MalAgent.J_90178 is a Virus. Virus is a type of malware that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data files, or the boot sector of the hard drive
Mutexes created
- d0e9f0850000073c
- Global\{2d17e659d34601689591}
Directory level activity
File level activity- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\6253f28473b9a9818c2be0e6059dc292.bin
- write - file - PIPE\lsarpc
- delete - file - C:\Documents and Settings\TestMachine\Local Settings\Application Data\msqDB4A.tmp.bat
- write - file - C:\Documents and Settings\All Users\Application Data\bfb4d370.exe
- write - file - C:\Documents and Settings\TestMachine\Local Settings\Application Data\msqDB4A.tmp.bat
Registry level activity- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCommon AppData
- write - registry - HKEY_CURRENT_USER\software\microsoft\windows4334c972
- write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersLocal AppData
Library level activity- load - library - advapi32
- load - library - ntdll
- load - library - KERNEL32.DLL
- load - library - ADVAPI32.dll
- load - library - KERNEL32.dll
- load - library - USER32.dll
- load - library - GDI32.dll
- load - library - SHELL32.dll
- load - library - WS2_32.dll
- load - library - SHLWAPI.dll
- load - library - ntdll.dll
- load - library - CRYPT32.dll
- load - library - msvcrt.dll
- load - library - ole32.dll
- load - library - gdiplus.dll
- load - library - WinSCard.dll
- load - library - IPHLPAPI.DLL
- load - library - WINTRUST.dll
- load - library - WININET.dll
- load - library - NETAPI32.dll
- load - library - USERENV.dll
- load - library - rsaenh.dll
- load - library - mscoree.dll
- load - library - PSAPI.DLL
- load - library - VERSION.dll
- load - library - kernel32.dll
- load - library - snxhk.dll
- load - library - sbiedll.dll
- load - library - ntdll.dll
Process API calls used
- NtCreateSection
- ZwMapViewOfSection
- NtProtectVirtualMemory
- VirtualProtectEx
Registry API calls used
System API calls used
- NtDelayExecution
- LdrLoadDll
- LdrGetDllHandle
- LdrGetProcedureAddress
Filesystem API calls used
Network
UDP source >> destination
- 192.168.30.254 >> 192.168.30.6
- 192.168.30.6 >> 192.168.30.254
- 192.168.30.6 >> 192.168.30.255
- 192.168.30.6 >> 8.8.8.8
TCP source >> destination
- 192.168.30.6 >> 192.168.30.254
Domains:- download.windowsupdate.com with IP - 209.197.3.8
- adtejoyo1377.tk with IP -
DNS Request:- adtejoyo1377.tk
- download.windowsupdate.com
HTTP Request:
DLL related data
Number of DLL's imported = 5
- ADVAPI32.dll
- USER32.dll
- KERNEL32.dll
- KERNEL32.dll
- msvcrt.dll
|
