File name:

5250255863349248.zip

Full analysis: https://app.any.run/tasks/0a7652e3-098c-496b-8615-d76753923b59
Verdict: Malicious activity
Threats:

TrickBot is an advanced banking trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Malware Trends Tracker     >>>
Analysis date: August 25, 2019, 09:17:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trickbot
trojan
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FD5946F2085CD379B53DE567E709E3D6

SHA1:

4C029A72EEBEFF5FA97E682542E3AFD5AB4DD12D

SHA256:

18E07E4292B5A0FAAC0DC1CCE366F7744025BF91ADBA3BFDCA99EA770A2B704A

SSDEEP:

6144:pi0cK+SfJvrEv6iZip+Le9qkU2cl1X0nadpc9l7c4JZ08UUCgPz+:U0cFwvIvy9Yjl1kazc9hNJZn7+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ПАКсЕыЦолИс.exe (PID: 3796)
      • 123.exe (PID: 2840)
      • ПАКсЕыЦолИс.exe (PID: 3852)
      • ПАКсЕыЦолИс.exe (PID: 184)

    • Known privilege escalation attack

      • DllHost.exe (PID: 2772)

    • Loads the Task Scheduler COM API

      • ПАКсЕыЦолИс.exe (PID: 3796)
      • ПАКсЕыЦолИс.exe (PID: 184)

    • Connects to CnC server

      • ПАКсЕыЦолИс.exe (PID: 184)

    • TRICKBOT was detected

      • ПАКсЕыЦолИс.exe (PID: 184)

  • SUSPICIOUS

    • Creates files in the user directory

      • ПАКсЕыЦолИс.exe (PID: 3852)
      • ПАКсЕыЦолИс.exe (PID: 184)

    • Creates files in the program directory

      • ПАКсЕыЦолИс.exe (PID: 184)
      • 123.exe (PID: 2840)

    • Executed via Task Scheduler

      • ПАКсЕыЦолИс.exe (PID: 184)

    • Starts itself from another location

      • 123.exe (PID: 2840)

    • Executable content was dropped or overwritten

      • 123.exe (PID: 2840)
      • ПАКсЕыЦолИс.exe (PID: 3852)

    • Executed via COM

      • DllHost.exe (PID: 2772)

    • Removes files from Windows directory

      • ПАКсЕыЦолИс.exe (PID: 184)

    • Creates files in the Windows directory

      • ПАКсЕыЦолИс.exe (PID: 184)

    • Checks for external IP

      • ПАКсЕыЦолИс.exe (PID: 184)

  • INFO

    • Manual execution by user

      • 123.exe (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x00000000
ZipCompressedSize: 291279
ZipUncompressedSize: 499712
ZipFileName: 11d59bad3177cbed5577816c93414343c0c745bdb226349b43ba5a9814007feb
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs 123.exe паксеыцолис.exe CMSTPLUA no specs паксеыцолис.exe no specs #TRICKBOT паксеыцолис.exe

Process information

PID
CMD
Path
Indicators
Parent process
184C:\Users\admin\AppData\Roaming\speedlink\ПАКсЕыЦолИс.exe C:\Users\admin\AppData\Roaming\speedlink\ПАКсЕыЦолИс.exe
taskeng.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Win32 API DLL
Exit code:
0
Version:
6.1.7601.17887 (win7sp1_gdr.120704-0720)
Modules
Images
c:\users\admin\appdata\roaming\speedlink\паксеыцолис.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
2772C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2840"C:\Users\admin\Desktop\123.exe" C:\Users\admin\Desktop\123.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Win32 API DLL
Exit code:
0
Version:
6.1.7601.17887 (win7sp1_gdr.120704-0720)
Modules
Images
c:\users\admin\desktop\123.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
3408"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\5250255863349248.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3796"C:\Users\admin\AppData\Roaming\speedlink\ПАКсЕыЦолИс.exe" C:\Users\admin\AppData\Roaming\speedlink\ПАКсЕыЦолИс.exe—DllHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Win32 API DLL
Exit code:
0
Version:
6.1.7601.17887 (win7sp1_gdr.120704-0720)
Modules
Images
c:\users\admin\appdata\roaming\speedlink\паксеыцолис.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
3852"C:\ProgramData\ПАКсЕыЦолИс.exe" C:\ProgramData\ПАКсЕыЦолИс.exe
123.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Win32 API DLL
Exit code:
0
Version:
6.1.7601.17887 (win7sp1_gdr.120704-0720)
Modules
Images
c:\programdata\паксеыцолис.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
Total events
854
Read events
827
Write events
27
Delete events
0

Modification events

(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3408) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\5250255863349248.zip
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3408) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2840) 123.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
2
Suspicious files
8
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3408.19244\11d59bad3177cbed5577816c93414343c0c745bdb226349b43ba5a9814007feb —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\CabF075.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\TarF076.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\CabF097.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\TarF098.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\Cab569.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\Tar56A.tmp —
MD5:—
SHA256:—
2840123.exeC:\ProgramData\ПАКсЕыЦолИс.exeexecutable
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Users\admin\AppData\Roaming\speedlink\settings.initext
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
4
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
184
ПАКсЕыЦолИс.exe
GET
200
23.23.243.154:80
http://api.ipify.org/
US
text
12 b
shared
184
ПАКсЕыЦолИс.exe
GET
200
13.107.4.50:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.6 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
184
ПАКсЕыЦолИс.exe
178.157.82.90:443
—
Nav Communications Srl
RO
suspicious
184
ПАКсЕыЦолИс.exe
31.184.253.6:443
—
—
RU
malicious
184
ПАКсЕыЦолИс.exe
23.23.243.154:80
api.ipify.org
Amazon.com, Inc.
US
malicious
184
ПАКсЕыЦолИс.exe
13.107.4.50:80
www.download.windowsupdate.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 13.107.4.50
whitelisted
api.ipify.org
  • 23.23.243.154
  • 54.204.36.156
  • 23.23.83.153
  • 107.22.215.20
  • 50.16.229.140
  • 23.21.121.219
  • 54.235.124.112
  • 54.243.198.12
shared
116.82.254.5.zen.spamhaus.org
  • —
unknown
116.82.254.5.cbl.abuseat.org
  • 127.0.0.2
unknown

Threats

PID
Process
Class
Message
184
ПАКсЕыЦолИс.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklist SSL certificate detected (Trickbot)
184
ПАКсЕыЦолИс.exe
A Network Trojan was detected
ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
184
ПАКсЕыЦолИс.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklist SSL certificate detected (Trickbot)
184
ПАКсЕыЦолИс.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup api.ipify.org
184
ПАКсЕыЦолИс.exe
A Network Trojan was detected
MALWARE [PTsecurity] Dyre/Trickbot/Dridex SSL connection
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5250255863349248.zip