analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

5250255863349248.zip

Full analysis: https://app.any.run/tasks/0a7652e3-098c-496b-8615-d76753923b59
Verdict: Malicious activity
Threats:

TrickBot is an advanced banking trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Malware Trends Tracker     >>>
Analysis date: August 25, 2019, 09:17:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trickbot
trojan
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

FD5946F2085CD379B53DE567E709E3D6

SHA1:

4C029A72EEBEFF5FA97E682542E3AFD5AB4DD12D

SHA256:

18E07E4292B5A0FAAC0DC1CCE366F7744025BF91ADBA3BFDCA99EA770A2B704A

SSDEEP:

6144:pi0cK+SfJvrEv6iZip+Le9qkU2cl1X0nadpc9l7c4JZ08UUCgPz+:U0cFwvIvy9Yjl1kazc9hNJZn7+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ПАКсЕыЦолИс.exe (PID: 3852)
      • 123.exe (PID: 2840)
      • ПАКсЕыЦолИс.exe (PID: 184)
      • ПАКсЕыЦолИс.exe (PID: 3796)

    • Loads the Task Scheduler COM API

      • ПАКсЕыЦолИс.exe (PID: 3796)
      • ПАКсЕыЦолИс.exe (PID: 184)

    • Known privilege escalation attack

      • DllHost.exe (PID: 2772)

    • Connects to CnC server

      • ПАКсЕыЦолИс.exe (PID: 184)

    • TRICKBOT was detected

      • ПАКсЕыЦолИс.exe (PID: 184)

  • SUSPICIOUS

    • Creates files in the program directory

      • 123.exe (PID: 2840)
      • ПАКсЕыЦолИс.exe (PID: 184)

    • Creates files in the user directory

      • ПАКсЕыЦолИс.exe (PID: 3852)
      • ПАКсЕыЦолИс.exe (PID: 184)

    • Starts itself from another location

      • 123.exe (PID: 2840)

    • Executable content was dropped or overwritten

      • 123.exe (PID: 2840)
      • ПАКсЕыЦолИс.exe (PID: 3852)

    • Executed via COM

      • DllHost.exe (PID: 2772)

    • Executed via Task Scheduler

      • ПАКсЕыЦолИс.exe (PID: 184)

    • Creates files in the Windows directory

      • ПАКсЕыЦолИс.exe (PID: 184)

    • Checks for external IP

      • ПАКсЕыЦолИс.exe (PID: 184)

    • Removes files from Windows directory

      • ПАКсЕыЦолИс.exe (PID: 184)

  • INFO

    • Manual execution by user

      • 123.exe (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 11d59bad3177cbed5577816c93414343c0c745bdb226349b43ba5a9814007feb
ZipUncompressedSize: 499712
ZipCompressedSize: 291279
ZipCRC: 0x00000000
ZipModifyDate: 1980:00:00 00:00:00
ZipCompression: Unknown (99)
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs 123.exe паксеыцолис.exe CMSTPLUA no specs паксеыцолис.exe no specs #TRICKBOT паксеыцолис.exe

Process information

PID
CMD
Path
Indicators
Parent process
3408"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\5250255863349248.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2840"C:\Users\admin\Desktop\123.exe" C:\Users\admin\Desktop\123.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Win32 API DLL
Exit code:
0
Version:
6.1.7601.17887 (win7sp1_gdr.120704-0720)
3852"C:\ProgramData\ПАКсЕыЦолИс.exe" C:\ProgramData\ПАКсЕыЦолИс.exe
123.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Win32 API DLL
Exit code:
0
Version:
6.1.7601.17887 (win7sp1_gdr.120704-0720)
2772C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3796"C:\Users\admin\AppData\Roaming\speedlink\ПАКсЕыЦолИс.exe" C:\Users\admin\AppData\Roaming\speedlink\ПАКсЕыЦолИс.exe—DllHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Win32 API DLL
Exit code:
0
Version:
6.1.7601.17887 (win7sp1_gdr.120704-0720)
184C:\Users\admin\AppData\Roaming\speedlink\ПАКсЕыЦолИс.exe C:\Users\admin\AppData\Roaming\speedlink\ПАКсЕыЦолИс.exe
taskeng.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Win32 API DLL
Version:
6.1.7601.17887 (win7sp1_gdr.120704-0720)
Total events
854
Read events
827
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
8
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3408WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3408.19244\11d59bad3177cbed5577816c93414343c0c745bdb226349b43ba5a9814007feb —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\CabF075.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\TarF076.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\CabF097.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\TarF098.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\Cab569.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\TEMP\Tar56A.tmp —
MD5:—
SHA256:—
184ПАКсЕыЦолИс.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015compressed
MD5:58A3BADC25E15583224E2B922F370A4F
SHA256:7E0630E9C468031329CAD1A21BFB37C12153BDA0F4D6298EE1B8682DD0C35F8A
184ПАКсЕыЦолИс.exeC:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:99CA3074A3E99F2E9DEA93F389BE9C3A
SHA256:990EDB7C2E21FB8FAE3E2C04DED5C31479442EB033499AED752995D8CAA45E5B
3852ПАКсЕыЦолИс.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:224A25EC632C7991C210657B8A63274F
SHA256:6E51E0D6940D1FC3A1047903631D75562BD332ABF8FF887BDE440C51B6A79596
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
184
ПАКсЕыЦолИс.exe
GET
200
23.23.243.154:80
http://api.ipify.org/
US
text
12 b
shared
184
ПАКсЕыЦолИс.exe
GET
200
13.107.4.50:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.6 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
184
ПАКсЕыЦолИс.exe
31.184.253.6:443
—
—
RU
malicious
184
ПАКсЕыЦолИс.exe
178.157.82.90:443
—
Nav Communications Srl
RO
suspicious
184
ПАКсЕыЦолИс.exe
13.107.4.50:80
www.download.windowsupdate.com
Microsoft Corporation
US
whitelisted
184
ПАКсЕыЦолИс.exe
23.23.243.154:80
api.ipify.org
Amazon.com, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 13.107.4.50
whitelisted
api.ipify.org
  • 23.23.243.154
  • 54.204.36.156
  • 23.23.83.153
  • 107.22.215.20
  • 50.16.229.140
  • 23.21.121.219
  • 54.235.124.112
  • 54.243.198.12
shared
116.82.254.5.zen.spamhaus.org
  • —
unknown
116.82.254.5.cbl.abuseat.org
  • 127.0.0.2
unknown

Threats

PID
Process
Class
Message
184
ПАКсЕыЦолИс.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklist SSL certificate detected (Trickbot)
184
ПАКсЕыЦолИс.exe
A Network Trojan was detected
ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
184
ПАКсЕыЦолИс.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklist SSL certificate detected (Trickbot)
184
ПАКсЕыЦолИс.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup api.ipify.org
184
ПАКсЕыЦолИс.exe
A Network Trojan was detected
MALWARE [PTsecurity] Dyre/Trickbot/Dridex SSL connection
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
5250255863349248.zip