| File name: | EzFrags v3.0.zip |
| Full analysis: | https://app.any.run/tasks/7c243a75-56e3-4363-9b27-cc9575432531 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | March 02, 2019, 17:08:56 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | B57FA970CFD58B0E628688E87BBCA757 |
| SHA1: | 655DEDBF8537D77A7A3F5C7263F31D7F2EA6B27C |
| SHA256: | 25B3AEBE738187F06902DED7CBA5F1475410725972AF46FF953F3CFF8F82A94D |
| SSDEEP: | 49152:PnZsDyt/HcLT81v578ozw2QKyPFMjBW/z2JJfi5pL0eXNCYB:ICHEu6BP5/zUB6x0e9Ck |
MALICIOUS
Application was dropped or rewritten from another process
- TC5.exe (PID: 3512)
- 1.exe (PID: 3204)
- Csgo v3.7.exe (PID: 3728)
- EzFrags v3.0.exe (PID: 2608)
Application was injected by another process
- explorer.exe (PID: 284)
Runs injected code in another process
- 1.exe (PID: 3204)
Connects to CnC server
- Csgo v3.7.exe (PID: 3728)
Stealing of credential data
- Csgo v3.7.exe (PID: 3728)
Actions looks like stealing of personal data
- Csgo v3.7.exe (PID: 3728)
Changes the autorun value in the registry
- explorer.exe (PID: 284)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3404)
- TC5.exe (PID: 3512)
- EzFrags v3.0.exe (PID: 2608)
- explorer.exe (PID: 284)
Creates files in the user directory
- TC5.exe (PID: 3512)
- EzFrags v3.0.exe (PID: 2608)
Reads the cookies of Google Chrome
- Csgo v3.7.exe (PID: 3728)
Connects to unusual port
- explorer.exe (PID: 284)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0009 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2019:01:18 22:19:14 |
| ZipCRC: | 0xccf22971 |
| ZipCompressedSize: | 2534893 |
| ZipUncompressedSize: | 2550466 |
| ZipFileName: | EzFrags v3.0.exe |
Total processes
35
Monitored processes
7
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 284 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2608 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb3404.7080\EzFrags v3.0.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb3404.7080\EzFrags v3.0.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: setup Exit code: 0 Version: 2.0.3698.9 Modules
| |||||||||||||||
| 3204 | "C:\Users\admin\AppData\Roaming\1.exe" | C:\Users\admin\AppData\Roaming\1.exe | — | TC5.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3404 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\EzFrags v3.0.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3432 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIb3404.6631\пароль 123.txt | C:\Windows\system32\NOTEPAD.EXE | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3512 | "C:\Users\admin\AppData\Roaming\TC5.exe" -s -pHJb159753369741LkH | C:\Users\admin\AppData\Roaming\TC5.exe | EzFrags v3.0.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3728 | "C:\Users\admin\AppData\Roaming\Csgo v3.7.exe" | C:\Users\admin\AppData\Roaming\Csgo v3.7.exe | TC5.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
1 187
Read events
1 127
Write events
60
Delete events
0
Modification events
| (PID) Process: | (3404) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3404) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3404) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3404) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\EzFrags v3.0.zip | |||
| (PID) Process: | (3404) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3404) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3404) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3404) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (284) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList |
| Operation: | write | Name: | a |
Value: WinRAR.exe | |||
| (PID) Process: | (284) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList |
| Operation: | write | Name: | MRUList |
Value: a | |||
Executable files
5
Suspicious files
1
Text files
3
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3728 | Csgo v3.7.exe | C:\Users\admin\AppData\Local\glo9ddohsn0g\google_chrome_default_ccdata.txt | — | |
MD5:— | SHA256:— | |||
| 3512 | TC5.exe | C:\Users\admin\AppData\Roaming\1.exe | executable | |
MD5:— | SHA256:— | |||
| 284 | explorer.exe | C:\ProgramData\SfClient.exe | executable | |
MD5:— | SHA256:— | |||
| 3404 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3404.7080\EzFrags v3.0.exe | executable | |
MD5:— | SHA256:— | |||
| 3728 | Csgo v3.7.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LoginData1 | sqlite | |
MD5:— | SHA256:— | |||
| 3512 | TC5.exe | C:\Users\admin\AppData\Roaming\Csgo v3.7.exe | executable | |
MD5:— | SHA256:— | |||
| 3728 | Csgo v3.7.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Web Data1 | sqlite | |
MD5:— | SHA256:— | |||
| 3404 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb3404.7080\settings.ini | text | |
MD5:— | SHA256:— | |||
| 3728 | Csgo v3.7.exe | C:\Users\admin\AppData\Local\glo9ddohsn0g\google_chrome_default_cookie.txt | text | |
MD5:— | SHA256:— | |||
| 3728 | Csgo v3.7.exe | C:\Users\admin\AppData\Local\glo9ddohsn0g\google_chrome_default_logins.txt | text | |
MD5:8CD3E621740BE01918DBD04A08733B6A | SHA256:2ED9E01F2B6C815EC72FF815CD9911195E67DAB9EEF4C40BFF7F9A878722F688 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
3
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3728 | Csgo v3.7.exe | POST | 302 | 92.53.96.158:80 | http://ce47086.tmweb.ru/landing.php | RU | html | 161 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3728 | Csgo v3.7.exe | 92.53.96.158:80 | ce47086.tmweb.ru | TimeWeb Ltd. | RU | malicious |
3728 | Csgo v3.7.exe | 92.53.96.158:443 | ce47086.tmweb.ru | TimeWeb Ltd. | RU | malicious |
284 | explorer.exe | 37.140.199.65:31890 | — | Domain names registrar REG.RU, Ltd | RU | malicious |
284 | explorer.exe | 194.58.92.63:31890 | — | Domain names registrar REG.RU, Ltd | RU | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google-public-dns-b.google.com |
| whitelisted |
ce47086.tmweb.ru |
| malicious |
vh90.timeweb.ru |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3728 | Csgo v3.7.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan.PWS.Stealer.24798 |
3728 | Csgo v3.7.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Spy.Win32.Stealer.cvq |
1 ETPRO signatures available at the full report