File name:

v.sct

Full analysis: https://app.any.run/tasks/970888c7-1b3f-4d6f-8c19-548cadcff6cf
Verdict: Malicious activity
Threats:

Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.

Malware Trends Tracker     >>>
Analysis date: October 01, 2018, 10:38:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
loader
xmrig
miner
trojan
stealer
arkei
Indicators:
MIME: text/xml
File info: XML document, ASCII text
MD5:

84791BD6597C88A2D682012ADD8EACC3

SHA1:

51FAC40F5EA444D84478A67BBB99712F31025335

SHA256:

21E2856A78B7902585A1E312DDB46105D30CD847756D9A5F4FA0C1BC51CB4580

SSDEEP:

12:RlKudPRCOhUeqsMSUYr0pVuRI/CXG4HkRnUEeGnGHpcnE0RV4X4pk:/PQxeXMZAUuRIKXfERnUr8ZRV48k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1716)
      • cmd.exe (PID: 920)

    • Application was dropped or rewritten from another process

      • king.exe (PID: 2264)
      • DOC001.exe (PID: 2932)
      • doc.exe (PID: 3024)
      • java.exe (PID: 2232)
      • java12.exe (PID: 3708)
      • dhelper.exe (PID: 276)
      • ns8BDD.tmp (PID: 3432)
      • ns8CC8.tmp (PID: 2760)
      • ns8DA4.tmp (PID: 3924)
      • lsm.exe (PID: 3436)
      • jar2.exe (PID: 3948)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 3184)
      • king.exe (PID: 2264)
      • DOC001.exe (PID: 2932)

    • Loads dropped or rewritten executable

      • king.exe (PID: 2264)
      • DOC001.exe (PID: 2932)
      • jar2.exe (PID: 3948)

    • Changes the autorun value in the registry

      • DOC001.exe (PID: 2932)
      • jar2.exe (PID: 3948)

    • Writes to a start menu file

      • DOC001.exe (PID: 2932)

    • Uses Task Scheduler to run other applications

      • java12.exe (PID: 3708)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2444)

    • ARKEI was detected

      • java12.exe (PID: 3708)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3184)
      • king.exe (PID: 2264)
      • doc.exe (PID: 3024)
      • DOC001.exe (PID: 2932)
      • cmd.exe (PID: 2212)
      • cmd.exe (PID: 2240)

    • Executes PowerShell scripts

      • regsvr32.exe (PID: 1352)

    • Executable content was dropped or overwritten

      • king.exe (PID: 2264)
      • powershell.exe (PID: 3184)
      • doc.exe (PID: 3024)
      • DOC001.exe (PID: 2932)
      • java.exe (PID: 2232)
      • java12.exe (PID: 3708)
      • jar2.exe (PID: 3948)
      • cmd.exe (PID: 2240)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1736)
      • cmd.exe (PID: 3932)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 840)

    • Starts CMD.EXE for commands execution

      • king.exe (PID: 2264)
      • ns8BDD.tmp (PID: 3432)
      • ns8CC8.tmp (PID: 2760)
      • ns8DA4.tmp (PID: 3924)

    • Starts itself from another location

      • doc.exe (PID: 3024)

    • Dropped object may contain URLs of mainers pools

      • DOC001.exe (PID: 2932)

    • Creates files in the program directory

      • java12.exe (PID: 3708)

    • Starts application with an unusual extension

      • jar2.exe (PID: 3948)

  • INFO

    • Drop XMRig executable file

      • DOC001.exe (PID: 2932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
33
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start regsvr32.exe no specs powershell.exe king.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs doc.exe doc001.exe java.exe #ARKEI java12.exe schtasks.exe no specs jar2.exe ns8bdd.tmp no specs cmd.exe no specs ns8cc8.tmp no specs cmd.exe ns8da4.tmp no specs cmd.exe no specs taskkill.exe no specs dhelper.exe no specs lsm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276C:\Users\admin\AppData\Roaming\dhelper.exe C:\Users\admin\AppData\Roaming\dhelper.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\dhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
840cmd /C taskkill /f /im dhelper.exe & start C:\Users\admin\AppData\Roaming\dhelper.exeC:\Windows\system32\cmd.exe—ns8DA4.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
920"C:\Windows\system32\cmd.exe" /c net stop WindowscurryusC:\Windows\system32\cmd.exe—king.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1352"C:\Windows\System32\regsvr32.exe" /s /n /u /i:"C:\Users\admin\AppData\Local\Temp\v.sct" scrobj.dllC:\Windows\System32\regsvr32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1716"C:\Windows\system32\cmd.exe" /c net stop MpsSvccC:\Windows\system32\cmd.exe—king.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1736"C:\Windows\system32\cmd.exe" /c taskkill /f /im LSMOSE* & tskill LSMOSE*C:\Windows\system32\cmd.exe—king.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1772tskill LSMOSE*C:\Windows\system32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tskill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winsta.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1960tskill cab*C:\Windows\system32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tskill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winsta.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2084net stop WindowscurryusC:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2212cmd /C copy /b %temp%\Javatemp\ini.jwd C:\Users\admin\AppData\Roaming\cppredistx86.exeC:\Windows\system32\cmd.exe—ns8BDD.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 546
Read events
2 383
Write events
163
Delete events
0

Modification events

(PID) Process:(3184) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3184) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
Executable files
18
Suspicious files
3
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
3184powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DAV9KRKSAD0D93ULXXHS.temp —
MD5:—
SHA256:—
2232java.exeC:\Users\admin\AppData\Local\Temp\Javatemp\ini.jwd —
MD5:—
SHA256:—
3184powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5b62b6.TMPbinary
MD5:—
SHA256:—
3184powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
3948jar2.exeC:\Users\admin\AppData\Local\Temp\nsa8BDC.tmp\ns8BDD.tmp —
MD5:—
SHA256:—
2932DOC001.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnklnk
MD5:—
SHA256:—
2932DOC001.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\java[1].datexecutable
MD5:—
SHA256:—
3948jar2.exeC:\Users\admin\AppData\Local\Temp\nsa8BDC.tmp\ns8DA4.tmp —
MD5:—
SHA256:—
3948jar2.exeC:\Users\admin\AppData\Local\Temp\nsa8BDB.tmp —
MD5:—
SHA256:—
2232java.exeC:\Users\admin\AppData\Local\Temp\Javatemp\jare.7z1executable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
8
DNS requests
16
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3184
powershell.exe
GET
200
195.208.1.107:80
http://kr1s.ru/king.dat
RU
executable
45.0 Kb
suspicious
2932
DOC001.exe
GET
200
89.111.178.201:80
http://zcop.ru/java12.dat
RU
executable
200 Kb
suspicious
2264
king.exe
GET
200
195.208.1.107:80
http://kr1s.ru/doc.dat
RU
executable
1009 Kb
suspicious
2264
king.exe
GET
200
88.99.66.31:80
http://iplogger.co/1h9PN6.html
DE
image
116 b
shared
2932
DOC001.exe
GET
200
195.208.1.107:80
http://kr1s.ru/java.dat
RU
executable
2.04 Mb
suspicious
3708
java12.exe
POST
—
184.168.221.40:80
http://ioad.pw/ioad.exe
US
—
—
malicious
3708
java12.exe
POST
301
88.99.66.31:80
http://2no.co/1ajz97
DE
html
178 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2264
king.exe
195.208.1.107:80
kr1s.ru
Autonomous Non-commercial Organization Regional Network Information Center
RU
suspicious
2264
king.exe
88.99.66.31:80
iplogger.co
Hetzner Online GmbH
DE
malicious
3184
powershell.exe
195.208.1.107:80
kr1s.ru
Autonomous Non-commercial Organization Regional Network Information Center
RU
suspicious
3708
java12.exe
88.99.66.31:80
iplogger.co
Hetzner Online GmbH
DE
malicious
2932
DOC001.exe
89.111.178.201:80
zcop.ru
CJSC Registrar R01
RU
suspicious
2932
DOC001.exe
195.208.1.107:80
kr1s.ru
Autonomous Non-commercial Organization Regional Network Information Center
RU
suspicious
3708
java12.exe
88.99.66.31:443
iplogger.co
Hetzner Online GmbH
DE
malicious
3708
java12.exe
184.168.221.40:80
ioad.pw
GoDaddy.com, LLC
US
malicious

DNS requests

Domain
IP
Reputation
kr1s.ru
  • 195.208.1.107
suspicious
iplogger.co
  • 88.99.66.31
shared
zcop.ru
  • 89.111.178.201
suspicious
2no.co
  • 88.99.66.31
whitelisted
ioad.pw
  • 184.168.221.40
malicious
cb1d30efad.pw
  • —
malicious
a8833d0dc1.pw
  • —
unknown
3662450a7e.pw
  • —
unknown
df27340eb6.pw
  • —
unknown
31f16792e8.pw
  • —
unknown

Threats

PID
Process
Class
Message
3184
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3184
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2264
king.exe
A Network Trojan was detected
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
2264
king.exe
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
2264
king.exe
A Network Trojan was detected
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
2264
king.exe
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
2264
king.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2932
DOC001.exe
A Network Trojan was detected
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
2932
DOC001.exe
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
2932
DOC001.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
No debug info