Summary

34df6753ba3fa12c_dw20.exe

File 34df6753ba3fa12c_dw20.exe

Summary
Download Resubmit sample

Size 12.1MB
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 c3d84af030b1549e67dfd080a8199732
SHA1 b843911df617d69ee7eea15a4d03a48e1dfdf58b
SHA256 34df6753ba3fa12caf5327d7a5fb096a091ed1f2289c31cf3086a827c7e3584b
SHA512
81f310d1432ba4992cfd453630018ef554415414632d878449c010baac9673ade3b233b91ac08454be0b4939c2c54f2be07fc630a0cdca4c309f782e39cb2386
CRC32 975AF67A
ssdeep None
Yara
  • Base64_encoded_Executable - Detects an base64 encoded executable (often embedded)
  • DebuggerException__ConsoleCtrl - (no description)
  • DebuggerException__SetConsoleCtrl - (no description)
  • SEH__vectored - (no description)
  • create_service - Create a windows service
  • network_udp_sock - Communications over UDP network
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS
  • escalate_priv - Escalade priviledges

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6302195

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE April 21, 2025, 3:39 a.m. April 21, 2025, 3:48 a.m. 491 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-04-20 07:35:27,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpsgyfoe
2025-04-20 07:35:27,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\qlPjrNgVcrpnhmVLj
2025-04-20 07:35:27,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\VdZXWdoHlkWYSeIQHDc
2025-04-20 07:35:27,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-04-20 07:35:27,030 [analyzer] INFO: Automatically selected analysis package "exe"
2025-04-20 07:35:27,296 [analyzer] DEBUG: Started auxiliary module Curtain
2025-04-20 07:35:27,296 [analyzer] DEBUG: Started auxiliary module DbgView
2025-04-20 07:35:27,796 [analyzer] DEBUG: Started auxiliary module Disguise
2025-04-20 07:35:28,015 [analyzer] DEBUG: Loaded monitor into process with pid 516
2025-04-20 07:35:28,015 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-04-20 07:35:28,015 [analyzer] DEBUG: Started auxiliary module Human
2025-04-20 07:35:28,015 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-04-20 07:35:28,015 [analyzer] DEBUG: Started auxiliary module Reboot
2025-04-20 07:35:28,092 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-04-20 07:35:28,092 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-04-20 07:35:28,092 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-04-20 07:35:28,092 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-04-20 07:35:28,358 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\34df6753ba3fa12c_dw20.exe' with arguments '' and pid 1460
2025-04-20 07:35:28,625 [analyzer] DEBUG: Loaded monitor into process with pid 1460
2025-04-20 07:35:51,397 [analyzer] INFO: Process with pid 1460 has terminated
2025-04-20 07:35:51,397 [analyzer] INFO: Process list is empty, terminating analysis.
2025-04-20 07:35:52,772 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-04-20 07:35:52,772 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-04-21 03:39:50,110 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:51,139 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:52,166 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:53,179 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:54,200 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:55,474 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:56,491 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:57,512 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:58,536 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:39:59,564 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:00,595 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:01,617 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:02,638 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:03,658 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:04,677 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:05,695 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:06,717 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:07,847 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:08,878 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:09,900 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:10,921 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:11,947 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:12,974 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:14,000 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:15,025 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:16,425 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:17,462 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:18,495 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:19,517 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:20,543 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:21,565 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:22,591 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:23,615 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:24,755 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:25,835 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:26,854 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:27,880 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:28,903 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:29,921 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:30,944 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:31,967 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:32,994 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:34,157 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:35,383 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:36,568 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:37,610 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:38,709 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:39,969 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:41,017 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:42,056 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:43,097 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:44,128 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:45,159 [cuckoo.core.scheduler] DEBUG: Task #6309974: no machine available yet
2025-04-21 03:40:46,208 [cuckoo.core.scheduler] INFO: Task #6309974: acquired machine win7x6413 (label=win7x6413)
2025-04-21 03:40:46,209 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.213 for task #6309974
2025-04-21 03:40:46,669 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3416318 (interface=vboxnet0, host=192.168.168.213)
2025-04-21 03:40:55,421 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6413
2025-04-21 03:40:56,051 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6413 to vmcloak
2025-04-21 03:44:08,343 [cuckoo.core.guest] INFO: Starting analysis #6309974 on guest (id=win7x6413, ip=192.168.168.213)
2025-04-21 03:44:09,348 [cuckoo.core.guest] DEBUG: win7x6413: not ready yet
2025-04-21 03:44:14,378 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6413, ip=192.168.168.213)
2025-04-21 03:44:14,457 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6413, ip=192.168.168.213, monitor=latest, size=6660546)
2025-04-21 03:44:18,045 [cuckoo.core.resultserver] DEBUG: Task #6309974: live log analysis.log initialized.
2025-04-21 03:44:19,009 [cuckoo.core.resultserver] DEBUG: Task #6309974 is sending a BSON stream
2025-04-21 03:44:19,604 [cuckoo.core.resultserver] DEBUG: Task #6309974 is sending a BSON stream
2025-04-21 03:44:20,296 [cuckoo.core.resultserver] DEBUG: Task #6309974: File upload for 'shots/0001.jpg'
2025-04-21 03:44:20,340 [cuckoo.core.resultserver] DEBUG: Task #6309974 uploaded file length: 114604
2025-04-21 03:44:21,565 [cuckoo.core.resultserver] DEBUG: Task #6309974: File upload for 'shots/0002.jpg'
2025-04-21 03:44:21,768 [cuckoo.core.resultserver] DEBUG: Task #6309974 uploaded file length: 127873
2025-04-21 03:44:33,119 [cuckoo.core.guest] DEBUG: win7x6413: analysis #6309974 still processing
2025-04-21 03:44:42,325 [cuckoo.core.resultserver] DEBUG: Task #6309974: File upload for 'shots/0003.jpg'
2025-04-21 03:44:42,344 [cuckoo.core.resultserver] DEBUG: Task #6309974 uploaded file length: 134069
2025-04-21 03:44:43,720 [cuckoo.core.resultserver] DEBUG: Task #6309974: File upload for 'curtain/1745127352.6.curtain.log'
2025-04-21 03:44:43,723 [cuckoo.core.resultserver] DEBUG: Task #6309974 uploaded file length: 36
2025-04-21 03:44:43,738 [cuckoo.core.resultserver] DEBUG: Task #6309974: File upload for 'sysmon/1745127352.76.sysmon.xml'
2025-04-21 03:44:43,754 [cuckoo.core.resultserver] DEBUG: Task #6309974 uploaded file length: 1256318
2025-04-21 03:44:44,396 [cuckoo.core.resultserver] DEBUG: Task #6309974 had connection reset for <Context for LOG>
2025-04-21 03:44:45,246 [cuckoo.core.guest] INFO: win7x6413: analysis completed successfully
2025-04-21 03:44:45,261 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-04-21 03:44:45,287 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-04-21 03:44:46,339 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6413 to path /srv/cuckoo/cwd/storage/analyses/6309974/memory.dmp
2025-04-21 03:44:46,340 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6413
2025-04-21 03:48:00,541 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.213 for task #6309974
2025-04-21 03:48:00,909 [cuckoo.core.scheduler] DEBUG: Released database task #6309974
2025-04-21 03:48:00,922 [cuckoo.core.scheduler] INFO: Task #6309974: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description Detects an base64 encoded executable (often embedded) rule Base64_encoded_Executable
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule SEH__vectored
description Create a windows service rule create_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Escalade priviledges rule escalate_priv
Command line console output was observed (1 event)
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: https://ent34ndx3cz8k.x.pipedream.net//a?son=1450009163&brother=1718314849&selfhash=34df6753ba3fa12caf5327d7a5fb096a091ed1f2289c31cf3086a827c7e3584b&seed=1745127329124023400&runnigfrom=C:\Users\Administrator\AppData\Local\Temp\34df6753ba3fa12c_dw20.exe
console_handle: 0x0000000000000007
1 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)
section .symtab
Raised Snort alerts (1 event)
snort ET INFO DNS Query for Webhook/HTTP Request Inspection Service (x .pipedream .net)
Raised Suricata alerts (3 events)
suricata ET INFO DNS Query for Webhook/HTTP Request Inspection Service (x .pipedream .net)
suricata TGI HUNT VulnTesting Domain (requestbin.net in DNS Lookup)
suricata ET INFO DNSBin Demo (requestbin .net) - Data Exfil
Detects the presence of Wine emulator (1 event)
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x000007feff587a50
function_name: wine_get_version
module: ntdll
module_address: 0x0000000077bf0000
-1073741511 0
File has been identified by 10 AntiVirus engine on IRMA as malicious (10 events)
G Data Antivirus (Windows) Virus: Trojan.GenericKDZ.110428 (Engine A)
Avast Core Security (Linux) Win64:MalwareX-gen [Misc]
C4S ClamAV (Linux) Win.Trojan.GravityRAT-6511862-0
WithSecure (Linux) Trojan.TR/Spy.Gen
eScan Antivirus (Linux) Trojan.GenericKDZ.110428(DB)
ESET Security (Windows) a variant of Win64/Agent.PR trojan
DrWeb Antivirus (Linux) BackDoor.GravityRAT.3
ClamAV (Linux) Win.Trojan.GravityRAT-6511862-0
Bitdefender Antivirus (Linux) Trojan.GenericKDZ.110428
Emsisoft Commandline Scanner (Windows) Trojan.GenericKDZ.110428 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.