2b277c41...90cf | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 98/100
Dynamic Analysis Report
Classification: Trojan, Keylogger, Spyware

2b277c411944cb25bf454ad5dc38d32e8eed45eac058304982c15646720990cf (SHA256)

beckky.exe

Windows Exe (x86-32)

Created at 2018-10-24 12:43:00

...

Notifications (2/3)

One or multiple processes crashed. As a result, the analysis results may be incomplete and may not fully represent the behavior of the sample.

Code overwrite was observed during this analysis. Note that the analysis results may be affected by this modification by the sample.

The operating system was rebooted during the analysis.

Indicators

File (13)
»
Filename Hash Operations Source
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\adsldraw\autoclb.exe MD5: 14624a38abffbc5bc154d77b12b08545
SHA1: 407a3151dc9d1584d5221947177e453741da906a
SHA256: d3fb843d103652b6ccdeeed6b89bf39dfedec35faa0452577e7a9ba8a965a08c
SSDeep: 24576:Y9m8Qa/0cxZs5yMmH1EQgVhA3NZNnXofn/DOhmFFt:k/0cxZssFgVhmTNXmbzd
ImpHash: None 		Access, Write Created File
C:\Users\CIiHmnxMn6Ps\Desktop - Access
"C:\Users\CIIHMN~1\AppData\Local\Temp\D232\4099.bat" - Access
"C:\Users\CIIHMN~1\AppData\Roaming\adsldraw\autoclb.exe" - Access
C:\Users\CIiHmnxMn6Ps\Desktop\beckky.exe MD5: 2024c021e1da73ce79f6fc96a6289eb0
SHA1: 257ec0250896eefd97a67f6120419b7fc07e1ccc
SHA256: 2b277c411944cb25bf454ad5dc38d32e8eed45eac058304982c15646720990cf
SSDeep: 24576:Im8Qa/0cxZs5yMmH1EQgVhA3NZNnXofn/DOhmFFt:G/0cxZssFgVhmTNXmbzd
ImpHash: 1aecd7211a9bf2a6f5ea6cad3cff4d1e 		Access, Read Sample File
C:\Users\CIIHMN~1\AppData\Local\Temp\98F9CE91 - Access
C:\Users\CIIHMN~1\AppData\Local\Temp\D232 - Access
C:\Users\CIIHMN~1\AppData\Local\Temp\D232.tmp - Access
C:\Users\CIIHMN~1\AppData\Local\Temp\D232\4099.bat MD5: 5ab1685ac3e369f0e071d8bce200add8
SHA1: 493e8a529a2d815564c4e30728402a4976634b5a
SHA256: 20508bdc4f179c7daca31cea5ef3c226445bb81f543823e5535e280d18e5ce4f
SSDeep: 3:MqDFu6OWRNfeURzTovG+gU64vHXMJATkUEzQQTovBs+n:rlRhJTVGvvHXMJ2dgtTl+n
ImpHash: None 		Access, Write Created File
C:\Users\CIIHMN~1\AppData\Local\Temp\D232\4099.tmp MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3::
ImpHash: None 		Access Created File
C:\Windows\system32\c_1252.nls - Access
C:\Windows\SYSTEM32\ntdll.dll - Access, Read
Registry (40)
»
Registry Key Name Operations
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableSPDY3_0 Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 Access
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530\Client Read, Write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530\Ini Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530\Install Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530\Scr Read
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530\{111F6A44-3C4D-6BC7-CED5-30CFE2D96473} Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\cabilipc Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_USERS Access
HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530 Access
HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530\Client Read
HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\AppDataLow\Software\Microsoft\667F6611-8D0F-88EB-47FA-113C6BCED530\Install Write
HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Access
HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData Read
HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Run Access
HKEY_USERS\S-1-5-21-1462094071-1423818996-289466292-1000\Software\Microsoft\Windows\CurrentVersion\Run\cabilipc Write
Mutex (5)
»
Mutex Name Operations
Local\{53667D0F-9637-FD89-3837-2A81EC5BFE45} Access
Local\{6C433A47-DB67-7E7B-C560-3F92C994E3E6} Access
Local\{FB999B87-1EC7-E503-005F-32E93403862D} Access
{1294B7E5-49A4-1461-6366-8D8847FA113C} Access
{CAF7338F-A104-8C55-7B9E-6580DFB269B4} Access
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image