| File name: | Battle.net-Setup.exe |
| Full analysis: | https://app.any.run/tasks/da9c885e-61bb-4ac0-b752-31d50391f7be |
| Verdict: | Malicious activity |
| Analysis date: | May 10, 2025, 04:00:19 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | F7FE24CEBBC4B0332C77BCE563E11B1D |
| SHA1: | 744968C9193E5A1B96941695600D3770E61A6FFA |
| SHA256: | 002F33FEE7B8A159058368B7E93E492931C4CA72E90660BDB2691BCD62FEDD3C |
| SSDEEP: | 98304:sdpEDlZPq7VZYLwZ6SbP+04w1n+5aSdNbgl8LoA94D1PfjWEeJfZX/BufZdERaQP:jqO |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 6752)
- Agent.exe (PID: 856)
- AgentHelper.exe (PID: 6040)
Application launched itself
- Battle.net-Setup.exe (PID: 5596)
Checks for external IP
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
Potential Corporate Privacy Violation
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
Executable content was dropped or overwritten
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 856)
- AgentHelper.exe (PID: 6040)
Connects to unusual port
- Battle.net-Setup.exe (PID: 4120)
- Battle.net-Setup.exe (PID: 5596)
- Agent.exe (PID: 856)
Process drops legitimate windows executable
- Agent.exe (PID: 856)
The process drops C-runtime libraries
- Agent.exe (PID: 856)
INFO
Reads the computer name
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 856)
- AgentHelper.exe (PID: 6040)
- Agent.exe (PID: 6752)
Creates files in the program directory
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 6752)
- Agent.exe (PID: 856)
- AgentHelper.exe (PID: 6040)
Checks supported languages
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 6752)
- Agent.exe (PID: 856)
- AgentHelper.exe (PID: 6040)
Reads the machine GUID from the registry
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- AgentHelper.exe (PID: 6040)
- Agent.exe (PID: 856)
Checks proxy server information
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 856)
Reads the software policy settings
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 856)
- AgentHelper.exe (PID: 6040)
Creates files or folders in the user directory
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 856)
Process checks computer location settings
- Battle.net-Setup.exe (PID: 5596)
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 856)
- Agent.exe (PID: 6752)
The sample compiled with english language support
- Battle.net-Setup.exe (PID: 4120)
- Agent.exe (PID: 856)
- AgentHelper.exe (PID: 6040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:08:04 01:44:13+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.15 |
| CodeSize: | 2932736 |
| InitializedDataSize: | 1978368 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x13b686 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.18.10.3141 |
| ProductVersionNumber: | 1.18.10.3141 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| LegalCopyright: | © 2005-2023 Blizzard Entertainment Inc. |
| InternalName: | Battle.net Setup |
| FileVersion: | 1.18.10.3141 |
| CompanyName: | Blizzard Entertainment |
| ProductName: | Battle.net Setup |
| ProductVersion: | 1.18.10.3141 |
| FileDescription: | Battle.net Setup |
| OriginalFileName: | Battle.net-Setup.exe |
Total processes
137
Monitored processes
9
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 744 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe |
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) | ||||
| 856 | "C:\ProgramData\Battle.net\Agent\Agent.9124\Agent.exe" --locale=enUS --session=7968814799916715449 | C:\ProgramData\Battle.net\Agent\Agent.9124\Agent.exe | Agent.exe | |
User: admin Company: Blizzard Entertainment Integrity Level: HIGH Description: Battle.net Update Agent Version: 2.38.1.9124 | ||||
| 4120 | "C:\Users\admin\AppData\Local\Temp\Battle.net-Setup.exe" --cmdver=2 --elevated --locale=enUS --mode=setup --session=7968814799916715449 | C:\Users\admin\AppData\Local\Temp\Battle.net-Setup.exe | Battle.net-Setup.exe | |
User: admin Company: Blizzard Entertainment Integrity Level: HIGH Description: Battle.net Setup Version: 1.18.10.3141 | ||||
| 5228 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Agent.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) | ||||
| 5324 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe |
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) | ||||
| 5596 | "C:\Users\admin\AppData\Local\Temp\Battle.net-Setup.exe" | C:\Users\admin\AppData\Local\Temp\Battle.net-Setup.exe | explorer.exe | |
User: admin Company: Blizzard Entertainment Integrity Level: MEDIUM Description: Battle.net Setup Exit code: 0 Version: 1.18.10.3141 | ||||
| 6028 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | AgentHelper.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | ||||
| 6040 | "C:\ProgramData\Battle.net\Agent\AgentHelper.exe" --install --target=C:/ProgramData/Battle.net_components/battlenet_helpersvc/AgentHelper.exe | C:\ProgramData\Battle.net\Agent\AgentHelper.exe | Agent.exe | |
User: admin Company: Blizzard Entertainment Integrity Level: HIGH Description: Battle.net Admin Agent Exit code: 0 Version: 2.38.1.9124 | ||||
| 6752 | "C:\ProgramData\Battle.net\Agent\Agent.exe" --locale=enUS --session=7968814799916715449 | C:\ProgramData\Battle.net\Agent\Agent.exe | — | Battle.net-Setup.exe |
User: admin Company: Blizzard Entertainment Integrity Level: HIGH Description: Battle.net File Switcher Exit code: 0 Version: 2.38.1.9124 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
139
Suspicious files
364
Text files
37
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5596 | Battle.net-Setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 | binary | |
MD5:2B4254882655885B4EC4DF341A2FF514 | SHA256:D764C694128AE56FA4F45887F54961F742B1752E0A5A1AA4EDD7015781BBEB66 | |||
| 4120 | Battle.net-Setup.exe | C:\ProgramData\Battle.net\Agent\..LICENSES.14.4120.temp.15.4120.temp | text | |
MD5:835AE7FB6E7733264A44F792CA33FB2B | SHA256:7CB852F64FB8C7BDE31B53CF7BD5C68EC50EBA128054DD3646C8A2C73B331162 | |||
| 4120 | Battle.net-Setup.exe | C:\ProgramData\Battle.net\Agent\..BlizzardError.exe.20.4120.temp.21.4120.temp | executable | |
MD5:A44A76265F9F22258D7665FFA5262CB6 | SHA256:BE2394FF7880E403A92AD773C675295A47E9FAFE330F01DF21FC886F5383B21A | |||
| 4120 | Battle.net-Setup.exe | C:\ProgramData\Battle.net\Agent\.AgentHelper.exe.17.4120.temp | binary | |
MD5:E6F838D285B05A8C29C2B1C095D5D86C | SHA256:E3B4882858ED6C6171F309889C76F0B589CBE4E9DC99F9104F953E9773A0E03E | |||
| 4120 | Battle.net-Setup.exe | C:\ProgramData\Battle.net\Agent\..AgentHelper.exe.17.4120.temp.18.4120.temp | executable | |
MD5:FB2EC42E4B2517B8054FBAFB8C868478 | SHA256:8F8F4458D8B5409828D6D2EE209E6243B99303BAB894B69F515862B6B892BD19 | |||
| 5596 | Battle.net-Setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 | binary | |
MD5:74A8419ADBD9D1651F6FE02DF6659754 | SHA256:B564EF9C3979FF81CDAF5A42FE2203006902D1DB7B8C13A89ABCC1D9607D3267 | |||
| 4120 | Battle.net-Setup.exe | C:\ProgramData\Battle.net\Agent\.BlizzardError.exe.20.4120.temp | binary | |
MD5:19E4267E5D1685D10F57D49890DEFA15 | SHA256:BC1E5933220C841A38D211D9FFD0A2E6A239169F28BC0BE755365BC995BA56F0 | |||
| 5596 | Battle.net-Setup.exe | C:\ProgramData\Battle.net\Setup\bna_2\Logs\battle.net-setup-20250510T040026.log | text | |
MD5:16D0F888F2A2DCE77A1CA7D38C11A3C3 | SHA256:0B7728A2F62927FFE3C46D0D920CE5AB7B18690899A509293E5F0405263DA81B | |||
| 4120 | Battle.net-Setup.exe | C:\ProgramData\Battle.net\Agent\.AgentHelper.exe.19.4120.temp | executable | |
MD5:FB2EC42E4B2517B8054FBAFB8C868478 | SHA256:8F8F4458D8B5409828D6D2EE209E6243B99303BAB894B69F515862B6B892BD19 | |||
| 4120 | Battle.net-Setup.exe | C:\ProgramData\Battle.net\Agent\..AgentHelper.exe.17.4120.temp.18.4120.temp.temp | executable | |
MD5:FB2EC42E4B2517B8054FBAFB8C868478 | SHA256:8F8F4458D8B5409828D6D2EE209E6243B99303BAB894B69F515862B6B892BD19 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
240
TCP/UDP connections
101
DNS requests
19
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.16:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5596 | Battle.net-Setup.exe | GET | 204 | 54.76.212.57:80 | http://nydus.battle.net/geoip | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5596 | Battle.net-Setup.exe | POST | — | 66.40.185.57:3724 | http://iir.blizzard.com:3724/submit/BNET_APP | unknown | — | — | whitelisted |
5596 | Battle.net-Setup.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D | unknown | — | — | whitelisted |
5596 | Battle.net-Setup.exe | POST | — | 66.40.185.57:3724 | http://iir.blizzard.com:3724/submit/BNET_APP | unknown | — | — | whitelisted |
4120 | Battle.net-Setup.exe | GET | 200 | 137.221.106.28:1119 | http://us.patch.battle.net:1119/bts/versions | unknown | — | — | whitelisted |
4120 | Battle.net-Setup.exe | GET | 200 | 137.221.106.28:1119 | http://us.patch.battle.net:1119/agent/cdns | unknown | — | — | whitelisted |
4120 | Battle.net-Setup.exe | GET | 200 | 137.221.64.4:80 | http://us.cdn.blizzard.com/tpr/bnt001/config/9e/77/9e77b5b212caaf380adaa63450d3a23c | unknown | — | — | whitelisted |
4120 | Battle.net-Setup.exe | GET | 200 | 23.48.23.25:80 | http://level3.blizzard.com/tpr/configs/data/2f/91/2f916817de49cc9943366ec2a13cd67f | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.16:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5596 | Battle.net-Setup.exe | 54.76.212.57:80 | nydus.battle.net | AMAZON-02 | IE | whitelisted |
5596 | Battle.net-Setup.exe | 66.40.185.57:3724 | iir.blizzard.com | — | US | whitelisted |
5596 | Battle.net-Setup.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4120 | Battle.net-Setup.exe | 54.76.212.57:80 | nydus.battle.net | AMAZON-02 | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
nydus.battle.net |
| whitelisted |
iir.blizzard.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
us.patch.battle.net |
| whitelisted |
level3.blizzard.com |
| whitelisted |
us.cdn.blizzard.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5596 | Battle.net-Setup.exe | Potential Corporate Privacy Violation | ET INFO GeoIP Lookup (nydus.battle.net) |
4120 | Battle.net-Setup.exe | Potential Corporate Privacy Violation | ET INFO GeoIP Lookup (nydus.battle.net) |