| File name: | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624 |
| Full analysis: | https://app.any.run/tasks/55dc8227-d36d-4a94-a006-96868e0d190e |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | December 11, 2023, 16:11:42 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 205023F0B5DA0FAD4322AD981A81678D |
| SHA1: | 5CEC710A22854521F271AD497872A6589F7709DC |
| SHA256: | 1C5E576CEBBCA18E8885E6BCE6F9169ED9C3E41DC4ADE05A6A79CDE44B27672E |
| SSDEEP: | 98304:brjwFmaUpCVQmupOkax+kyeoO8n+/G3k/3Qs8YJ3+KX1aAH6CBGyfOFtNCpsbIJz:ezxwQJIuRk7PslT |
MALICIOUS
Drops the executable file immediately after the start
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe (PID: 1936)
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe (PID: 2736)
- wmaconvert.exe (PID: 588)
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
Uses Task Scheduler to run other applications
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
SOCKS5SYSTEMZ has been detected (YARA)
- wmaconvert.exe (PID: 1616)
SUSPICIOUS
Process drops legitimate windows executable
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
Process drops SQLite DLL files
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
Drops 7-zip archiver for unpacking
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
Reads the Windows owner or organization settings
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
INFO
Checks supported languages
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe (PID: 2736)
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 1012)
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe (PID: 1936)
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
- wmaconvert.exe (PID: 1616)
- wmaconvert.exe (PID: 588)
Reads the computer name
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 1012)
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
- wmaconvert.exe (PID: 588)
Create files in a temporary directory
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe (PID: 1936)
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe (PID: 2736)
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
Creates files in the program directory
- SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp (PID: 272)
- wmaconvert.exe (PID: 588)
- wmaconvert.exe (PID: 1616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (77.7) |
|---|---|---|
| .exe | | | Win32 Executable Delphi generic (10) |
| .dll | | | Win32 Dynamic Link Library (generic) (4.6) |
| .exe | | | Win32 Executable (generic) (3.1) |
| .exe | | | Win16/32 Executable Delphi generic (1.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:12:11 13:20:26+01:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 37888 |
| InitializedDataSize: | 31744 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x9c40 |
| OSVersion: | 1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | ConvertWMA Setup |
| FileVersion: | |
| LegalCopyright: | |
| ProductName: | ConvertWMA |
| ProductVersion: | 1.2.1.1 |
Total processes
45
Monitored processes
9
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 272 | "C:\Users\admin\AppData\Local\Temp\is-476IF.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp" /SL5="$1C0178,6973457,68096,C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe" /SPAWNWND=$180136 /NOTIFYWND=$1C03D8 | C:\Users\admin\AppData\Local\Temp\is-476IF.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | — | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe | |||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
| 588 | "C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i | C:\Program Files (x86)\ConvertWMA\wmaconvert.exe | — | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 712 | "C:\Windows\system32\schtasks.exe" /Query | C:\Windows\SysWOW64\schtasks.exe | — | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1012 | "C:\Users\admin\AppData\Local\Temp\is-91LRK.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp" /SL5="$1C03D8,6973457,68096,C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe" | C:\Users\admin\AppData\Local\Temp\is-91LRK.tmp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | — | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
| 1616 | "C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s | C:\Program Files (x86)\ConvertWMA\wmaconvert.exe | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1936 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe" /SPAWNWND=$180136 /NOTIFYWND=$1C03D8 | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: ConvertWMA Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 2652 | C:\Windows\system32\net1 helpmsg 11 | C:\Windows\SysWOW64\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2736 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.exe | — | explorer.exe | |||||||||||
User: admin Company: Integrity Level: MEDIUM Description: ConvertWMA Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 2768 | "C:\Windows\system32\net.exe" helpmsg 11 | C:\Windows\SysWOW64\net.exe | — | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
909
Read events
909
Write events
0
Delete events
0
Modification events
Executable files
112
Suspicious files
5
Text files
14
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Users\admin\AppData\Local\Temp\is-1JIHQ.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Users\admin\AppData\Local\Temp\is-1JIHQ.tmp\_isetup\_iscrypt.dll | executable | |
MD5:A69559718AB506675E907FE49DEB71E9 | SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Users\admin\AppData\Local\Temp\is-1JIHQ.tmp\_isetup\_RegDLL.tmp | executable | |
MD5:0EE914C6F0BB93996C75941E1AD629C6 | SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2 | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Program Files (x86)\ConvertWMA\stuff\is-9JFVD.tmp | text | |
MD5:257D1BF38FA7859FFC3717EF36577C04 | SHA256:DFACC2F208EBF6D6180EE6E882117C31BB58E8B6A76A26FB07AC4F40E245A0CB | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Users\admin\AppData\Local\Temp\is-1JIHQ.tmp\_isetup\_isdecmp.dll | executable | |
MD5:3ADAA386B671C2DF3BAE5B39DC093008 | SHA256:71CD2F5BC6E13B8349A7C98697C6D2E3FCDEEA92699CEDD591875BEA869FAE38 | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Program Files (x86)\ConvertWMA\uninstall\unins000.exe | executable | |
MD5:7108BE4EB8F46AAAAC754D97F025D7BC | SHA256:601792C4F2791174E8913D04D9C08D17001611CAAAE08944BBC924AF385AE67E | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Program Files (x86)\ConvertWMA\uninstall\is-D9VI1.tmp | executable | |
MD5:7108BE4EB8F46AAAAC754D97F025D7BC | SHA256:601792C4F2791174E8913D04D9C08D17001611CAAAE08944BBC924AF385AE67E | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Program Files (x86)\ConvertWMA\stuff\is-VMMVF.tmp | text | |
MD5:992C00BEAB194CE392117BB419F53051 | SHA256:9E35C8E29CA055CE344E4C206E7B8FF1736158D0B47BF7B3DBC362F7EC7E722C | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Program Files (x86)\ConvertWMA\stuff\is-VEAI3.tmp | text | |
MD5:257D1BF38FA7859FFC3717EF36577C04 | SHA256:DFACC2F208EBF6D6180EE6E882117C31BB58E8B6A76A26FB07AC4F40E245A0CB | |||
| 272 | SecuriteInfo.com.Heuristic.HEUR.AGEN.1332570.26931.31624.tmp | C:\Program Files (x86)\ConvertWMA\stuff\is-R47AD.tmp | text | |
MD5:992C00BEAB194CE392117BB419F53051 | SHA256:9E35C8E29CA055CE344E4C206E7B8FF1736158D0B47BF7B3DBC362F7EC7E722C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |