0

I noticed it becaue one of these exe's started running after a BSOD.

Putting one of the exe's into VirusTotal gives it a 3/70. How can I examine this further?

Edit: Other exe's are worse: VirusTotal 23/71 as Trojan, CoinMiner, ... Yep.

enter image description here

Improve this question
6
  • You can look at the .c file, it might have some information about what it's trying to do.
    – user
    Commented Feb 23, 2022 at 17:21
  • @user it has a bunch of functions, one of them is credited to Memory DLL loading code - Copyright (c) 2004-2015 by Joachim Bauch / [email protected], the header also starts defining #ifdef PAYLOAD_FIRST, #ifdef PAYLOAD_SECOND, ... So is it safe to assume that this is not a windows thing but someone's infectious program?
    – Vepir
    Commented Feb 23, 2022 at 17:32
  • A compromised system (which is certainly looks like someone made a makeshift modified trojan or similar) should be nuked from orbit. Just out of curiosity - what does the uninstall.bat file contain? Just please don't execute it...
    – Sir Muffington
    Commented Feb 23, 2022 at 18:32
  • @SirMuffington __uninstall.bat
    – Vepir
    Commented Feb 23, 2022 at 18:34
  • It seems the source code included for some reason is used for fileless malware, which is injected into the RAM. It might be a banking trojan, it might be a cryptominer it could be anything. It also seems to update itself as well, so maybe it's even metamorphic
    – Sir Muffington
    Commented Feb 23, 2022 at 18:34

2 Answers 2

Reset to default
1

It's very likely not a Microsoft Windows executable and its dependencies are also not Microsoft Windows related (it might use Windows API Calls for malicious purposes though). The random string is likely there to prevent detection by AV solutions(?)

What you have at your hands is very likely a so-called fileless malware, which sits in your memory, but it seems to be amateur-like, since usually you don't get such useful clues to identify as you did.

If you go to the website joachim-bauch.de you can see in the comments that the original source code has been modified for new strains of malware of this kind as mentioned earlier.

Your next step would be apparently possibly saving files you have on the system (not recommended by me though) and then nuking it from orbit. Just pray to god it's not one of those newer malwares which also have the functionality to get persistance in your hardware's firmware, meaning it would last even after reinstalling Windows.

Improve this answer
4
  • I agree that it should be nuked, but if this folder is just temporary, I wonder where the other parts of the malware are hiding. (Neither Malwarebytes nor WindowsDefender found anything else.)
    – Vepir
    Commented Feb 25, 2022 at 17:01
  • In your memory (RAM)
    – Sir Muffington
    Commented Feb 25, 2022 at 17:11
  • If only RAM remains, how does it persist?
    – Vepir
    Commented Feb 25, 2022 at 17:14
  • It could've in theory injected into your HDD's/SSD's controller firmware or something similar if it's advanced. I think that kind of code has been open sourced by Shadow Brokers. In your case, it's highly likely just itself on your HDD/SSD, but don't quote me on that. And also if I'm wrong I'm open to critique
    – Sir Muffington
    Commented Feb 25, 2022 at 17:17
0

It's definitely not a MS Windows thing. Trojan alerts usually comes from reads and writes to memory from a non-signed executable and folder name looks like a generated string, which means it is a 99% malicious software. My suggestion is to delete it and review all running processes for something unusual.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .