AntiVirus engine on IRMA as malicious (8 events)
G Data Antivirus (Windows) Virus: Gen:Adware.MSIL.DotDo.1 (2x), Gen:Variant.Nemesis.10893 (Engine A)
Avast Core Security (Linux) FileRepMalware [Adw]
F-Secure Antivirus (Linux) Heuristic.HEUR/AGEN.1313684 [Aquarius]
Windows Defender (Windows) Trojan:Win32/Occamy.C7A
Microsoft Defender ATP (Linux) Trojan:Win32/Occamy.C7A
eScan Antivirus (Linux) Gen:Adware.MSIL.DotDo.1(DB)
ESET Security (Windows) multiple detections
Kaspersky Standard (Windows) not-a-virus:HEUR:AdWare.MSIL.Dotdo.gen
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)
Bkav W32.AIDetectMalware
Lionic Adware.NSIS.Dotdo.2!c
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
McAfee Artemis!DD600093D8A1
ALYac IL:Trojan.MSILZilla.6226
Cylance unsafe
VIPRE Gen:Variant.Nemesis.10893
Sangfor Adware.Win32.Dotdo.Vy72
K7AntiVirus Adware ( 005077961 )
BitDefender Gen:Variant.Nemesis.10893
K7GW Adware ( 005077961 )
Cybereason malicious.97c0ff
Arcabit Trojan.Nemesis.D2A8D [many]
Cyren W32/Trojan.NLNR-5404
Symantec ML.Attribute.HighConfidence
ESET-NOD32 multiple detections
Avast Win32:Adware-gen [Adw]
Kaspersky not-a-virus:HEUR:AdWare.NSIS.Dotdo.gen
Alibaba AdWare:Win32/Dotdo.ba75f389
NANO-Antivirus Riskware.Win32.Dotdo.emcdeh
SUPERAntiSpyware Adware.ConvertAd/Variant
MicroWorld-eScan Gen:Variant.Nemesis.10893
Rising Adware.Dotdo!8.1172 (CLOUD)
Emsisoft Gen:Variant.Nemesis.10893 (B)
F-Secure Heuristic.HEUR/AGEN.1313684
DrWeb Adware.Dotdo.159
TrendMicro TROJ_GEN.R06BC0PIK23
McAfee-GW-Edition RDN/Generic PUP.z
Trapmine malicious.high.ml.score
FireEye Gen:Variant.Nemesis.10893
Sophos Generic Reputation PUA (PUA)
Ikarus AdWare.MSIL.Dotdo
Webroot W32.Adware.Gen
Avira HEUR/AGEN.1345533
MAX malware (ai score=99)
Antiy-AVL GrayWare[AdWare]/MSIL.Dotdo
Gridinsoft Ransom.Win32.Occamy.sa
Xcitium ApplicUnwnt@#3men6czeat9lt
Microsoft Trojan:Win32/Occamy.C7A
ZoneAlarm not-a-virus:HEUR:AdWare.MSIL.Dotdo.gen
GData IL:Trojan.MSILZilla.6226
Google Detected
BitDefenderTheta Gen:NN.ZemsilF.36738.am0@aK@ezhb
DeepInstinct MALICIOUS
VBA32 Adware.Dotdo
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.R06BC0PIK23
Tencent Msil.AdWare.Dotdo.Xtjl
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.