File name:

SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046

Full analysis: https://app.any.run/tasks/50ab8e87-9547-4863-a60d-54b7908a830d
Verdict: Malicious activity
Analysis date: December 05, 2022, 17:30:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
snake
keylogger
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

3D8665C57C2A13C97F44D86D0D783A76

SHA1:

B75CB478899374CF529DA3A7B8DEBCA552E3721E

SHA256:

2758782D2F4BF1101CFBC91D0E9EB266A928EBA933FCE802B6412912CF792391

SSDEEP:

24576:YyeineevnvnF6FBlKqw+ULWAhZnVWk6PFv+Z9CLtdfDPm:Q6ewF6FkTzGFFCgLtF+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

    • SNAKEKEYLOGGER was detected

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

    • SNAKE detected by memory dumps

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

  • SUSPICIOUS

    • Reads the Internet Settings

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

    • Application launched itself

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2212)

    • Loads DLL from Mozilla Firefox

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

    • Connects to SMTP port

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

    • Checks for external IP

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

  • INFO

    • Reads the computer name

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2212)
      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

    • Checks supported languages

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2212)
      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)

    • Reads Environment values

      • SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe (PID: 2624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

SnakeKeylogger

(PID) Process(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
Credentials
PasswordqlRYaFn8
Username[email protected]
Port587
Hostus2.smtp.mailhostbox.com
ProtocolSMTP
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2048-Mar-30 06:14:20
Debug artifacts:
  • LcG8nIX.pdb
Comments:
CompanyName: Microsoft
FileDescription: Traffic Light
FileVersion: 1.0.0.0
InternalName: LcG8nIX.exe
LegalCopyright: Copyright © 2021
LegalTrademarks:
OriginalFilename: LcG8nIX.exe
ProductName: Traffic Light
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: 0
e_cparhdr: 4
e_minalloc: 0
e_maxalloc: 65535
e_ss: 0
e_sp: 184
e_csum: 0
e_ip: 0
e_cs: 0
e_ovno: 0
e_oemid: 0
e_oeminfo: 0
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2048-Mar-30 06:14:20
PointerToSymbolTable: 0
NumberOfSymbols: 0
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
1095284
1095680
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.34436
.rsrc
1105920
1472
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.14481
.reloc
1114112
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.32999
820
UNKNOWN
UNKNOWN
RT_VERSION
1 (#2)
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.win32.hacktoolx-gen.30740.31046.exe no specs securiteinfo.com.win32.hacktoolx-gen.30740.31046.exe no specs #SNAKE securiteinfo.com.win32.hacktoolx-gen.30740.31046.exe

Process information

PID
CMD
Path
Indicators
Parent process
2212"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe—Explorer.EXE
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Traffic Light
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.hacktoolx-gen.30740.31046.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2484"{path}"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe—SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Traffic Light
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.hacktoolx-gen.30740.31046.exe
c:\windows\system32\ntdll.dll
2624"{path}"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Traffic Light
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.hacktoolx-gen.30740.31046.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
SnakeKeylogger
(PID) Process(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
Credentials
PasswordqlRYaFn8
Username[email protected]
Port587
Hostus2.smtp.mailhostbox.com
ProtocolSMTP
Total events
771
Read events
759
Write events
12
Delete events
0

Modification events

(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2624) SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2624
SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
US
html
105 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2624
SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
208.91.199.224:587
us2.smtp.mailhostbox.com
UNIFIEDLAYER-AS-1
US
shared
2624
SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
193.122.6.168:80
checkip.dyndns.org
ORACLE-BMC-31898
DE
malicious

DNS requests

Domain
IP
Reputation
checkip.dyndns.org
  • 193.122.6.168
  • 132.226.8.169
  • 158.101.44.242
  • 132.226.247.73
  • 193.122.130.0
shared
us2.smtp.mailhostbox.com
  • 208.91.199.224
  • 208.91.199.223
  • 208.91.198.143
  • 208.91.199.225
shared

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
—
—
Misc activity
AV INFO Query to checkip.dyndns. Domain
2624
SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup - checkip.dyndns.org
2624
SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2023 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Win32.HacktoolX-gen.30740.31046