URL:

http://cdn.gxx.garenanow.com/gxx/pc/installer/Garena-v2.0.exe

Full analysis: https://app.any.run/tasks/61c6352f-1387-4b39-836a-539cff6bb67d
Verdict: Malicious activity
Analysis date: April 28, 2020, 09:35:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6E36899140E567FA7C5C96391DE825FE

SHA1:

81950CCCED3A1C3BA9198146A43B5924FD38D7E5

SHA256:

1D4F6E412B51568237576D73653DFB829152E4A9A76C16FB86E0AC88F213437D

SSDEEP:

3:N1KdBL6JHQYobyRgOXKQ9TXLhN:CXsHSGgOXrbhN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Garena-v2.0.exe (PID: 1500)
      • Garena-v2.0.exe (PID: 3988)
      • gxxsvc.exe (PID: 3940)
      • gxxsvc.exe (PID: 1412)
      • gxxsvc.exe (PID: 3796)
      • Garena.exe (PID: 3980)

    • Loads dropped or rewritten executable

      • Garena-v2.0.exe (PID: 3988)
      • gxxsvc.exe (PID: 1412)
      • gxxsvc.exe (PID: 3940)
      • Garena.exe (PID: 3980)
      • gxxsvc.exe (PID: 3796)

    • Loads the Task Scheduler COM API

      • gxxsvc.exe (PID: 3796)
      • gxxsvc.exe (PID: 3940)
      • gxxsvc.exe (PID: 1412)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3844)
      • Garena-v2.0.exe (PID: 3988)

    • Executed as Windows Service

      • gxxsvc.exe (PID: 1412)

    • Creates files in the program directory

      • gxxsvc.exe (PID: 3796)
      • Garena.exe (PID: 3980)
      • Garena-v2.0.exe (PID: 3988)

    • Creates a software uninstall entry

      • Garena-v2.0.exe (PID: 3988)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 3844)
      • chrome.exe (PID: 2784)
      • Garena.exe (PID: 3980)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3844)

    • Application launched itself

      • chrome.exe (PID: 3844)

    • Manual execution by user

      • Garena.exe (PID: 3980)

    • Dropped object may contain Bitcoin addresses

      • Garena-v2.0.exe (PID: 3988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
17
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs garena-v2.0.exe no specs garena-v2.0.exe gxxsvc.exe no specs gxxsvc.exe no specs gxxsvc.exe no specs garena.exe

Process information

PID
CMD
Path
Indicators
Parent process
588"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=992,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=10542353187299715073 --mojo-platform-channel-handle=2660 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1168"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6ebaa9d0,0x6ebaa9e0,0x6ebaa9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1232"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5513756083892965632 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1412"C:\Program Files\Garena\Garena\2.0.1909.2618\gxxsvc.exe" runC:\Program Files\Garena\Garena\2.0.1909.2618\gxxsvc.exe—services.exe
User:
SYSTEM
Company:
Garena Online
Integrity Level:
SYSTEM
Description:
Garena platform service
Exit code:
0
Version:
2019.09.26.1824
Modules
Images
c:\program files\garena\garena\2.0.1909.2618\gxxsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1500"C:\Users\admin\Downloads\Garena-v2.0.exe" C:\Users\admin\Downloads\Garena-v2.0.exe—chrome.exe
User:
admin
Company:
Garena
Integrity Level:
MEDIUM
Description:
Garena Installer
Exit code:
3221226540
Version:
2.0.1909.2618
Modules
Images
c:\users\admin\downloads\garena-v2.0.exe
c:\systemroot\system32\ntdll.dll
2784"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=992,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=15544146488392817661 --mojo-platform-channel-handle=1636 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3168"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3316 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=992,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=11230891313373184931 --mojo-platform-channel-handle=2680 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3764"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7614343093143451892 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3796"C:\Program Files\Garena\Garena\2.0.1909.2618\gxxsvc.exe" uninstallC:\Program Files\Garena\Garena\2.0.1909.2618\gxxsvc.exe—Garena-v2.0.exe
User:
admin
Company:
Garena Online
Integrity Level:
HIGH
Description:
Garena platform service
Exit code:
0
Version:
2019.09.26.1824
Modules
Images
c:\program files\garena\garena\2.0.1909.2618\gxxsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 313
Read events
1 241
Write events
69
Delete events
3

Modification events

(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3168) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3844-13232540151309500
Value:
259
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3844) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(3844) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
98
Suspicious files
77
Text files
360
Unknown types
16

Dropped files

PID
Process
Filename
Type
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5EA7F8F7-F04.pma —
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\284a7b38-60fa-4eba-866f-368bb9f19d30.tmp —
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFa6e23a.TMPtext
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old —
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
3844chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RFa6e45d.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
23
DNS requests
15
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3980
Garena.exe
HEAD
200
2.16.186.57:80
http://cdn.gxx.garenanow.com/gxx/gamecenter/app/0000/010/001/home_banner/10001-banner-assets-1488534080.jpg
unknown
—
—
whitelisted
3988
Garena-v2.0.exe
POST
200
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
text
4 b
unknown
3988
Garena-v2.0.exe
POST
200
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
text
4 b
unknown
3988
Garena-v2.0.exe
POST
200
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
text
4 b
unknown
3988
Garena-v2.0.exe
POST
200
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
text
4 b
unknown
3980
Garena.exe
GET
206
2.16.186.57:80
http://cdn.gxx.garenanow.com/gxx/gamecenter/app/0000/010/001/home_banner/10001-banner-assets-1488534080.jpg
unknown
image
33.2 Kb
whitelisted
3988
Garena-v2.0.exe
POST
200
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
text
4 b
unknown
3980
Garena.exe
GET
200
2.16.186.96:80
http://cdn.gxx.garenanow.com/gxx/gamecenter/login-banner/00.json?version=1567263642
unknown
text
201 b
whitelisted
3988
Garena-v2.0.exe
POST
200
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
text
4 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2784
chrome.exe
172.217.18.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2784
chrome.exe
2.16.186.57:80
cdn.gxx.garenanow.com
Akamai International B.V.
—
whitelisted
2784
chrome.exe
172.217.22.45:443
accounts.google.com
Google Inc.
US
whitelisted
2784
chrome.exe
172.217.16.164:443
www.google.com
Google Inc.
US
whitelisted
2784
chrome.exe
172.217.16.195:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2784
chrome.exe
2.16.186.96:80
cdn.gxx.garenanow.com
Akamai International B.V.
—
whitelisted
—
—
2.16.186.96:80
cdn.gxx.garenanow.com
Akamai International B.V.
—
whitelisted
3980
Garena.exe
2.16.186.96:80
cdn.gxx.garenanow.com
Akamai International B.V.
—
whitelisted
3980
Garena.exe
2.16.186.57:80
cdn.gxx.garenanow.com
Akamai International B.V.
—
whitelisted
3980
Garena.exe
122.11.128.49:19900
udp.gxx.garenanow.com
StarHub Internet Exchange
SG
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.18.3
whitelisted
cdn.gxx.garenanow.com
  • 2.16.186.57
  • 2.16.186.96
whitelisted
accounts.google.com
  • 172.217.22.45
shared
www.google.com
  • 172.217.16.164
malicious
ssl.gstatic.com
  • 172.217.16.195
whitelisted
www.gstatic.com
  • 172.217.22.3
whitelisted
clients1.google.com
  • 172.217.16.206
whitelisted
sb-ssl.google.com
  • 172.217.16.142
whitelisted
statscollection.garenanow.com
  • 203.117.172.231
unknown
udp.gxx.garenanow.com
  • 122.11.128.48
  • 122.11.128.49
unknown

Threats

PID
Process
Class
Message
2784
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2784
chrome.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2784
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
2784
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
Garena-v2.0.exe
{"id":"gxx","action":"0","data":{"ver":"2.0.1909.2618", "patch":"0", "stage":"init"}}
Garena-v2.0.exe
CSRSS.EXE
Garena-v2.0.exe
SVCHOST.EXE
Garena-v2.0.exe
SVCHOST.EXE
Garena-v2.0.exe
SVCHOST.EXE
Garena-v2.0.exe
SVCHOST.EXE
Garena-v2.0.exe
CTFMON.EXE
Garena-v2.0.exe
SMSS.EXE
Garena-v2.0.exe
curl_easy_perform() failed: Failed writing received data to disk/application
Garena-v2.0.exe
WININIT.EXE
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://cdn.gxx.garenanow.com/gxx/pc/installer/Garena-v2.0.exe