Cuckoo Sandbox

File b3c43f1954f50e1cd3d72ac10db4f3585cb24458b3fb0709ebf710c1e5bee303

Summary
Download Resubmit sample

Size	11.5MB
Type	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5	`2e6bf847df78826f548203eb2baf5c67`
SHA1	`104544b9dfdff0427c134aa765403b864a2829b2`
SHA256	`b3c43f1954f50e1cd3d72ac10db4f3585cb24458b3fb0709ebf710c1e5bee303`
SHA512	`cb63f20d0f8a9905071cb6c558a4d4e20f08b43989f3b15642eb3dd0046f4957a62df6d1c37091c92a30ae90d1353cbad6d411e0234bffd278cd060483451f52`
CRC32	`9E1ABA13`
ssdeep	`None`
Yara	Base64_encoded_Executable - Detects an base64 encoded executable (often embedded) DebuggerException__ConsoleCtrl - (no description) DebuggerException__SetConsoleCtrl - (no description) SEH__vectored - (no description) create_service - Create a windows service network_udp_sock - Communications over UDP network network_tcp_listen - Listen for incoming communication network_tcp_socket - Communications over RAW socket network_dns - Communications use DNS escalate_priv - Escalade priviledges

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

6309973

6309974

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	April 20, 2025, 12:29 a.m.	April 20, 2025, 12:35 a.m.	400 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-04-19 16:04:56,030 [analyzer] DEBUG: Starting analyzer from: C:\tmp564etj
2025-04-19 16:04:56,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\vKmZyaBiFeNKrOyPlOPyyUjMtHIvFPB
2025-04-19 16:04:56,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\gFuRjKxXbZfhVsDqRluGzdnZFtGlyu
2025-04-19 16:04:56,328 [analyzer] DEBUG: Started auxiliary module Curtain
2025-04-19 16:04:56,328 [analyzer] DEBUG: Started auxiliary module DbgView
2025-04-19 16:04:56,937 [analyzer] DEBUG: Started auxiliary module Disguise
2025-04-19 16:04:57,140 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-04-19 16:04:57,140 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-04-19 16:04:57,140 [analyzer] DEBUG: Started auxiliary module Human
2025-04-19 16:04:57,140 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-04-19 16:04:57,140 [analyzer] DEBUG: Started auxiliary module Reboot
2025-04-19 16:04:57,233 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-04-19 16:04:57,233 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-04-19 16:04:57,233 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-04-19 16:04:57,233 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-04-19 16:04:57,483 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\b3c43f1954f50e1cd3d72ac10db4f3585cb24458b3fb0709ebf710c1e5bee303.exe' with arguments '' and pid 2712
2025-04-19 16:04:57,750 [analyzer] DEBUG: Loaded monitor into process with pid 2712
2025-04-19 23:33:15,532 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Windows\System32\.exe
2025-04-19 23:33:15,611 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL
2025-04-19 23:33:15,648 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.exe
2025-04-19 23:33:15,740 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL
2025-04-19 23:33:15,763 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.exe
2025-04-19 23:33:15,805 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
2025-04-19 23:33:15,841 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.exe
2025-04-19 23:33:15,887 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
2025-04-19 23:33:15,923 [analyzer] INFO: Added new file to list with pid 2712 and path C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.exe
2025-04-19 23:33:16,983 [analyzer] INFO: Process with pid 2712 has terminated
2025-04-19 23:33:16,983 [analyzer] INFO: Process list is empty, terminating analysis.
2025-04-19 23:33:18,388 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-04-19 23:33:19,311 [analyzer] WARNING: File at path u'c:\\windows\\system32\\.exe' does not exist, skip.
2025-04-19 23:33:20,154 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-04-20 00:29:08,622 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:09,649 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:10,675 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:11,697 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:12,730 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:13,881 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:15,048 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:16,089 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:17,123 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:18,150 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:19,388 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:20,428 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:21,460 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:22,492 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:23,542 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:24,603 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:25,653 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:26,697 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:27,735 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:28,776 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:30,081 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:31,155 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:32,351 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:33,740 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:34,774 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:35,807 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:36,834 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:38,348 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:39,380 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:40,428 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:41,677 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:42,706 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:43,727 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:44,782 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:45,900 [cuckoo.core.scheduler] DEBUG: Task #6302195: no machine available yet
2025-04-20 00:29:47,060 [cuckoo.core.scheduler] INFO: Task #6302195: acquired machine win7x6419 (label=win7x6419)
2025-04-20 00:29:47,062 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.219 for task #6302195
2025-04-20 00:29:47,597 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 853654 (interface=vboxnet0, host=192.168.168.219)
2025-04-20 00:29:54,660 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6419
2025-04-20 00:29:55,330 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6419 to vmcloak
2025-04-20 00:32:42,888 [cuckoo.core.guest] INFO: Starting analysis #6302195 on guest (id=win7x6419, ip=192.168.168.219)
2025-04-20 00:32:43,894 [cuckoo.core.guest] DEBUG: win7x6419: not ready yet
2025-04-20 00:32:48,915 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6419, ip=192.168.168.219)
2025-04-20 00:32:49,004 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6419, ip=192.168.168.219, monitor=latest, size=6660546)
2025-04-20 00:32:51,428 [cuckoo.core.resultserver] DEBUG: Task #6302195: live log analysis.log initialized.
2025-04-20 00:32:52,513 [cuckoo.core.resultserver] DEBUG: Task #6302195 is sending a BSON stream
2025-04-20 00:32:53,044 [cuckoo.core.resultserver] DEBUG: Task #6302195 is sending a BSON stream
2025-04-20 00:32:53,788 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'shots/0001.jpg'
2025-04-20 00:32:53,804 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 112815
2025-04-20 00:32:54,962 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'shots/0002.jpg'
2025-04-20 00:32:54,977 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 128070
2025-04-20 00:33:06,361 [cuckoo.core.guest] DEBUG: win7x6419: analysis #6302195 still processing
2025-04-20 00:33:15,912 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'shots/0003.jpg'
2025-04-20 00:33:15,930 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 130745
2025-04-20 00:33:17,028 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'shots/0004.jpg'
2025-04-20 00:33:17,038 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 133599
2025-04-20 00:33:18,037 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'curtain/1745098398.12.curtain.log'
2025-04-20 00:33:18,051 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 36
2025-04-20 00:33:18,263 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'sysmon/1745098398.37.sysmon.xml'
2025-04-20 00:33:18,287 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 1710772
2025-04-20 00:33:18,376 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'files/34df6753ba3fa12c_dw20.exe'
2025-04-20 00:33:18,466 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 12715663
2025-04-20 00:33:18,564 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'files/f7fc4bd58a59eb6f_msaddndr.dll'
2025-04-20 00:33:19,005 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 12785295
2025-04-20 00:33:19,106 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'files/1da285b08ba60980_dw20.exe.exe'
2025-04-20 00:33:19,199 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 12799639
2025-04-20 00:33:19,289 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'files/bc2665f6a37a42a9_dwtrig20.exe.exe'
2025-04-20 00:33:19,353 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 12859031
2025-04-20 00:33:19,445 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'files/15cea630e7bfc996_msaddndr.dll.exe'
2025-04-20 00:33:19,526 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 12813975
2025-04-20 00:33:19,619 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'files/ef5611b9af0504bc_dwtrig20.exe'
2025-04-20 00:33:19,690 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 12769935
2025-04-20 00:33:19,796 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'files/32485409da180270_dbghelp.dll.exe'
2025-04-20 00:33:19,873 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 12859031
2025-04-20 00:33:19,972 [cuckoo.core.resultserver] DEBUG: Task #6302195: File upload for 'files/f3cfdb195dd6d674_dbghelp.dll'
2025-04-20 00:33:20,050 [cuckoo.core.resultserver] DEBUG: Task #6302195 uploaded file length: 12794511
2025-04-20 00:33:20,080 [cuckoo.core.resultserver] DEBUG: Task #6302195 had connection reset for <Context for LOG>
2025-04-20 00:33:21,468 [cuckoo.core.guest] INFO: win7x6419: analysis completed successfully
2025-04-20 00:33:21,481 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-04-20 00:33:21,506 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-04-20 00:33:22,579 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6419 to path /srv/cuckoo/cwd/storage/analyses/6302195/memory.dmp
2025-04-20 00:33:22,580 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6419
2025-04-20 00:35:45,321 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.219 for task #6302195
2025-04-20 00:35:47,583 [cuckoo.core.scheduler] DEBUG: Released database task #6302195
2025-04-20 00:35:47,846 [cuckoo.core.scheduler] INFO: Task #6302195: analysis procedure completed

Signatures

Yara rules detected for file (10 events)

description	Detects an base64 encoded executable (often embedded)	rule	Base64_encoded_Executable
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	SEH__vectored
description	Create a windows service	rule	create_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Escalade priviledges	rule	escalate_priv

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 19, 2025, 5:04 p.m.	buffer: https://ent34ndx3cz8k.x.pipedream.net//a?son=1278494033&brother=1732066570&selfhash=b3c43f1954f50e1cd3d72ac10db4f3585cb24458b3fb0709ebf710c1e5bee303&seed=1745071498180664100&runnigfrom=C:\Users\Administrator\AppData\Local\Temp\b3c43f1954f50e1cd3d72ac10db4f3585cb24458b3fb0709ebf710c1e5bee303.exe console_handle: 0x0000000000000007	1	1
WriteConsoleW April 19, 2025, 5:05 p.m.	buffer: C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL console_handle: 0x0000000000000007	1	1
WriteConsoleW April 19, 2025, 5:05 p.m.	buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL console_handle: 0x0000000000000007	1	1
WriteConsoleW April 19, 2025, 5:05 p.m.	buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE console_handle: 0x0000000000000007	1	1
WriteConsoleW April 19, 2025, 5:05 p.m.	buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE console_handle: 0x0000000000000007	1	1
WriteConsoleW April 19, 2025, 5:05 p.m.	buffer: C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL console_handle: 0x0000000000000007	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.symtab

Creates executable files on the filesystem (9 events)

file	C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
file	C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.exe
file	C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.exe
file	c:\Windows\System32\.exe
file	C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL
file	C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.exe
file	C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
file	C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.exe
file	C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL

Raised Snort alerts (1 event)

snort

ET INFO DNS Query for Webhook/HTTP Request Inspection Service (x .pipedream .net)

Raised Suricata alerts (3 events)

suricata	ET INFO DNS Query for Webhook/HTTP Request Inspection Service (x .pipedream .net)
suricata	TGI HUNT VulnTesting Domain (requestbin.net in DNS Lookup)
suricata	ET INFO DNSBin Demo (requestbin .net) - Data Exfil

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\(Default)

reg_value

c:\Windows\System32\.exe

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress April 19, 2025, 5:04 p.m.	ordinal: 0 function_address: 0x000007fefedf7a50 function_name: wine_get_version module: ntdll module_address: 0x0000000077560000		-1073741511	0

File has been identified by 12 AntiVirus engine on IRMA as malicious (12 events)

G Data Antivirus (Windows)	Virus: Trojan.GenericKDZ.110428 (Engine A)
Avast Core Security (Linux)	Win64:MalwareX-gen [Misc]
C4S ClamAV (Linux)	Win.Trojan.GravityRAT-6511862-0
WithSecure (Linux)	Trojan.TR/Spy.Gen
eScan Antivirus (Linux)	Trojan.GenericKDZ.110428(DB)
ESET Security (Windows)	a variant of Win64/Agent.PR trojan
Sophos Anti-Virus (Linux)	Mal/Generic-S
DrWeb Antivirus (Linux)	BackDoor.GravityRAT.3
ClamAV (Linux)	Win.Trojan.GravityRAT-6511862-0
Bitdefender Antivirus (Linux)	Trojan.GenericKDZ.110428
Kaspersky Standard (Windows)	HEUR:Trojan.Win32.Vimditator.gen
Emsisoft Commandline Scanner (Windows)	Trojan.GenericKDZ.110428 (B)