analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

C:\Users\admin\AppData\Local\Temp\265A.tmp.exe

Full analysis: https://app.any.run/tasks/2c8a91ce-7489-4188-a596-0b6897f0c7c4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 18, 2020, 13:05:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
miner
qwertminer
adware
oxypumper
loader
pup
linkury
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7C2AB15D2A95F4A15C2C5082CE77D1FB

SHA1:

B3E288EC58F27942256EF3233948C6A5E425C8DA

SHA256:

0C63F8ECF4F8853B8D3A94222C21D3B4A9B888CA9B66FD708948C5E7D000D362

SSDEEP:

3072:rnKg8d1LK2PBq6SDI2U2xGqqoFQ2WXMDRQuAg0FujsY9eSDM5V:rnKgSLjzeIfX+vBhAOotSDM5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • fish.exe (PID: 1712)
      • ZathIt.exe (PID: 4020)
      • CloudPrinter.exe (PID: 292)
      • Good-Hold.exe (PID: 3860)
      • EcoZozhome.bin (PID: 320)
      • Pangoc.exe (PID: 2580)
      • LogicHandler.exe (PID: 4000)
      • LogicHandler.exe (PID: 2176)
      • set.exe (PID: 328)
      • Pangoc.exe (PID: 2668)
      • Pangoc.exe (PID: 2028)
      • Pangoc.exe (PID: 2876)
      • Pangoc.exe (PID: 1856)

    • Downloads executable files from the Internet

      • 265A.tmp.exe (PID: 2280)
      • fish.exe (PID: 1712)

    • QWERTMINER was detected

      • 265A.tmp.exe (PID: 2280)

    • LINKURY was detected

      • fish.exe (PID: 1712)
      • ZathIt.exe (PID: 4020)
      • CloudPrinter.exe (PID: 292)
      • Good-Hold.exe (PID: 3860)
      • Pangoc.exe (PID: 2580)
      • LogicHandler.exe (PID: 4000)
      • set.exe (PID: 328)

    • Connects to CnC server

      • fish.exe (PID: 1712)
      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • set.exe (PID: 328)
      • Pangoc.exe (PID: 2580)

    • Changes settings of System certificates

      • fish.exe (PID: 1712)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2096)
      • schtasks.exe (PID: 3936)
      • schtasks.exe (PID: 4036)
      • schtasks.exe (PID: 1316)
      • schtasks.exe (PID: 3892)
      • schtasks.exe (PID: 952)
      • schtasks.exe (PID: 2416)
      • schtasks.exe (PID: 1888)
      • schtasks.exe (PID: 1296)
      • schtasks.exe (PID: 2172)
      • schtasks.exe (PID: 2832)
      • schtasks.exe (PID: 3344)
      • schtasks.exe (PID: 1292)
      • schtasks.exe (PID: 2700)
      • schtasks.exe (PID: 2500)
      • schtasks.exe (PID: 3804)
      • schtasks.exe (PID: 3872)
      • schtasks.exe (PID: 3952)
      • schtasks.exe (PID: 3452)
      • schtasks.exe (PID: 3412)
      • schtasks.exe (PID: 1904)
      • schtasks.exe (PID: 2528)
      • schtasks.exe (PID: 1704)
      • schtasks.exe (PID: 392)
      • schtasks.exe (PID: 2200)
      • schtasks.exe (PID: 2172)
      • schtasks.exe (PID: 3308)
      • schtasks.exe (PID: 1292)
      • schtasks.exe (PID: 3696)
      • schtasks.exe (PID: 2120)
      • schtasks.exe (PID: 3948)
      • schtasks.exe (PID: 1780)
      • schtasks.exe (PID: 920)
      • schtasks.exe (PID: 2928)
      • schtasks.exe (PID: 3116)
      • schtasks.exe (PID: 1024)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3912)
      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 1412)
      • cmd.exe (PID: 600)
      • cmd.exe (PID: 3124)
      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 3796)
      • cmd.exe (PID: 2004)
      • cmd.exe (PID: 1524)
      • cmd.exe (PID: 1416)
      • cmd.exe (PID: 1852)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 1584)
      • cmd.exe (PID: 2532)
      • cmd.exe (PID: 1016)
      • cmd.exe (PID: 616)
      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 2976)
      • cmd.exe (PID: 3716)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 3404)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 3388)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 1928)
      • cmd.exe (PID: 932)
      • cmd.exe (PID: 3984)
      • cmd.exe (PID: 1328)
      • cmd.exe (PID: 408)
      • cmd.exe (PID: 2748)
      • cmd.exe (PID: 3944)
      • cmd.exe (PID: 492)

    • Loads dropped or rewritten executable

      • Pangoc.exe (PID: 2580)
      • set.exe (PID: 328)
      • schtasks.exe (PID: 3892)
      • schtasks.exe (PID: 2416)
      • schtasks.exe (PID: 952)
      • cmd.exe (PID: 3124)
      • cmd.exe (PID: 1600)
      • conhost.exe (PID: 2076)
      • cmd.exe (PID: 1412)
      • conhost.exe (PID: 2812)
      • conhost.exe (PID: 1800)
      • conhost.exe (PID: 3964)
      • schtasks.exe (PID: 1296)
      • regedit.exe (PID: 3948)
      • schtasks.exe (PID: 1888)
      • conhost.exe (PID: 3944)
      • cmd.exe (PID: 3744)
      • taskeng.exe (PID: 2996)
      • cmd.exe (PID: 2004)
      • conhost.exe (PID: 408)
      • cmd.exe (PID: 3796)
      • schtasks.exe (PID: 2172)
      • Pangoc.exe (PID: 2668)
      • cmd.exe (PID: 1524)
      • conhost.exe (PID: 2660)
      • schtasks.exe (PID: 2832)
      • conhost.exe (PID: 1704)
      • conhost.exe (PID: 2136)
      • schtasks.exe (PID: 3344)
      • cmd.exe (PID: 1416)
      • schtasks.exe (PID: 1292)
      • cmd.exe (PID: 1852)
      • Pangoc.exe (PID: 2028)
      • cmd.exe (PID: 3924)
      • conhost.exe (PID: 1792)
      • conhost.exe (PID: 2952)
      • schtasks.exe (PID: 2700)
      • schtasks.exe (PID: 3804)
      • cmd.exe (PID: 2532)
      • schtasks.exe (PID: 2500)
      • schtasks.exe (PID: 3872)
      • conhost.exe (PID: 2204)
      • cmd.exe (PID: 1016)
      • cmd.exe (PID: 1584)
      • conhost.exe (PID: 3756)
      • regedit.exe (PID: 1328)
      • conhost.exe (PID: 3680)
      • DllHost.exe (PID: 3176)
      • schtasks.exe (PID: 3412)
      • conhost.exe (PID: 896)
      • schtasks.exe (PID: 3952)
      • cmd.exe (PID: 616)
      • schtasks.exe (PID: 3452)
      • cmd.exe (PID: 2976)
      • schtasks.exe (PID: 1904)
      • conhost.exe (PID: 1524)
      • conhost.exe (PID: 1416)
      • cmd.exe (PID: 3488)
      • conhost.exe (PID: 1888)
      • cmd.exe (PID: 2056)
      • werfault.exe (PID: 2776)
      • schtasks.exe (PID: 2528)
      • cmd.exe (PID: 3716)
      • conhost.exe (PID: 2512)
      • werfault.exe (PID: 3356)
      • schtasks.exe (PID: 392)
      • cmd.exe (PID: 3404)
      • regedit.exe (PID: 3452)
      • schtasks.exe (PID: 1704)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 3388)
      • conhost.exe (PID: 2552)
      • conhost.exe (PID: 3196)
      • schtasks.exe (PID: 2200)
      • regedit.exe (PID: 3264)
      • conhost.exe (PID: 2708)
      • cmd.exe (PID: 2112)
      • schtasks.exe (PID: 2172)
      • conhost.exe (PID: 1788)
      • cmd.exe (PID: 3744)
      • schtasks.exe (PID: 3308)
      • schtasks.exe (PID: 1292)
      • cmd.exe (PID: 1928)
      • schtasks.exe (PID: 3696)
      • conhost.exe (PID: 3368)
      • conhost.exe (PID: 3796)
      • cmd.exe (PID: 932)
      • schtasks.exe (PID: 2120)
      • conhost.exe (PID: 2420)
      • cmd.exe (PID: 3984)
      • Pangoc.exe (PID: 2876)
      • schtasks.exe (PID: 3948)
      • conhost.exe (PID: 944)
      • cmd.exe (PID: 408)
      • schtasks.exe (PID: 920)
      • conhost.exe (PID: 2184)
      • cmd.exe (PID: 1328)
      • schtasks.exe (PID: 1780)
      • Pangoc.exe (PID: 1856)
      • conhost.exe (PID: 2660)
      • schtasks.exe (PID: 2928)
      • cmd.exe (PID: 3944)
      • cmd.exe (PID: 2748)
      • conhost.exe (PID: 520)
      • schtasks.exe (PID: 3116)
      • werfault.exe (PID: 2604)
      • conhost.exe (PID: 3900)
      • cmd.exe (PID: 492)
      • werfault.exe (PID: 3356)
      • schtasks.exe (PID: 1024)

    • Changes the autorun value in the registry

      • regedit.exe (PID: 1160)
      • regedit.exe (PID: 3948)
      • regedit.exe (PID: 1328)
      • regedit.exe (PID: 3452)
      • regedit.exe (PID: 3264)

    • Changes AppInit_DLLs value (autorun option)

      • regedit.exe (PID: 1160)
      • regedit.exe (PID: 3948)
      • regedit.exe (PID: 1328)
      • regedit.exe (PID: 3452)
      • regedit.exe (PID: 3264)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • fish.exe (PID: 1712)
      • 265A.tmp.exe (PID: 2280)
      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • EcoZozhome.bin (PID: 320)
      • LogicHandler.exe (PID: 2176)
      • Pangoc.exe (PID: 2580)

    • Starts itself from another location

      • fish.exe (PID: 1712)

    • Starts SC.EXE for service management

      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • LogicHandler.exe (PID: 2176)
      • cmd.exe (PID: 2432)

    • Creates files in the program directory

      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • LogicHandler.exe (PID: 4000)
      • LogicHandler.exe (PID: 2176)
      • fish.exe (PID: 1712)
      • Pangoc.exe (PID: 2580)

    • Creates files in the Windows directory

      • CloudPrinter.exe (PID: 292)
      • Pangoc.exe (PID: 2580)
      • set.exe (PID: 328)

    • Executed as Windows Service

      • CloudPrinter.exe (PID: 292)
      • Pangoc.exe (PID: 2580)
      • set.exe (PID: 328)

    • Application launched itself

      • LogicHandler.exe (PID: 4000)

    • Starts application with an unusual extension

      • fish.exe (PID: 1712)

    • Starts CMD.EXE for commands execution

      • LogicHandler.exe (PID: 2176)
      • Pangoc.exe (PID: 2580)
      • Pangoc.exe (PID: 2668)
      • Pangoc.exe (PID: 2028)
      • Pangoc.exe (PID: 2876)
      • Pangoc.exe (PID: 1856)

    • Adds / modifies Windows certificates

      • fish.exe (PID: 1712)

    • Creates a software uninstall entry

      • fish.exe (PID: 1712)

    • Executed via Task Scheduler

      • cmd.exe (PID: 600)
      • cmd.exe (PID: 1600)
      • Pangoc.exe (PID: 2668)
      • cmd.exe (PID: 1584)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 2112)

    • Removes files from Windows directory

      • set.exe (PID: 328)
      • Pangoc.exe (PID: 2580)

    • Creates files in the user directory

      • Pangoc.exe (PID: 2580)

    • Changes the started page of IE

      • Pangoc.exe (PID: 2580)

    • Searches for installed software

      • Pangoc.exe (PID: 2580)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x7ca2
UninitializedDataSize: -
InitializedDataSize: 74240
CodeSize: 81408
LinkerVersion: 14.16
PEType: PE32
TimeStamp: 2019:11:21 10:09:53+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Nov-2019 09:09:53
Detected languages:
  • English - United States
Debug artifacts:
  • C:\Work\ajhjfdgkjhdf\Release\safefinder.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 21-Nov-2019 09:09:53
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00013DC9
0x00013E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64202
.rdata
0x00015000
0x0000DEDE
0x0000E000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.3533
.data
0x00023000
0x00001AC8
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.94776
.rsrc
0x00025000
0x00000938
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.69123
.reloc
0x00026000
0x00001A5C
0x00001C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.40428

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST
101
3.43406
1682
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
RPCRT4.dll
SHELL32.dll
USER32.dll
WININET.dll
urlmon.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
182
Monitored processes
134
Malicious processes
95
Suspicious processes
20

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start 265a.tmp.exe no specs #QWERTMINER 265a.tmp.exe #LINKURY fish.exe #LINKURY zathit.exe sc.exe no specs #LINKURY cloudprinter.exe #LINKURY good-hold.exe sc.exe no specs #LINKURY pangoc.exe ecozozhome.bin #LINKURY logichandler.exe logichandler.exe cmd.exe no specs sc.exe no specs sc.exe no specs #LINKURY set.exe cmd.exe no specs schtasks.exe no specs cmd.exe no specs schtasks.exe no specs cmd.exe no specs schtasks.exe no specs cmd.exe no specs regedit.exe cmd.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs taskeng.exe no specs conhost.exe no specs schtasks.exe no specs pangoc.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs pangoc.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs Thumbnail Cache Out of Proc Server no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs pangoc.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs pangoc.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Users\admin\AppData\Local\Temp\265A.tmp.exe" C:\Users\admin\AppData\Local\Temp\265A.tmp.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\systemroot\system32\ntdll.dll
2280"C:\Users\admin\AppData\Local\Temp\265A.tmp.exe" C:\Users\admin\AppData\Local\Temp\265A.tmp.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\265a.tmp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1712C:\Users\admin\AppData\Local\Temp\fish.exe {"packer":{"DistributerName":"APSFPango","ChannelId":"3"},"Agent":{"SetAll":"true"}}C:\Users\admin\AppData\Local\Temp\fish.exe
265A.tmp.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\fish.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
4020"C:\Users\admin\AppData\Local\ZathIt.exe" shuz -f "lobby.dat" -l -a DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 ApName=PangocC:\Users\admin\AppData\Local\ZathIt.exe
fish.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\zathit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
592"C:\Windows\system32\sc.exe" create CloudPrinter binpath= "C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f \"C:\ProgramData\\CloudPrinter\\CloudPrinter.dat\" -l -a" DisplayName= CloudPrinter start= autoC:\Windows\system32\sc.exe—ZathIt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
292C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f "C:\ProgramData\\CloudPrinter\\CloudPrinter.dat" -l -aC:\ProgramData\CloudPrinter\CloudPrinter.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\programdata\cloudprinter\cloudprinter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3860"C:\Users\admin\AppData\Local\Good-Hold.exe" shuz -f "noah.dat" -l -a DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 DefaultSearchDomain=https://feed.sonic-search.com HomePageDomain=https://feed.helperbar.com NewTabDomain=https://feed.helperbar.com EncryptUrl=true AddRemove=false AgentName=Pangoc YBSearch=false ApName=Pangoc SetAll=trueC:\Users\admin\AppData\Local\Good-Hold.exe
fish.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\good-hold.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2056"C:\Windows\system32\sc.exe" create Pangoc binpath= "C:\ProgramData\\Pangoc\\Pangoc.exe shuz -f \"C:\ProgramData\\Pangoc\\Pangoc.dat\" -l -a" DisplayName= Pangoc start= autoC:\Windows\system32\sc.exe—Good-Hold.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2580C:\ProgramData\\Pangoc\\Pangoc.exe shuz -f "C:\ProgramData\\Pangoc\\Pangoc.dat" -l -aC:\ProgramData\Pangoc\Pangoc.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\programdata\pangoc\pangoc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
320"C:\Users\admin\AppData\Local\EcoZozhome.bin" DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 Ids=inafjghmmkmiobijhbgkfekenbfbklhb ExtensionEntityName=bazzsearch ForceInstall=true OpenTP=falseC:\Users\admin\AppData\Local\EcoZozhome.bin
fish.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1000
Modules
Images
c:\users\admin\appdata\local\ecozozhome.bin
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc_os.dll
Total events
1 609
Read events
1 351
Write events
0
Delete events
0

Modification events

No data
Executable files
20
Suspicious files
21
Text files
57
Unknown types
28

Dropped files

PID
Process
Filename
Type
1712fish.exeC:\Users\admin\AppData\Local\agent.dat —
MD5:—
SHA256:—
1712fish.exeC:\Users\admin\AppData\Local\InstallationConfiguration.xmltext
MD5:43BCB3596F548E3D89A3F5B37E8CDC32
SHA256:BA508968F2C860295FE24ECA583619C329E3FFD464576D2B858077238251453F
4020ZathIt.exeC:\ProgramData\CloudPrinter\CloudPrinter.datbinary
MD5:0AB948DC4BB6BFD642D3F8CC287680FB
SHA256:FDC1D15A2AD6E9A2FFC47563AA720F9F905E047AB171922D9A1756267D5D47E2
1712fish.exeC:\Users\admin\AppData\Local\md.xmltext
MD5:FABF19B91F77BC8EC91647829F05B7F3
SHA256:515D579878EEEC37340B0CABA02C2BAB4FAF5AE1CFB2E03B5B9DA30BAD26F2AA
2280265A.tmp.exeC:\Users\admin\AppData\Local\Temp\fish.exeexecutable
MD5:1F972207384DA52E3EAA7327E218281B
SHA256:8DA4B1756ED0DAAA4B90E8F00F243157B80E9BED17DFCB71906CA6800871E04F
3860Good-Hold.exeC:\ProgramData\Pangoc\Pangoc.d.dat —
MD5:—
SHA256:—
1712fish.exeC:\Users\admin\AppData\Local\Good-Hold.exeexecutable
MD5:1F972207384DA52E3EAA7327E218281B
SHA256:8DA4B1756ED0DAAA4B90E8F00F243157B80E9BED17DFCB71906CA6800871E04F
4020ZathIt.exeC:\ProgramData\CloudPrinter\CloudPrinter.exeexecutable
MD5:1F972207384DA52E3EAA7327E218281B
SHA256:8DA4B1756ED0DAAA4B90E8F00F243157B80E9BED17DFCB71906CA6800871E04F
292CloudPrinter.exeC:\Windows\system32\config\systemprofile\AppData\Local\InstallationConfiguration.xmltext
MD5:43BCB3596F548E3D89A3F5B37E8CDC32
SHA256:BA508968F2C860295FE24ECA583619C329E3FFD464576D2B858077238251453F
3860Good-Hold.exeC:\ProgramData\Pangoc\Pangoc.exeexecutable
MD5:1F972207384DA52E3EAA7327E218281B
SHA256:8DA4B1756ED0DAAA4B90E8F00F243157B80E9BED17DFCB71906CA6800871E04F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
127
TCP/UDP connections
51
DNS requests
36
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1712
fish.exe
GET
200
52.166.114.5:80
http://svc-stats.linkury.com/StateStatisticsService.svc/V1/JSON/GetDistributorIdFromNameHttpGet?distributorName=APSFPango
NL
text
13 b
shared
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
2280
265A.tmp.exe
GET
200
205.185.208.154:80
http://h8y9u9b2.ssl.hwcdn.net/APSFPango/dynlink_1579267140397.exe
US
executable
1.69 Mb
malicious
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
GET
200
205.185.208.154:80
http://m4y2d5k4.ssl.hwcdn.net/installer/installers-config/safefinder-ap/apsfpango/ic090120.xml
US
text
15.8 Kb
malicious
1712
fish.exe
GET
200
52.174.148.190:80
http://updates.utyuytjn.com/Update/CheckInstallConfig?deviceid=a6985883-ace4-b706-fafa-0ee4efb037e4&distributer=APSFPango&channelid=3&barcodeid=54565003&country=GB&encrypt=True
NL
text
263 b
whitelisted
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
GET
200
65.52.153.196:80
http://madmax.utyuytjn.com/MaxMind.asmx/GetGeoInfo
NL
xml
193 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1712
fish.exe
52.166.114.5:80
svc-stats.linkury.com
Microsoft Corporation
NL
whitelisted
1712
fish.exe
65.52.153.196:80
madmax.utyuytjn.com
Microsoft Corporation
NL
whitelisted
2280
265A.tmp.exe
216.58.207.36:80
google-analytics.com
Google Inc.
US
whitelisted
2280
265A.tmp.exe
52.174.148.190:80
install.portmdfmoon.com
Microsoft Corporation
NL
whitelisted
2280
265A.tmp.exe
205.185.208.154:80
h8y9u9b2.ssl.hwcdn.net
Highwinds Network Group, Inc.
US
malicious
1712
fish.exe
52.174.148.190:80
install.portmdfmoon.com
Microsoft Corporation
NL
whitelisted
4020
ZathIt.exe
65.52.153.196:80
madmax.utyuytjn.com
Microsoft Corporation
NL
whitelisted
1712
fish.exe
104.41.146.197:80
api.eazymount.com
Microsoft Corporation
US
whitelisted
1712
fish.exe
205.185.208.154:80
h8y9u9b2.ssl.hwcdn.net
Highwinds Network Group, Inc.
US
malicious
4020
ZathIt.exe
52.166.114.5:80
svc-stats.linkury.com
Microsoft Corporation
NL
whitelisted

DNS requests

Domain
IP
Reputation
google-analytics.com
  • 216.58.207.36
whitelisted
install.portmdfmoon.com
  • 52.174.148.190
unknown
h8y9u9b2.ssl.hwcdn.net
  • 205.185.208.154
malicious
svc-stats.linkury.com
  • 52.166.114.5
shared
madmax.utyuytjn.com
  • 65.52.153.196
unknown
updates.utyuytjn.com
  • 52.174.148.190
unknown
stats.utyuytjn.com
  • 52.166.114.5
unknown
m4y2d5k4.ssl.hwcdn.net
  • 205.185.208.154
malicious
api.eazymount.com
  • 104.41.146.197
unknown
cloud-search.linkury.com
  • 65.52.153.196
whitelisted

Threats

PID
Process
Class
Message
2280
265A.tmp.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/QwertMiner CoinMiner UA
2280
265A.tmp.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2280
265A.tmp.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2280
265A.tmp.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
1712
fish.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.LogicHandler
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
193 ETPRO signatures available at the full report
Process
Message
265A.tmp.exe
[18/01/2020 13:05:51:0409] Downloaded
265A.tmp.exe
[18/01/2020 13:05:51:0409] {"packer":{"DistributerName":"APSFPango","ChannelId":"3"},"Agent":{"SetAll":"true"}}
ZathIt.exe
DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 ApName=Pangoc
Good-Hold.exe
DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 DefaultSearchDomain=https://feed.sonic-search.com HomePageDomain=https://feed.helperbar.com NewTabDomain=https://feed.helperbar.com EncryptUrl=true AddRemove=false AgentName=Pangoc YBSearch=false ApName=Pangoc SetAll=true
Pangoc.exe
Agent Main
Pangoc.exe
Agent Started
Pangoc.exe
Agent service started with arg: DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 DefaultSearchDomain=https://feed.sonic-search.com HomePageDomain=https://feed.helperbar.com NewTabDomain=https://feed.helperbar.com EncryptUrl=true AddRemove=false AgentName=Pangoc YBSearch=false ApName=Pangoc SetAll=true
Pangoc.exe
Current directory: C:\ProgramData\Pangoc
Pangoc.exe
*****************************************************************
Pangoc.exe
Create file context remotely : Path = C:\ProgramData\Pangoc\Pangoc.d.dat, Version = 3.0.0.27
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
C:\Users\admin\AppData\Local\Temp\265A.tmp.exe