Summary

5f78019ec59c52a6_dw20.exe

File 5f78019ec59c52a6_dw20.exe

Summary
Download Resubmit sample

Size 13.6MB
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 ce20415de4a62397f262a9be2ae7344c
SHA1 bba15dd269b2ff1a96d664416ffc37b07188bcae
SHA256 5f78019ec59c52a6c534710ed6a8d66d7046f641ac4b5729c5d72cfa56ba9985
SHA512
8a168ede6fd030fd5b41e119c4ee7da3a2e7eafb948222a12dca700961c1c14b53376cbb6d0d35b14e02e57b6729259a251317ce3264ca44c01afb0b982651ef
CRC32 EA392607
ssdeep None
Yara
  • vmdetect - Possibly employs anti-virtualization techniques
  • Base64_encoded_Executable - Detects an base64 encoded executable (often embedded)
  • DebuggerException__ConsoleCtrl - (no description)
  • DebuggerException__SetConsoleCtrl - (no description)
  • SEH__vectored - (no description)
  • create_service - Create a windows service
  • network_udp_sock - Communications over UDP network
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:5977916

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Feb. 25, 2025, 2:18 a.m. Feb. 25, 2025, 2:25 a.m. 452 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-02-21 21:47:49,030 [analyzer] DEBUG: Starting analyzer from: C:\tmp564etj
2025-02-21 21:47:49,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\BcDsdlYgVhHIBOusLAXBxr
2025-02-21 21:47:49,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\nXOShdwLFTigdgOXsEREjZZbSwZz
2025-02-21 21:47:49,046 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-02-21 21:47:49,078 [analyzer] INFO: Automatically selected analysis package "exe"
2025-02-21 21:47:49,342 [analyzer] DEBUG: Started auxiliary module Curtain
2025-02-21 21:47:49,342 [analyzer] DEBUG: Started auxiliary module DbgView
2025-02-21 21:47:49,796 [analyzer] DEBUG: Started auxiliary module Disguise
2025-02-21 21:47:50,000 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-02-21 21:47:50,000 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-02-21 21:47:50,000 [analyzer] DEBUG: Started auxiliary module Human
2025-02-21 21:47:50,000 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-02-21 21:47:50,000 [analyzer] DEBUG: Started auxiliary module Reboot
2025-02-21 21:47:50,078 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-02-21 21:47:50,078 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-02-21 21:47:50,078 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-02-21 21:47:50,092 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-02-21 21:47:50,342 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5f78019ec59c52a6_dw20.exe' with arguments '' and pid 2620
2025-02-21 21:47:50,592 [analyzer] DEBUG: Loaded monitor into process with pid 2620
2025-02-21 21:48:12,591 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Windows\System32\poBttQtds.exe
2025-02-21 21:48:12,713 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL
2025-02-21 21:48:12,746 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.exe
2025-02-21 21:48:12,984 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL
2025-02-21 21:48:13,012 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.exe
2025-02-21 21:48:13,230 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
2025-02-21 21:48:13,477 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.exe
2025-02-21 21:48:13,641 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
2025-02-21 21:48:13,686 [analyzer] INFO: Added new file to list with pid 2620 and path C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.exe
2025-02-21 21:48:14,364 [analyzer] INFO: Process with pid 2620 has terminated
2025-02-21 21:48:14,364 [analyzer] INFO: Process list is empty, terminating analysis.
2025-02-21 21:48:15,864 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-02-21 21:48:38,239 [analyzer] WARNING: File at path u'c:\\windows\\system32\\pobttqtds.exe' does not exist, skip.
2025-02-21 21:48:49,816 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-02-25 02:18:15,034 [cuckoo.core.scheduler] INFO: Task #6011810: acquired machine win7x6419 (label=win7x6419)
2025-02-25 02:18:15,040 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.219 for task #6011810
2025-02-25 02:18:15,541 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3290368 (interface=vboxnet0, host=192.168.168.219)
2025-02-25 02:23:03,334 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6419
2025-02-25 02:23:04,264 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6419 to vmcloak
2025-02-25 02:24:08,464 [cuckoo.core.guest] INFO: Starting analysis #6011810 on guest (id=win7x6419, ip=192.168.168.219)
2025-02-25 02:24:09,484 [cuckoo.core.guest] DEBUG: win7x6419: not ready yet
2025-02-25 02:24:14,613 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6419, ip=192.168.168.219)
2025-02-25 02:24:17,805 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6419, ip=192.168.168.219, monitor=latest, size=6660546)
2025-02-25 02:24:21,063 [cuckoo.core.resultserver] DEBUG: Task #6011810: live log analysis.log initialized.
2025-02-25 02:24:21,907 [cuckoo.core.resultserver] DEBUG: Task #6011810 is sending a BSON stream
2025-02-25 02:24:22,448 [cuckoo.core.resultserver] DEBUG: Task #6011810 is sending a BSON stream
2025-02-25 02:24:23,141 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'shots/0001.jpg'
2025-02-25 02:24:23,176 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 111956
2025-02-25 02:24:24,291 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'shots/0002.jpg'
2025-02-25 02:24:24,394 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 125257
2025-02-25 02:24:36,734 [cuckoo.core.guest] DEBUG: win7x6419: analysis #6011810 still processing
2025-02-25 02:24:45,258 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'shots/0003.jpg'
2025-02-25 02:24:45,285 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 133384
2025-02-25 02:24:46,522 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'shots/0004.jpg'
2025-02-25 02:24:46,575 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 133578
2025-02-25 02:24:47,328 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'curtain/1740170895.55.curtain.log'
2025-02-25 02:24:47,360 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 36
2025-02-25 02:24:47,588 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'sysmon/1740170895.8.sysmon.xml'
2025-02-25 02:24:47,743 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 1133180
2025-02-25 02:24:47,774 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'files/ccd6e253107805aa_dw20.exe'
2025-02-25 02:24:50,301 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 14981120
2025-02-25 02:24:50,554 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'files/a8acc55f3ff8f5e5_msaddndr.dll'
2025-02-25 02:24:52,506 [cuckoo.core.guest] DEBUG: win7x6419: analysis #6011810 still processing
2025-02-25 02:24:53,481 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 14966784
2025-02-25 02:24:53,784 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'files/fe89c72264c1d222_dw20.exe.exe'
2025-02-25 02:24:56,998 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 15008776
2025-02-25 02:24:57,680 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'files/7d656834cc022da1_dwtrig20.exe.exe'
2025-02-25 02:25:00,108 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 14961672
2025-02-25 02:25:00,599 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'files/8249ba72420678f9_msaddndr.dll.exe'
2025-02-25 02:25:04,939 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 15066120
2025-02-25 02:25:05,903 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'files/07122727d336cbc5_dwtrig20.exe'
2025-02-25 02:25:08,086 [cuckoo.core.guest] DEBUG: win7x6419: analysis #6011810 still processing
2025-02-25 02:25:10,095 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 14951424
2025-02-25 02:25:12,592 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'files/122eaecf07b18601_dbghelp.dll.exe'
2025-02-25 02:25:16,413 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 15008776
2025-02-25 02:25:17,330 [cuckoo.core.resultserver] DEBUG: Task #6011810: File upload for 'files/7678d210798bf9e4_dbghelp.dll'
2025-02-25 02:25:21,841 [cuckoo.core.resultserver] DEBUG: Task #6011810 uploaded file length: 14969856
2025-02-25 02:25:21,868 [cuckoo.core.resultserver] DEBUG: Task #6011810 had connection reset for <Context for LOG>
2025-02-25 02:25:24,094 [cuckoo.core.guest] INFO: win7x6419: analysis completed successfully
2025-02-25 02:25:24,204 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-02-25 02:25:24,242 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-02-25 02:25:25,793 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6419 to path /srv/cuckoo/cwd/storage/analyses/6011810/memory.dmp
2025-02-25 02:25:25,864 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6419
2025-02-25 02:25:41,158 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.219 for task #6011810
2025-02-25 02:25:41,842 [cuckoo.core.scheduler] DEBUG: Released database task #6011810
2025-02-25 02:25:42,013 [cuckoo.core.scheduler] INFO: Task #6011810: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description Possibly employs anti-virtualization techniques rule vmdetect
description Detects an base64 encoded executable (often embedded) rule Base64_encoded_Executable
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule SEH__vectored
description Create a windows service rule create_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
Command line console output was observed (6 events)
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: https://ent34ndx3cz8k.x.pipedream.net//a?son=2035764045&brother=1936873816&selfhash=5f78019ec59c52a6c534710ed6a8d66d7046f641ac4b5729c5d72cfa56ba9985&seed=1740170871003906300&runnigfrom=C:\Users\Administrator\AppData\Local\Temp\5f78019ec59c52a6_dw20.exe
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL
console_handle: 0x0000000000000007
1 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)
section .symtab
Creates executable files on the filesystem (9 events)
file C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
file C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.exe
file C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL
file C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
file c:\Windows\System32\poBttQtds.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL
Raised Snort alerts (1 event)
snort ET INFO DNS Query for Webhook/HTTP Request Inspection Service (x .pipedream .net)
Raised Suricata alerts (3 events)
suricata ET INFO DNS Query for Webhook/HTTP Request Inspection Service (x .pipedream .net)
suricata TGI HUNT VulnTesting Domain (requestbin.net in DNS Lookup)
suricata ET INFO DNSBin Demo (requestbin .net) - Data Exfil
Installs itself for autorun at Windows startup (1 event)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poBttQtds reg_value c:\Windows\System32\poBttQtds.exe
Detects the presence of Wine emulator (1 event)
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x000007fefedf7a50
function_name: wine_get_version
module: ntdll
module_address: 0x0000000077560000
-1073741511 0
File has been identified by 11 AntiVirus engine on IRMA as malicious (11 events)
G Data Antivirus (Windows) Virus: Trojan.GenericKD.75760281 (Engine A)
Avast Core Security (Linux) Win64:Trojan-gen
C4S ClamAV (Linux) Win.Trojan.GravityRAT-6511862-0
F-Secure Antivirus (Linux) Heuristic.HEUR/AGEN.1318158 [Aquarius]
eScan Antivirus (Linux) Trojan.GenericKD.75760281(DB)
ESET Security (Windows) a variant of Win64/Agent.PR trojan
DrWeb Antivirus (Linux) BackDoor.GravityRAT.3
WithSecure (Linux) Trojan.TR/Spy.Gen
ClamAV (Linux) Win.Trojan.GravityRAT-6511862-0
Bitdefender Antivirus (Linux) Trojan.GenericKD.75760281
Emsisoft Commandline Scanner (Windows) Trojan.GenericKD.75760281 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.