File name: | CC Checker -AcTeam-.exe |
Full analysis: | https://app.any.run/tasks/e4643c34-749a-40e2-b331-29c143fbd329 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 18:32:07 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | F045688821C95892F36B1F1FB81C3DAD |
SHA1: | E4FB3608A2ABAB3A79AE92557C63147ACFC5B195 |
SHA256: | 151CEEA1A97415F8CE6BA897FB80E72B11B1C8BEF9D48968BBEFBD34199859AC |
SSDEEP: | 49152:ABRNlVlypZAz25Vq3pYsq6wZKbbW5Etx6TbxEsPAdZkdqc:a/lgAz25V+qpZKGuX6T9jskdqc |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2022-Mar-03 13:15:57 |
Debug artifacts: |
|
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 272 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 6 |
TimeDateStamp: | 2022-Mar-03 13:15:57 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 203740 | 203776 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.71296 |
.rdata | 208896 | 44736 | 45056 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.26161 |
.data | 253952 | 149280 | 4096 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.38746 |
.didat | 405504 | 400 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.33273 |
.rsrc | 409600 | 57424 | 57856 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.80217 |
.reloc | 471040 | 9020 | 9216 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.62301 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.97409 | 1384 | Latin 1 / Western European | UNKNOWN | RT_ICON |
2 | 5.10026 | 2216 | Latin 1 / Western European | UNKNOWN | RT_ICON |
3 | 5.25868 | 3752 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4 | 5.02609 | 1128 | Latin 1 / Western European | UNKNOWN | RT_ICON |
5 | 5.18109 | 4264 | Latin 1 / Western European | UNKNOWN | RT_ICON |
6 | 5.04307 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
7 | 7.94547 | 15729 | Latin 1 / Western European | UNKNOWN | RT_ICON |
8 | 3.71728 | 582 | Latin 1 / Western European | UNKNOWN | RT_STRING |
9 | 3.73856 | 422 | Latin 1 / Western European | UNKNOWN | RT_STRING |
10 | 3.55807 | 220 | Latin 1 / Western European | UNKNOWN | RT_STRING |
KERNEL32.dll |
OLEAUT32.dll |
USER32.dll (delay-loaded) |
gdiplus.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1752 | "C:\Users\admin\Downloads\CC Checker -AcTeam-.exe" | C:\Users\admin\Downloads\CC Checker -AcTeam-.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
1248 | "C:\Users\admin\AppData\Local\Temp\RarSFX0\CC Checker -AcTeam-.exe" | C:\Users\admin\AppData\Local\Temp\RarSFX0\CC Checker -AcTeam-.exe | CC Checker -AcTeam-.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Yahoo.com Version: 1.4.1.2 Modules
| |||||||||||||||
2348 | "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All | C:\Windows\system32\cmd.exe | — | CC Checker -AcTeam-.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2548 | chcp 65001 | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1244 | netsh wlan show profile | C:\Windows\system32\netsh.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1872 | findstr All | C:\Windows\system32\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3316 | "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid | C:\Windows\system32\cmd.exe | — | CC Checker -AcTeam-.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3460 | chcp 65001 | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3476 | netsh wlan show networks mode=bssid | C:\Windows\system32\netsh.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2688 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (1752) CC Checker -AcTeam-.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1752) CC Checker -AcTeam-.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1752) CC Checker -AcTeam-.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1752) CC Checker -AcTeam-.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing |
PID | Process | Filename | Type | |
---|---|---|---|---|
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\Temp\tmp41DC.tmp.dat | — | |
MD5:— | SHA256:— | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\Temp\Stealerium-Latest.log | text | |
MD5:F84538AF64C4B8D704334ABEC459B4EB | SHA256:645A554FDF0F84970928ACF7439D87CCA6BCF63686C4C39FA73B322A5BD89BAD | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Documents\europeblog.rtf | text | |
MD5:C5905BDEAAA154665A6BEDF1658B993C | SHA256:C53B783CD1FBAEBDBBFA7ADE4E9C4C1A140A17C054E61E6D27F80D95AA56C302 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Pictures\appearfriday.png | image | |
MD5:A52AB5BE7AE84F89CB5F33EBDEE0320D | SHA256:DA6506D7E873ECE96E222BC21D4515DD4DCC8F19E691353E931B39B5DD80A9C8 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\admin@USER-PC_en-US\System\Debug.txt | text | |
MD5:CCEA1071B6444818367372ACFC40D83B | SHA256:4D25DEB51B662FDC2661B9A830ED79040EE055585CAA7D46944464C7709ABBF9 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Documents\rentalsplease.rtf | text | |
MD5:18DFC78A80478D47B4AE7346BA511318 | SHA256:6D9466BD9EC315F48382DC128EEA06A7ECDB1BC6BE3B08BF6C26EF1AEDB9316F | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Desktop\offercultural.rtf | text | |
MD5:786102C6BC46F382F21C0E7C90BF737E | SHA256:F75C3DE63D3D03E480076083CCF136A5E577E9CA909EB7BD84B0782B2D748DB0 | |||
1752 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\CC Checker -AcTeam-.exe | executable | |
MD5:E588EC5E8F7A8AD6E933B48ABC1C9FF2 | SHA256:4E2D44D40E6FDE9A7BE650C8B2ABF707F82EA8A536CA0C9C6C53E585C239ABAE | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Desktop\printdomain.rtf | text | |
MD5:292084D0107AD3D20A9A14680D1116FD | SHA256:66481F91492A5DFDAD74B9A3875525CD07264DAA36EBE6D0403D1754EABC734A | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\admin@USER-PC_en-US\Grabber\DRIVE-C\Users\admin\Desktop\energymade.rtf | text | |
MD5:3C06C8DEDE121F0944498CC093D0E463 | SHA256:3D4959C8F8D3F74ACFAD62EFF485D53F5DE5309CC37B4B4BFBDAD2570E420D5F |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1248 | CC Checker -AcTeam-.exe | 104.18.115.97:80 | icanhazip.com | CLOUDFLARENET | — | malicious |
1472 | CC Checker -AcTeam-.exe | 162.159.136.232:443 | discord.com | CLOUDFLARENET | — | shared |
1248 | CC Checker -AcTeam-.exe | 162.159.136.232:443 | discord.com | CLOUDFLARENET | — | shared |
Domain | IP | Reputation |
---|---|---|
discord.com |
| whitelisted |
icanhazip.com |
| shared |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
1248 | CC Checker -AcTeam-.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |