Submission Summary:

What's been foundSeverity Level
Downloads/requests other files from Internet.

 

Technical Details:

 

Memory Modifications

Process NameProcess FilenameMain Module Size
winlogon.exe%AppData%\winlogon.exe1,331,200 bytes
[filename of the sample #1][file and pathname of the sample #1]1,331,200 bytes

Service NameDisplay NameStatusService Filename
DRSrvicesDevice Report Services"Running"%AppData%\winlogon.exe

 

Registry Modifications

 

Other details

Server NameServer PortConnect as UserConnection Password
down.nood1e.cf80(null)(null)
ser.cnxc.bid80(null)(null)

 

 

Downloaded File Summary:

What's been foundSeverity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.

 

Technical Details:

 

File System Modifications

#Filename(s)File SizeFile HashAlias
1 %Temp%\1521223063069_Speed.bat 77 bytes MD5: 0x9DE23767175E9D69B3AC353242ED9C5A
SHA-1: 0xD1F3C4B006493140277D6A201F0C8299FD13C69F
(not available)
2 %Temp%\1521223150100_Speed.bat 77 bytes MD5: 0xC05F7877D3758D97AE1EECE75FA90974
SHA-1: 0xB3945979E468A717F8896A9BDF436C2E88291122
(not available)
3 %Temp%\1521223162069_Speed.bat 77 bytes MD5: 0x1D46EE608056D0FB705B601457450F59
SHA-1: 0xE13287A985CA7C0E5144E4F10AA3EBAE39838988
(not available)
4 %Temp%\1521223163382_Speed.bat 77 bytes MD5: 0x26DFF3A572680117F02B6AA7BB63EB68
SHA-1: 0xDBD2437D2EE03A7D158984CB3CF789723693B3C7
(not available)
5 %Windir%\Debug\debugconfig\services.exe 4,301,824 bytes MD5: 0xCF0FB6F0836D56BB48AC0BE25B3B90A7
SHA-1: 0xD8C90D720525908D93E89469179A286F2A65163B
packed with ASPack [Kaspersky Lab]
6 %Windir%\Debug\debugconfig\zip.dll 464,384 bytes MD5: 0x6DF0ED0AFE162198116BE68ABA60E0C4
SHA-1: 0xBD0CA25FF4E495717BE7345933AAA90755E5A6CA
(not available)
7 %System%\boxlou.exe
[file and pathname of the sample #1]
101,888 bytes MD5: 0xFB0B72A555A5109C01B69342F2799F1D
SHA-1: 0x333E44F19CD3600F3C0069D4CF5B00BB01B9CCAE
packed with ASPack [Kaspersky Lab]

 

Memory Modifications

Process NameProcess FilenameMain Module Size
boxlou.exe%System%\boxlou.exe233,472 bytes
services.exe%Windir%\debug\debugconfig\services.exe5,107,712 bytes
csrss.exe%Windir%\debug\debugconfig\csrss.exe61,440 bytes
[filename of the sample #1][file and pathname of the sample #1]233,472 bytes
[filename of the sample #2][file and pathname of the sample #2]5,107,712 bytes
spoolsv.exe%Windir%\debug\debugconfig\spoolsv.exe57,344 bytes
svchost.exe%Windir%\debug\debugconfig\svchost.exe143,360 bytes

Service NameDisplay NameStatusService Filename
PowerShadowMicrosoft PowerMaster"Running"%System%\boxlou.exe

 

Registry Modifications

 

Other details

China
Spain

PortProtocolProcess
1033TCPboxlou.exe (%System%\boxlou.exe)

Remote HostPort Number
yk.cnxc.tk9800

Server NameServer PortConnect as UserConnection Password
down.nood1e.cf80(null)(null)

 

Outbound traffic (potentially malicious)

 

 

Downloaded Files Summary (Generation #2):

What's been foundSeverity Level
Downloads/requests other files from Internet.

 

Technical Details:

 

Memory Modifications

Process NameProcess FilenameMain Module Size
[generic host process][generic host process filename]20,480 bytes

Module NameModule FilenameAddress Space Details
[filename of the sample #2][file and pathname of the sample #2]Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0xB10000 - 0xB9C000

 

Other details

URL to be downloadedFilename for the downloaded bits
http://205.209.177.18/mm/svchosx.exe%Temp%\\ebfec.exe
????????8??I?4????e`};?T?0@h/8

 

 

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2018 ThreatExpert. All rights reserved.