Analyzing...

File Name: BitcoinBot_v_3.13.exe

SHA1: 1e3d1d78777a591ca7524f2ab681e407718a1a1d

MD5: 00131f2d3e297eb02a4bc13a08f4f9a9

First Seen Date: 2017-08-04 03:36:47.240962 ( 2017-08-04 03:36:47.240962 )

Number of Clients Seen: 2

Last Analysis Date: 2017-08-04 03:36:47.240962 ( 2017-08-04 03:36:47.240962 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-08-04 03:36:47.240962	Malware
Static Analysis Overall Verdict	2017-08-04 03:36:47.240962	No Threat Found
Dynamic Analysis Overall Verdict	2017-08-04 03:36:47.240962	No Threat Found
Precise Detectors Overall Verdict	2017-08-04 03:36:47.240962	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Suspicious
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Creates a child process
Writes to address space of another process
Uses a function clandestinely
Reads memory of another process
Opens a file in a system directory
Has no visible windows

Behavioral Information

SetFilePointer

{"lDistanceToMove": "fffffc00", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "0", "hFile": "1dc"}

{"lDistanceToMove": "fffffc00", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "0", "hFile": "2ac"}

QueryFilePath

C:\Windows\system32\ODBC32.dll

C:\BitcoinBot_v_3.13.exe

C:\Windows\system32\TAPI32.dll

C:\Windows\system32\MSACM32.dll

C:\Windows\SysWOW64\ieframe.dll

C:\Windows\system32\PROPSYS.dll

ReadRegisteryKey

FrameMerging

CreateUriCacheSize

EnablePunycode

DisableSecuritySettingsCheck

Priority1

SpecialFoldersCacheSize

FrameTabWindow

SessionMerging

NoPCMConverter

AdminTabProcs

TabProcGrowth

SystemSetupInProgress

RegSetValue

{"Reserved": "0", "hKey": "184", "lpData": "79a900", "dwType": "3", "lpValueName": "aFormatTagCache", "cbData": "18"}

{"Reserved": "0", "hKey": "184", "lpData": "7b4fb0", "dwType": "3", "lpValueName": "aFormatTagCache", "cbData": "10"}

{"Reserved": "0", "hKey": "184", "lpData": "41ec98", "dwType": "4", "lpValueName": "fdwSupport", "cbData": "4"}

{"Reserved": "0", "hKey": "184", "lpData": "41ec9c", "dwType": "4", "lpValueName": "cFilterTags", "cbData": "4"}

{"Reserved": "0", "hKey": "184", "lpData": "7acf48", "dwType": "3", "lpValueName": "aFormatTagCache", "cbData": "10"}

{"Reserved": "0", "hKey": "184", "lpData": "41eca0", "dwType": "4", "lpValueName": "cFormatTags", "cbData": "4"}

{"Reserved": "0", "hKey": "184", "lpData": "7b5028", "dwType": "3", "lpValueName": "aFormatTagCache", "cbData": "10"}

{"h_key": "180", "samDesired": "20006", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "0", "dwOptions": "0", "lpClass": "<NULL>", "phkResult": "41ec10", "lpSubKey": "Software\\Microsoft\\Multimedia\\Audio Compression Manager\\"}

{"h_key": "180", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "0", "dwOptions": "0", "lpClass": "<NULL>", "phkResult": "41edc0", "lpSubKey": "WaveFormats"}

{"h_key": "180", "samDesired": "20006", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "0", "dwOptions": "0", "lpClass": "<NULL>", "phkResult": "41ef40", "lpSubKey": "Software\\Microsoft\\Multimedia\\Audio Compression Manager\\"}

{"h_key": "184", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "0", "dwOptions": "0", "lpClass": "<NULL>", "phkResult": "41f100", "lpSubKey": "MSACM"}

{"h_key": "80000001", "samDesired": "20006", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "0", "dwOptions": "0", "lpClass": "<NULL>", "phkResult": "41edc4", "lpSubKey": "Software\\Microsoft\\Multimedia\\Audio\\"}

{"h_key": "188", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "0", "dwOptions": "0", "lpClass": "<NULL>", "phkResult": "41ec08", "lpSubKey": "Priority v4.00"}

{"h_key": "180", "samDesired": "20006", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "0", "dwOptions": "0", "lpClass": "<NULL>", "phkResult": "41f108", "lpSubKey": "Software\\Microsoft\\Multimedia\\Audio Compression Manager\\"}

{"h_key": "184", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "0", "dwOptions": "0", "lpClass": "<NULL>", "phkResult": "41ef38", "lpSubKey": "Priority v4.00"}

CreateFile

{"dwCreationDisposition": "2", "path": "C:\\ProgramData\\bitcoin_bot.exe", "dwDesiredAccess": "40000000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "\\??\\C:\\Windows\\SysWOW64\\ieframe.dll", "dwDesiredAccess": "80", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "dwDesiredAccess": "80000000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\ProgramData\\bitcoin_bot.exe", "dwDesiredAccess": "20000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\System32\\rundll32.exe", "dwDesiredAccess": "20000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\Windows", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\\\d3dx9_27.dll", "dwDesiredAccess": "40000000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\System32", "dwDesiredAccess": "100081", "dwShareMode": "7"}

OpenRegisteryKey

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\BidInterface\\Loader"}

{"hKey": "204", "phkResult": "0", "lpSubKey": "FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "204", "phkResult": "0", "lpSubKey": "FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\PDH"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software"}

{"hKey": "204", "phkResult": "0", "lpSubKey": "FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\CurrentControlSet\\Control\\MediaResources\\acm"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "204", "phkResult": "0", "lpSubKey": "FEATURE_LOCALMACHINE_LOCKDOWN"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\ODBC\\ODBC.INI\\ODBC"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\Setup"}

{"hKey": "204", "phkResult": "0", "lpSubKey": "FEATURE_PROTOCOL_LOCKDOWN"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "270", "phkResult": "0", "lpSubKey": "Microsoft\\Internet Explorer\\Security"}

{"hKey": "204", "phkResult": "0", "lpSubKey": "FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "SOFTWARE\\ODBC\\ODBC.INI\\ODBC"}

{"hKey": "204", "phkResult": "0", "lpSubKey": "FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "26c", "phkResult": "0", "lpSubKey": "Microsoft\\Internet Explorer\\Security"}

CreateMutex

<NULL>

Zzz...

Local\ZonesCacheCounterMutex

Local\ZonesLockedCacheCounterMutex

OpenMutex

Zzz...

WriteFile

{"nNumberOfBytesToWrite": "1000", "lpOverlapped": "0", "lpBuffer": "2e5e058", "lpNumberOfBytesWritten": "41e720", "hFile": "1b0"}

{"nNumberOfBytesToWrite": "ce0", "lpOverlapped": "0", "lpBuffer": "2e5e058", "lpNumberOfBytesWritten": "41e7fc", "hFile": "1b0"}

{"nNumberOfBytesToWrite": "e00", "lpOverlapped": "0", "lpBuffer": "2e5d058", "lpNumberOfBytesWritten": "41e7fc", "hFile": "1cc"}

{"nNumberOfBytesToWrite": "1000", "lpOverlapped": "0", "lpBuffer": "2e5d058", "lpNumberOfBytesWritten": "41e720", "hFile": "1cc"}

CreateProcess

"C:\ProgramData\bitcoin_bot.exe"

LoadLibrary

C:\Windows\system32\odbcint.dll

imm32.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

comctl32.dll

API-MS-WIN-Service-Management-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

kernel32

WINTRUST.dll

imaadp32.acm

msg711.acm

msgsm32.acm

msadp32.acm

KERNEL32.dll

SHELL32.dll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-localization-l1-2-1

ADVAPI32.dll

propsys.dll

ole32.dll

C:\Windows\SysWOW64\ieframe.dll

kernel32.dll

ntmarta.dll

Secur32.dll

API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL

OLEAUT32.dll

api-ms-win-downlevel-advapi32-l2-1-0.dll

api-ms-win-appmodel-runtime-l1-1-1

ext-ms-win-kernel32-package-current-l1-1-0

QueryProcessAddress

ShellExecuteW

IsDebuggerPresent

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise Adware Prepscram 1	2017-08-04 03:35:28.084828	No Match	No match.
Static Precise Trojan Cryptor Detector 1	2017-08-04 03:35:28.090615	No Match	No match.
Yara Rule Static Malware Detector	2017-08-04 03:35:27.990500	No Match	No match.
Static Precise PUA Detector 1	2017-08-04 03:35:28.102971	No Match	NotDetected
Static Precise Virus Detector	2017-08-04 03:35:28.126817	No Match	NotDetected
Static Precise Trojan Detector	2017-08-04 03:35:28.123434	No Match	NotDetected
Static Precise PUA Detector 2	2017-08-04 03:35:28.127865	No Match	No match.
Static Precise PUA Detector 3	2017-08-04 03:35:28.128033	No Match	No match.
Static Precise Virus Hezhi Detector	2017-08-04 03:35:28.134502	No Match	No match.
Ransomware Chunk Detector	2017-08-04 03:35:31.738501	No Match	No match.
Static Precise Virus Detector 2	2017-08-04 03:35:28.040378	No Match	NotDetected
Static Precise Trojan Detector 2	2017-08-04 03:35:28.060177	No Match	NotDetected
Static Precise Trojan Detector 3	2017-08-04 03:35:28.050189	No Match	NotDetected
Static Precise Adware InstallCore Detector 1	2017-08-04 03:35:28.058532	No Match	NotDetected
Static Precise Trojan Generic Cryptor Detector 1	2017-08-04 03:35:28.058135	No Match	NotDetected
Malicious Url Detector	2017-08-04 03:36:47.214770	No Match	No match.

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5