analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://down10d.zol.com.cn/zoldownload_os/YoudaoDict8.6.2@81_313019.exe/

Full analysis: https://app.any.run/tasks/42b47151-aeaf-492d-94ac-4dc049489dfb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 21, 2022, 05:33:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

F9D1B3874175EB808142C6E62521F6B0

SHA1:

9167F2E6506CC1D07F4A218C257AA5075A513FF2

SHA256:

34697D8EBC4B2F6256518C5AE356BB45F5037E6BADB386147BE4C11E02EDBAF2

SSDEEP:

3:N1KaKhmI6zKnkKhxdjvSUc0dv:CabzaSUrJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • iexplore.exe (PID: 920)
      • iexplore.exe (PID: 2444)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 920)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2444)
      • iexplore.exe (PID: 920)

    • Drops a file with a compile date too recent

      • iexplore.exe (PID: 920)
      • iexplore.exe (PID: 2444)

    • Starts Internet Explorer

      • rundll32.exe (PID: 2568)

    • Uses RUNDLL32.EXE to load library

      • iexplore.exe (PID: 2444)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2444)
      • iexplore.exe (PID: 920)
      • rundll32.exe (PID: 2568)
      • iexplore.exe (PID: 2084)

    • Checks supported languages

      • iexplore.exe (PID: 920)
      • iexplore.exe (PID: 2444)
      • rundll32.exe (PID: 2568)
      • iexplore.exe (PID: 2084)

    • Application launched itself

      • iexplore.exe (PID: 2444)

    • Changes internet zones settings

      • iexplore.exe (PID: 2444)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2444)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2444)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2444)
      • iexplore.exe (PID: 920)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2444)
      • iexplore.exe (PID: 920)

    • Creates files in the user directory

      • iexplore.exe (PID: 920)
      • iexplore.exe (PID: 2444)

    • Reads internet explorer settings

      • iexplore.exe (PID: 920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe rundll32.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2444"C:\Program Files\Internet Explorer\iexplore.exe" "http://down10d.zol.com.cn/zoldownload_os/YoudaoDict8.6.2@81_313019.exe/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
920"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2444 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2568"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\YoudaoDict8.6.2@81_313019[1]C:\Windows\system32\rundll32.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2084"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkId=57426&Ext=2@81_313019[1]C:\Program Files\Internet Explorer\iexplore.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
Total events
15 061
Read events
14 921
Write events
139
Delete events
1

Modification events

(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30960852
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30960852
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2444) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
3
Suspicious files
15
Text files
87
Unknown types
8

Dropped files

PID
Process
Filename
Type
2444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\YoudaoDict8.6.2@81_313019[1]executable
MD5:796C596185E63803A4EC4003AA60F425
SHA256:1CDD71F3FE9AA641D53864265AA950562B9290B3F143B2E52A03D2011B348FA4
920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:199129CAED6099F8A9D28ECFC01A43F1
SHA256:0EC8076AD0F9C728886BAF2B51C2E31F1E9E63C452BCB6711CBBA0E3BCA57746
920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:AC8FE9D561E9E7288AECF13F03AEA3D1
SHA256:CECD911136F3CCBE6F4869CBCBD9FD15B3FA91CD2FD49B9655FA3BCF8E932C05
920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\YoudaoDict8.6.2@81_313019[1]executable
MD5:4DBA88380C4C0DF323FAC480539D2974
SHA256:58DE5E74D6B9B7294717523A6F1CA3B454D6FE01FDE0C3A961FE7EF439AFB367
2444iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF68738AAD58971CCD.TMPgmc
MD5:19A0915635292FF3087F400B16220866
SHA256:52473AFBE1C4E89B3ED6735B458963A2D691111363C722D9820E41BDA66B519F
2444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{85F35AD7-D8C7-11EC-B7B7-12A9866C77DE}.datbinary
MD5:31D41121EC8797B61A83BE13AA641224
SHA256:FB6F798D9169DBDE19F2FFE5DEFAD666E8F0AAA8C1ED9AF3250F8CFA730CFB9A
920iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\D42MAHP8.txttext
MD5:1842BD4C8AD4FA951C9ED4CE5A213405
SHA256:C7288DA03E53B69F8DCB2B37464C05FAF2DF09D730FCA59A86668EA2BD5CB94D
920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\search[1].htmhtml
MD5:716425E44F33E7D8584C711CAC87D3CD
SHA256:85DE4F9AE279D99C8D5FEF65EA092FC40CBC22F75D0674589363BB7C06EE0408
920iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z2XBQOAX.txttext
MD5:0DC7D5DE7AEDBB12936105622BDA3002
SHA256:75C34760FAC3DC56C2D629CADEBDC4B3E86AC36995ECF6D18909307E9851799B
2444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\YoudaoDict8.6.2@81_313019[1].qkag721.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
920
iexplore.exe
GET
301
92.123.195.121:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=2%4081_313019%5b1%5d
unknown
—
—
whitelisted
920
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
920
iexplore.exe
GET
200
42.249.218.79:80
http://down10d.zol.com.cn/zoldownload_os/YoudaoDict8.6.2@81_313019.exe/
CN
executable
1.49 Mb
malicious
920
iexplore.exe
GET
200
67.27.158.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f8de64aefa9366de
US
compressed
4.70 Kb
whitelisted
2444
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
920
iexplore.exe
GET
200
67.27.158.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c5452ec078a5ec59
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
920
iexplore.exe
42.249.218.79:80
down10d.zol.com.cn
No.31,Jin-rong Street
CN
suspicious
920
iexplore.exe
92.123.195.121:80
shell.windows.com
Akamai International B.V.
—
suspicious
920
iexplore.exe
104.92.93.19:443
go.microsoft.com
Akamai Technologies, Inc.
NL
unknown
920
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
920
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
920
iexplore.exe
67.27.158.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
2444
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2444
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2444
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
920
iexplore.exe
40.126.32.138:443
login.microsoftonline.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
down10d.zol.com.cn
  • 42.249.218.79
  • 42.249.218.80
malicious
go.microsoft.com
  • 104.92.93.19
whitelisted
ctldl.windowsupdate.com
  • 67.27.158.254
  • 67.27.157.254
  • 8.248.137.254
  • 67.27.157.126
  • 8.241.123.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
shell.windows.com
  • 92.123.195.121
  • 92.123.195.108
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
login.microsoftonline.com
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.76
  • 40.126.32.134
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.133
  • 20.190.160.20
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.140
  • 40.126.32.74
  • 20.190.160.22
whitelisted

Threats

PID
Process
Class
Message
920
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://down10d.zol.com.cn/zoldownload_os/YoudaoDict8.6.2@81_313019.exe/