File name: | CC Checker -AcTeam-.exe |
Full analysis: | https://app.any.run/tasks/e4643c34-749a-40e2-b331-29c143fbd329 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 18:32:07 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | F045688821C95892F36B1F1FB81C3DAD |
SHA1: | E4FB3608A2ABAB3A79AE92557C63147ACFC5B195 |
SHA256: | 151CEEA1A97415F8CE6BA897FB80E72B11B1C8BEF9D48968BBEFBD34199859AC |
SSDEEP: | 49152:ABRNlVlypZAz25Vq3pYsq6wZKbbW5Etx6TbxEsPAdZkdqc:a/lgAz25V+qpZKGuX6T9jskdqc |
.exe | | | Win64 Executable (generic) (64.6) |
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2022-Mar-03 13:15:57 |
Debug artifacts: |
|
e_magic: | MZ |
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | 0 |
e_cparhdr: | 4 |
e_minalloc: | 0 |
e_maxalloc: | 65535 |
e_ss: | 0 |
e_sp: | 184 |
e_csum: | 0 |
e_ip: | 0 |
e_cs: | 0 |
e_ovno: | 0 |
e_oemid: | 0 |
e_oeminfo: | 0 |
e_lfanew: | 272 |
Signature: | PE |
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 6 |
TimeDateStamp: | 2022-Mar-03 13:15:57 |
PointerToSymbolTable: | 0 |
NumberOfSymbols: | 0 |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 203740 | 203776 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.71296 |
.rdata | 208896 | 44736 | 45056 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.26161 |
.data | 253952 | 149280 | 4096 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.38746 |
.didat | 405504 | 400 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.33273 |
.rsrc | 409600 | 57424 | 57856 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.80217 |
.reloc | 471040 | 9020 | 9216 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.62301 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.97409 | 1384 | Latin 1 / Western European | UNKNOWN | RT_ICON |
2 | 5.10026 | 2216 | Latin 1 / Western European | UNKNOWN | RT_ICON |
3 | 5.25868 | 3752 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4 | 5.02609 | 1128 | Latin 1 / Western European | UNKNOWN | RT_ICON |
5 | 5.18109 | 4264 | Latin 1 / Western European | UNKNOWN | RT_ICON |
6 | 5.04307 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
7 | 7.94547 | 15729 | Latin 1 / Western European | UNKNOWN | RT_ICON |
8 | 3.71728 | 582 | Latin 1 / Western European | UNKNOWN | RT_STRING |
9 | 3.73856 | 422 | Latin 1 / Western European | UNKNOWN | RT_STRING |
10 | 3.55807 | 220 | Latin 1 / Western European | UNKNOWN | RT_STRING |
KERNEL32.dll |
OLEAUT32.dll |
USER32.dll (delay-loaded) |
gdiplus.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1752 | "C:\Users\admin\Downloads\CC Checker -AcTeam-.exe" | C:\Users\admin\Downloads\CC Checker -AcTeam-.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
1248 | "C:\Users\admin\AppData\Local\Temp\RarSFX0\CC Checker -AcTeam-.exe" | C:\Users\admin\AppData\Local\Temp\RarSFX0\CC Checker -AcTeam-.exe | CC Checker -AcTeam-.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Yahoo.com Version: 1.4.1.2 Modules
| |||||||||||||||
2348 | "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All | C:\Windows\system32\cmd.exe | — | CC Checker -AcTeam-.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2548 | chcp 65001 | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1244 | netsh wlan show profile | C:\Windows\system32\netsh.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1872 | findstr All | C:\Windows\system32\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3316 | "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid | C:\Windows\system32\cmd.exe | — | CC Checker -AcTeam-.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3460 | chcp 65001 | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3476 | netsh wlan show networks mode=bssid | C:\Windows\system32\netsh.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2688 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (1752) CC Checker -AcTeam-.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1752) CC Checker -AcTeam-.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1752) CC Checker -AcTeam-.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1752) CC Checker -AcTeam-.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (1248) CC Checker -AcTeam-.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CC Checker -AcTeam-_RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing |
PID | Process | Filename | Type | |
---|---|---|---|---|
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\Temp\tmp41DC.tmp.dat | — | |
MD5:— | SHA256:— | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\[email protected]_en-US\Grabber\DRIVE-C\Users\admin\Documents\europeblog.rtf | text | |
MD5:C5905BDEAAA154665A6BEDF1658B993C | SHA256:C53B783CD1FBAEBDBBFA7ADE4E9C4C1A140A17C054E61E6D27F80D95AA56C302 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\[email protected]_en-US\Grabber\DRIVE-C\Users\admin\Pictures\appearfriday.png | image | |
MD5:A52AB5BE7AE84F89CB5F33EBDEE0320D | SHA256:DA6506D7E873ECE96E222BC21D4515DD4DCC8F19E691353E931B39B5DD80A9C8 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\[email protected]_en-US\Grabber\DRIVE-C\Users\admin\Documents\environmentbox.rtf | text | |
MD5:67BD21177A15E16C90CEEB3CF549BE1B | SHA256:7152D5447FC2E25BF8EB2CF40A87D3D1E000451C1AA03A274E97E4BF9957B1F6 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\[email protected]_en-US\Grabber\DRIVE-C\Users\admin\Desktop\alternativeflash.rtf | text | |
MD5:6152FDF44A2046EC88967D6EC2F43A3D | SHA256:03740FA54A429D15C8DCDDB2CF4980DBA1650909DF9EB0B8C2A545C4A64FC454 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\[email protected]_en-US\Grabber\DRIVE-C\Users\admin\Pictures\includesv.png | image | |
MD5:3FF12A631CEEB76C85ACB54906893E8E | SHA256:663F48F40098599066161F596B622E454F7743F33E13256435DD1938D4E59059 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\[email protected]_en-US\Grabber\DRIVE-C\Users\admin\Pictures\videosreturn.png | image | |
MD5:BEB8B4C12737DBFE72330EE2D81B1B2A | SHA256:1EE0000A2BB838B8A8BEAE09895A0D4A4D5BF8BEBEEA2CD1D2C51DE4D01AF020 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\Temp\Stealerium-Latest.log | text | |
MD5:F84538AF64C4B8D704334ABEC459B4EB | SHA256:645A554FDF0F84970928ACF7439D87CCA6BCF63686C4C39FA73B322A5BD89BAD | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\[email protected]_en-US\Grabber\DRIVE-C\Users\admin\Downloads\relevanteg.png | image | |
MD5:B332EAD3D6C690E229C665027FBDA260 | SHA256:BC66F2B99255D46CA783BE53397A584888536A4845F21E58D375A10CAC1D1168 | |||
1248 | CC Checker -AcTeam-.exe | C:\Users\admin\AppData\Local\dc2815bdebaeab526eaa882516445489\[email protected]_en-US\Grabber\DRIVE-C\Users\admin\Downloads\wordperfect.png | image | |
MD5:CA0F9322089EF516B4F50810CAE26FEE | SHA256:266D8C0216EFB2F720CD2827C505851B1FE5D01CD655EE8C7EF4757274F1B6B0 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1248 | CC Checker -AcTeam-.exe | 162.159.136.232:443 | discord.com | CLOUDFLARENET | — | shared |
1472 | CC Checker -AcTeam-.exe | 162.159.136.232:443 | discord.com | CLOUDFLARENET | — | shared |
1248 | CC Checker -AcTeam-.exe | 104.18.115.97:80 | icanhazip.com | CLOUDFLARENET | — | malicious |
Domain | IP | Reputation |
---|---|---|
discord.com |
| whitelisted |
icanhazip.com |
| shared |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
1248 | CC Checker -AcTeam-.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |