analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

LOLChecker.zip

Full analysis: https://app.any.run/tasks/11fcce6c-7f78-4f8a-9beb-5652a6d7333e
Verdict: Malicious activity
Analysis date: July 12, 2020, 18:15:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C0E906FFFD00537D4E0B3310B4B65D9B

SHA1:

4D83910BB05F553D51558B4B09985853D40EDE88

SHA256:

232E082A7DC39ABDDCECDEA71623D860E787B57E6187F369248D21DCE45A33C0

SSDEEP:

12288:1t90A3AIqoYAgIn/Jzj/xkyWxUvpTljA4FUc0MJu+QE78WvZe78J:1t90A33qAgIB//yzUekttqWvhJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • leaguechecker.exe (PID: 2536)
      • leaguechecker.exe (PID: 4048)
      • LeagueOfLegendsChecker.exe (PID: 3720)
      • LeagueOfLegendsChecker.exe (PID: 1980)
      • LeagueOfLegendsChecker.exe (PID: 2660)
      • LeagueOfLegendsChecker.exe (PID: 2376)
      • leaguechecker.exe (PID: 2224)

    • Loads dropped or rewritten executable

      • leaguechecker.exe (PID: 4048)
      • leaguechecker.exe (PID: 2536)
      • LeagueOfLegendsChecker.exe (PID: 1980)
      • SearchProtocolHost.exe (PID: 3544)
      • LeagueOfLegendsChecker.exe (PID: 2376)
      • leaguechecker.exe (PID: 2224)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 852)

  • INFO

    • Manual execution by user

      • LeagueOfLegendsChecker.exe (PID: 2660)
      • leaguechecker.exe (PID: 2224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:01:16 03:33:11
ZipCRC: 0x8e0255fd
ZipCompressedSize: 5405
ZipUncompressedSize: 11264
ZipFileName: CheckerLib.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
9
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start winrar.exe leaguechecker.exe no specs leaguechecker.exe no specs leagueoflegendschecker.exe no specs leagueoflegendschecker.exe no specs searchprotocolhost.exe no specs leagueoflegendschecker.exe no specs leagueoflegendschecker.exe no specs leaguechecker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
852"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\LOLChecker.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
4048"C:\Users\admin\AppData\Local\Temp\Rar$EXa852.9194\leaguechecker.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa852.9194\leaguechecker.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
leaguechecker
Version:
1.0.0.0
2536"C:\Users\admin\AppData\Local\Temp\Rar$EXa852.9222\leaguechecker.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa852.9222\leaguechecker.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
leaguechecker
Version:
1.0.0.0
3720"C:\Users\admin\AppData\Local\Temp\Rar$EXa852.9886\LeagueOfLegendsChecker.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa852.9886\LeagueOfLegendsChecker.exe—WinRAR.exe
User:
admin
Company:
Microsofrt
Integrity Level:
MEDIUM
Description:
conhost
Exit code:
0
Version:
1.00.00.00
2376C:\Users\admin\AppData\Local\Temp\Rar$EXa852.9886\LeagueOfLegendsChecker.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa852.9886\LeagueOfLegendsChecker.exe—LeagueOfLegendsChecker.exe
User:
admin
Company:
Microsofrt
Integrity Level:
MEDIUM
Description:
conhost
Version:
1.00.00.00
3544"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2660"C:\Users\admin\Desktop\LeagueOfLegendsChecker.exe" C:\Users\admin\Desktop\LeagueOfLegendsChecker.exe—explorer.exe
User:
admin
Company:
Microsofrt
Integrity Level:
MEDIUM
Description:
conhost
Exit code:
0
Version:
1.00.00.00
1980C:\Users\admin\Desktop\LeagueOfLegendsChecker.exeC:\Users\admin\Desktop\LeagueOfLegendsChecker.exe—LeagueOfLegendsChecker.exe
User:
admin
Company:
Microsofrt
Integrity Level:
MEDIUM
Description:
conhost
Version:
1.00.00.00
2224"C:\Users\admin\Desktop\leaguechecker.exe" C:\Users\admin\Desktop\leaguechecker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
leaguechecker
Version:
1.0.0.0
Total events
491
Read events
463
Write events
0
Delete events
0

Modification events

No data
Executable files
15
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa852.12952\CheckerLib.dll —
MD5:—
SHA256:—
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa852.12952\Colorful.Console.dll —
MD5:—
SHA256:—
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa852.12952\Leaf.xNet.dll —
MD5:—
SHA256:—
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa852.12952\leaguechecker.exe —
MD5:—
SHA256:—
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa852.12952\LeagueOfLegendsChecker.exe —
MD5:—
SHA256:—
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa852.12952\proxies.txt —
MD5:—
SHA256:—
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa852.9194\CheckerLib.dllexecutable
MD5:B8CD9B796EDC9C7706AF4479499400B8
SHA256:9738870D3A13FCE8C806FFE703CBD12172113422468B62C68955E89AF3DA0418
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa852.9194\LeagueOfLegendsChecker.exeexecutable
MD5:CF808FE664EB2BF92728B7F0CD4570AC
SHA256:54E6A42DB0B342DA5B1DB376197C181651ED55228DEB82F302EF4124A0FCB539
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa852.9194\leaguechecker.exeexecutable
MD5:0D6371B27B3144DDBA1366A48686F741
SHA256:964B461CE00CFFD0884CB020406E95BA8AC3C59156D5F45E87D51ED18DBCA2E4
852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa852.9222\leaguechecker.exeexecutable
MD5:0D6371B27B3144DDBA1366A48686F741
SHA256:964B461CE00CFFD0884CB020406E95BA8AC3C59156D5F45E87D51ED18DBCA2E4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
LOLChecker.zip